The tag has no usage guidance.

learn more… | top users | synonyms

10
votes
2answers
3k views

Should I escape wordpress functions like the_title, the_excerpt, the_content

I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development ...
9
votes
2answers
3k views

Should HTML output be passed through esc_html() AND wp_kses()?

I'm confused about the different uses of esc_html() and wp_kses(). I understand that esc_html() converts special characters to their HTML entity, and that wp_kses() removes unwanted tags (e.g., <...
8
votes
1answer
1k views

From a security standpoint, should bloginfo() or get_bloginfo() be escaped?

I've been reviewing a lot of information about WP theme and plugin security and understand the concept that you should escape attributes and HTML values in themes and plugins. I've seen bloginfo() and ...
6
votes
3answers
10k views

How to prevent escaping when saving HTML code in an option value?

I have a Theme Options page where the user can add certain options like Facebook links, etc. One of the options is for some ad code and when saving it as an option it gets escaped over and over again. ...
6
votes
1answer
277 views

What to use instead of wp_kses() in user output

I need some help here. While developing a theme, I want to make sure there are no security issues. So all dynamic data must be correctly escaped for the context where it is rendered. I know how to ...
5
votes
1answer
3k views

How to use wildcards in $wpdb queries using $wpdb->get_results & $wpdb->prepare?

I am attempting to make a custom search for BuddyPress groups. Here is my method: public function search_groups($string){ global $wpdb; $results = $wpdb->get_results($wpdb->prepare( ...
5
votes
1answer
1k views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
4
votes
2answers
109 views

esc before saving or before displaying does it matter?

In a lot of how to create a custom meta box tutorials, when saving data, i.e., update_post_meta the data is escaped: update_post_meta( $post_id, 'city', esc_attr( ucwords( $_POST['city'] ) ) ); ...
4
votes
1answer
4k views

Difference between esc_url() and esc_url_raw()

http://core.trac.wordpress.org/browser/trunk/wp-includes/formatting.php#L2239 I'm confused about when should either of them be used. Assuming I have this URL: http://site.com/?getsomejavascript=1, ...
4
votes
1answer
48 views

Do I need to escape data passed to wp_localize_script()?

Title pretty much says it all. I took a look at the source, and I didn't see any escaping being done. But, I can't say for sure. wp_localize_script( 'script-hook', 'object_name', array( 'param_1' ...
4
votes
2answers
68 views

Escaping built-in WP function return strings

Should one filter the output of builtin WP functions such as get_permalink() and well-known WP plugins such as ACF (Advanced Custom Fields) such as get_field()? For instance get_permalink() calls ...
3
votes
1answer
653 views

Escaping WP_Query tax_query when term has special character(s)

Here's my issue. I have a custom post type that I'm attaching a custom taxonomy to. This taxonomy will allow the admin to provide search suggestions that will ensure the post is found when a user ...
2
votes
3answers
6k views

When do I need to use esc_attr when using WordPress internal functions

When I am putting a WordPress value inside the attribute tag, for example, the following method does not need esc_attr e.g. // JS code alert('<?php echo get_bloginfo('name');?>'); the ...
2
votes
1answer
868 views

How do translated, escaped strings (esc_attr) in Themes work?

I was looking at the TwentyEleven code and found this: esc_attr__( 'Permalink to %s', 'twentyeleven' ) This is come code that came out of the title tag for a post; the full code within the title ...
2
votes
2answers
4k views

How do I stop HTML entities in a custom meta box from being un-htmlentitied?

I have a custom meta box that is supposed to accept HTML, but the text I'm trying to input contains both double and single quotes (and ampersands), and it's messing up the saved data - each time I ...
2
votes
1answer
61 views

Do you need to escape hard coded plain text?

I started playing with the Underscores starter theme and noticed it uses esc_html_e() even on plain text: <a class="skip-link" href="#content"><?php esc_html_e( 'Skip to content', '_s' ); ?&...
2
votes
1answer
2k views

How to correctly escape query variables to be used in WP_Query

I've got custom query variables that are added via query_vars. For example, 'industry'. In pre_get_posts action I construct and add taxonomy query if there is a value for the 'industry' parameter, ...
2
votes
1answer
699 views

Prevent add_shortcode from escaping a tag

In my plugin, I'm rendering a shortcode with some inline JavaScript. Wordpress seems to hate the closing CDATA tag (]]>), as it escapes it. I'm using CDATA blocks so as to render well-formed XHTML, ...
2
votes
1answer
94 views

Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?

I'm creating a theme in which I've created options for the admin to enter custom Javascript and Css code in the "Theme Settings" page (created using Options API). Now I'm just not sure how to output ...
2
votes
1answer
831 views

wp_specialchars and wp_specialchars_decode in a shortcode plugin

I have written my first plugin, a shortcode plugin. I have read about wp_specialchars and wp_specialchars_decode but I'm not sure how to use them. The plugin read a shortcode allowing some parameters ...
2
votes
0answers
466 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
1
vote
3answers
3k views

Disable escaping html

I'm using SyntaxHighlighter Evolved to highlight code examples. E.g. [csharp] string s = "text"; List<int> numbers = new List<int>(); [/csharp] When I first save it, it's ok, but when ...
1
vote
1answer
523 views

How Could I sanitize the receive data from this code

<form id="tellastory" method="post" action=""> <label for="fullname">Full Name </label> <input id="fullname" name="fullname" type="text" maxlength="255" value=""/> ...
1
vote
1answer
240 views

When I re-save a post with [code] sections, the entities are double-escaped (> becomes &gt; etc)

I've a hard time googling for this issue. On my blog, whenever I update an existing page, code sections are doubly escaped. I.e., on a recent page I have find /V "QWERTYUIOPPO" < calc.exe:yourads....
1
vote
1answer
2k views

what's different between esc_attr, htmlspecialchars and htmlentities

Can I simply use htmlspecialchars instead of esc_attr?
1
vote
1answer
1k views

How to sanitize user input?

