The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
1answer
22 views

What to use instead of wp_kses() in user output

I need some help here. While developing a theme, I want to make sure there are no security issues. So all dynamic data must be correctly escaped for the context where it is rendered. I know how to ...
1
vote
1answer
122 views

esc_attr not working in shortcode

I have a shortcode that outputs a block of html. One element in the block is an anchor tag with an image caption in the title attribute. Some of the captions I am using have double quotes in them, so ...
1
vote
1answer
495 views

wp_specialchars and wp_specialchars_decode in a shortcode plugin

I have written my first plugin, a shortcode plugin. I have read about wp_specialchars and wp_specialchars_decode but I'm not sure how to use them. The plugin read a shortcode allowing some parameters ...
0
votes
1answer
18 views

Updating a post without escaping ampersands?

I've found that wp_update_post() escapes all ampersands provided in the post's post_content. I'm trying to update a post without converting ampersands to &. (I need to add plaintext URLs ...
0
votes
1answer
28 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
0
votes
1answer
94 views

Is it necessary to escape LIKE term in WP_User_Query?

While searching for partial string searches using WP_User_Query I came across this answer by @kaiser who has provided some great answers here on Stackexchange. However, I was confused over the use of ...
1
vote
0answers
20 views

mysql_real_escape_string() vs. esc_sql() in WordPress

Does mysql_real_escape_string() and esc_sql() in WordPress both do the same work? I tried following the following: $fetch_row='<p>And againĀ for single posts</p>' echo ...
1
vote
0answers
57 views

esc_js() breaks unicode sequences by removing the slash '\' character

I've noticed that esc_js() is breaking unicode encoded characters by removing the '\' (slash) character. For example: esc_js('\u041f') returns: 'u041f' I can potentially use REGEX to identify ...
1
vote
0answers
163 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
0
votes
0answers
24 views

site_url() returns with additional backslashes

I am using site_url() function and it returns the address as http:\/\/vip.local\/cc where I can see that WP automatically adds unnecessary backslashes. Is this for some escaping purpose? I tried using ...
0
votes
0answers
150 views

How to modify wp_kses_post() so it will escape unknown HTML instead of remove it?

I have a site that uses the basic editor (not TinyMCE) to allow registered users to create posts. However, they need to be able to have text in their post that LOOKS like html. Since these are not ...
0
votes
0answers
31 views

Where is escaped the shortcode?

I'm working with a function that returns a list of posts which has the same type as the actual post. Actually, it returns a list of links with title on anchor link and let to use it with a shortcode: ...
0
votes
0answers
67 views

Code auto escaping is not working when using short codes

I'm using this ages old, but still well working, plugin (source code here) to auto escape html inside <code>. All is well and good until I tried to use short codes to form the ...