The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
2answers
163 views

Allow HTML in Settings API input field

I want to allow HTML into a plugin input field via a user, I am using the Settings API, but it strips everything HTML out. - Code below -any pointers? function plugin_settings(){ register_Setting( ...
1
vote
1answer
215 views

esc_attr not working in shortcode

I have a shortcode that outputs a block of html. One element in the block is an anchor tag with an image caption in the title attribute. Some of the captions I am using have double quotes in them, so ...
0
votes
1answer
46 views

Proper way to use esc_html__ and esc_attr__ etc for escaping value for translation

From the articles on Codex, esc_attr_e is proper way to escaping value for translation. But from other articles, I read about sanitizing issue and security issue for some escaping code. For my code, I ...
0
votes
1answer
111 views

Updating a post without escaping ampersands?

I've found that wp_update_post() escapes all ampersands provided in the post's post_content. I'm trying to update a post without converting ampersands to &. (I need to add plaintext URLs ...
0
votes
1answer
33 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
2
votes
0answers
439 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
1
vote
0answers
120 views

mysql_real_escape_string() vs. esc_sql() in WordPress

Does mysql_real_escape_string() and esc_sql() in WordPress both do the same thing? I tried the following: $fetch_row='<p>And again for single posts</p>' echo mysql_real_escape_string( ...
1
vote
0answers
99 views

esc_js() breaks unicode sequences by removing the slash '\' character

I've noticed that esc_js() is breaking unicode encoded characters by removing the '\' (slash) character. For example: esc_js('\u041f') returns: 'u041f' I can potentially use REGEX to identify ...
0
votes
0answers
17 views

Escaping and sanitization

I have created a custom metabox for a certain plugin - events CPT. In it I can add talks by event days, with images, speaker names, descriptions, titles and times. So all either input fields or ...
0
votes
0answers
25 views

wpdb insert escaping

I have created a function that adds some data to a database table using wpdb->insert() Each time the form is submit it adds back slashes to single quote ' character, if form validation fails and ...
0
votes
0answers
39 views

site_url() returns with additional backslashes

I am using site_url() function and it returns the address as http:\/\/vip.local\/cc where I can see that WP automatically adds unnecessary backslashes. Is this for some escaping purpose? I tried using ...
0
votes
0answers
39 views

Where is escaped the shortcode?

I'm working with a function that returns a list of posts which has the same type as the actual post. Actually, it returns a list of links with title on anchor link and let to use it with a shortcode: ...
0
votes
0answers
77 views

Code auto escaping is not working when using short codes

I'm using this ages old, but still well working, plugin (source code here) to auto escape html inside <code>. All is well and good until I tried to use short codes to form the ...