The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
2answers
75 views

Allow HTML in Settings API input field

I want to allow HTML into a plugin input field via a user, I am using the Settings API, but it strips everything HTML out. - Code below -any pointers? function plugin_settings(){ register_Setting( ...
1
vote
1answer
189 views

esc_attr not working in shortcode

I have a shortcode that outputs a block of html. One element in the block is an anchor tag with an image caption in the title attribute. Some of the captions I am using have double quotes in them, so ...
1
vote
1answer
733 views

wp_specialchars and wp_specialchars_decode in a shortcode plugin

I have written my first plugin, a shortcode plugin. I have read about wp_specialchars and wp_specialchars_decode but I'm not sure how to use them. The plugin read a shortcode allowing some parameters ...
0
votes
1answer
83 views

Updating a post without escaping ampersands?

I've found that wp_update_post() escapes all ampersands provided in the post's post_content. I'm trying to update a post without converting ampersands to &. (I need to add plaintext URLs ...
0
votes
1answer
33 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
0
votes
1answer
110 views

Is it necessary to escape LIKE term in WP_User_Query?

While searching for partial string searches using WP_User_Query I came across this answer by @kaiser who has provided some great answers here on Stackexchange. However, I was confused over the use of ...
2
votes
0answers
343 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
1
vote
0answers
101 views

mysql_real_escape_string() vs. esc_sql() in WordPress

Does mysql_real_escape_string() and esc_sql() in WordPress both do the same thing? I tried the following: $fetch_row='<p>And again for single posts</p>' echo mysql_real_escape_string( ...
1
vote
0answers
96 views

esc_js() breaks unicode sequences by removing the slash '\' character

I've noticed that esc_js() is breaking unicode encoded characters by removing the '\' (slash) character. For example: esc_js('\u041f') returns: 'u041f' I can potentially use REGEX to identify ...
0
votes
0answers
25 views

wpdb insert escaping

I have created a function that adds some data to a database table using wpdb->insert() Each time the form is submit it adds back slashes to single quote ' character, if form validation fails and ...
0
votes
0answers
37 views

site_url() returns with additional backslashes

I am using site_url() function and it returns the address as http:\/\/vip.local\/cc where I can see that WP automatically adds unnecessary backslashes. Is this for some escaping purpose? I tried using ...
0
votes
0answers
38 views

Where is escaped the shortcode?

I'm working with a function that returns a list of posts which has the same type as the actual post. Actually, it returns a list of links with title on anchor link and let to use it with a shortcode: ...
0
votes
0answers
75 views

Code auto escaping is not working when using short codes

I'm using this ages old, but still well working, plugin (source code here) to auto escape html inside <code>. All is well and good until I tried to use short codes to form the ...