The tag has no usage guidance.

learn more… | top users | synonyms

1
vote
1answer
151 views

esc_attr not working in shortcode

I have a shortcode that outputs a block of html. One element in the block is an anchor tag with an image caption in the title attribute. Some of the captions I am using have double quotes in them, so ...
1
vote
1answer
599 views

wp_specialchars and wp_specialchars_decode in a shortcode plugin

I have written my first plugin, a shortcode plugin. I have read about wp_specialchars and wp_specialchars_decode but I'm not sure how to use them. The plugin read a shortcode allowing some parameters ...
0
votes
1answer
44 views

Updating a post without escaping ampersands?

I've found that wp_update_post() escapes all ampersands provided in the post's post_content. I'm trying to update a post without converting ampersands to &. (I need to add plaintext URLs ...
0
votes
1answer
33 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
0
votes
1answer
107 views

Is it necessary to escape LIKE term in WP_User_Query?

While searching for partial string searches using WP_User_Query I came across this answer by @kaiser who has provided some great answers here on Stackexchange. However, I was confused over the use of ...
1
vote
0answers
52 views

mysql_real_escape_string() vs. esc_sql() in WordPress

Does mysql_real_escape_string() and esc_sql() in WordPress both do the same thing? I tried the following: $fetch_row='<p>And again for single posts</p>' echo mysql_real_escape_string( ...
1
vote
0answers
79 views

esc_js() breaks unicode sequences by removing the slash '\' character

I've noticed that esc_js() is breaking unicode encoded characters by removing the '\' (slash) character. For example: esc_js('\u041f') returns: 'u041f' I can potentially use REGEX to identify ...
1
vote
0answers
231 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
0
votes
0answers
17 views

wpdb insert escaping

I have created a function that adds some data to a database table using wpdb->insert() Each time the form is submit it adds back slashes to single quote ' character, if form validation fails and ...
0
votes
0answers
32 views

site_url() returns with additional backslashes

I am using site_url() function and it returns the address as http:\/\/vip.local\/cc where I can see that WP automatically adds unnecessary backslashes. Is this for some escaping purpose? I tried using ...
0
votes
0answers
249 views

How to modify wp_kses_post() so it will escape unknown HTML instead of remove it?

I have a site that uses the basic editor (not TinyMCE) to allow registered users to create posts. However, they need to be able to have text in their post that LOOKS like html. Since these are not ...
0
votes
0answers
34 views

Where is escaped the shortcode?

I'm working with a function that returns a list of posts which has the same type as the actual post. Actually, it returns a list of links with title on anchor link and let to use it with a shortcode: ...
0
votes
0answers
71 views

Code auto escaping is not working when using short codes

I'm using this ages old, but still well working, plugin (source code here) to auto escape html inside <code>. All is well and good until I tried to use short codes to form the ...