What is the correct way sanitizing form data before submitting to the database? I have the following text input: <form method="post" action="options.php"> <?php wp_nonce_field('update-...
1
vote
1answer
665 views

Allow all attributes in $allowedposttags tags

I would like to use $allowedposttags to allow extra HTML tags during entry submission. Can I allow all attributes for a specific tag using $allowedposttags? For example, the code below will allow ...
1
vote
2answers
2k views

why is esc_html() returning nothing given a string containing a high-bit character?

In PHP 5.2, filter_var() sanitizes text. In WP, esc_html() sanitizes text. The former works with a high-bit character in the text string, e.g. à , but the latter doesn't. esc_html seems to be ...
1
vote
2answers
35 views

How Flexible are the WordPress Coding Standards for PHPCS?

In my WordPress workflow I use Gulp and have a task that runs my PHP files through PHPCS using the WordPress coding standards tests (https://github.com/WordPress-Coding-Standards/WordPress-Coding-...
1
vote
1answer
113 views

Is it necessary to escape LIKE term in WP_User_Query?

While searching for partial string searches using WP_User_Query I came across this answer by @kaiser who has provided some great answers here on Stackexchange. However, I was confused over the use of ...
1
vote
1answer
825 views

Post Content, Special Characters and Filters

I added a hook to the_content. add_filter('the_content', 'edit_the_content'); function edit_the_content($content){ return $content; } Pretty simple right? However, when it output $content from ...
1
vote
1answer
2k views

How to get my post title to work with an apostrophe ('s)?

When saving a post with the title Jule's Gormet, it gets formatted as Jule&#039;s Gormet. If I save it again, it becomes Jule&amp;#039;s Gormet. Following this pattern, it keeps escaping ...
1
vote
0answers
127 views

mysql_real_escape_string() vs. esc_sql() in WordPress

Does mysql_real_escape_string() and esc_sql() in WordPress both do the same thing? I tried the following: $fetch_row='<p>And again for single posts</p>' echo mysql_real_escape_string( $...
1
vote
0answers
101 views

esc_js() breaks unicode sequences by removing the slash '\' character

I've noticed that esc_js() is breaking unicode encoded characters by removing the '\' (slash) character. For example: esc_js('\u041f') returns: 'u041f' I can potentially use REGEX to identify ...
1
vote
0answers
495 views

How to save double quotes in post meta, when the post meta data is an array? [closed]

Ok so I've been scratching my head on this one for a while. I'm making a plugin that adds a custom meta box to a custom post type. I'm using the update_post_meta function to save the data from the ...
1
vote
1answer
220 views

esc_attr not working in shortcode

I have a shortcode that outputs a block of html. One element in the block is an anchor tag with an image caption in the title attribute. Some of the captions I am using have double quotes in them, so ...
0
votes
1answer
39 views

Unexpected esc_html and esc_attr behaviour

On my site's search results page I am outputting the search term as follows: <?php echo esc_html($_GET['s']); ?> For the search term "SEARCH-TERM" (including the quotes) I would expect this ...
0
votes
4answers
158 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
0
votes
1answer
2k views

Something is unescaping all html entities before output to browser [closed]

I have a nasty problem. In my wordpress site something unescapes all html entities before sending data to the browser. It happens for all of the following cases: echo "&quot;XSS" print_r( ...
0
votes
1answer
25 views

Echoing a URL to a link

I've found the esc_url() function and I'm trying to understand what to do with URLs in Wordpress, before resorting to my normal PHP tactics. I see that the third parameter is used to set the filter ...
0
votes
3answers
61 views

Escape html structure in php

I have code like this: <?php echo '<div class="class-name">' . __( 'Text','text-domain' ) . '</div>'; ?> in a plugin of mine. Do i have to escape this? (esc_html or similiar)?
0
votes
1answer
180 views

Wrapping add_query_arg with esc_url not working

I know about the XSS issue related to add_query_arg()function. That is why I am wrapping it with esc_url(). Problem is...this is not working with wp_remote_get(). If I go: $url = add_query_arg( ...
0
votes
1answer
327 views

Using esc_attr_e

From what I understand esc_attr_e is ideally used for escaping values in attributes - Is it right that the usage of esc_attr_e can also be worked in with non attribute values, such as the h3 and label ...
0
votes
1answer
253 views

Add HTML to Term Description

I'm trying to add ( using wp_editor ) an HTML Term Description without a pluign. Whenever I try and spit out the data I get escaped HTML back: &lt;strong&gt;test&lt;/strong&gt; ...
0
votes
1answer
167 views

ACF Unexpected T_CONSTANT_ENCAPSED_STRING [closed]

I'm running the Advanced Custom Fields Pro plugin. When I implement the following code for the repeater field, I get this PHP error: Parse error: syntax error, unexpected ...
0
votes
1answer
245 views

How to pass an array as attribute of shortcode to work properly shortcode parser?

echo '[test attr="'.json_encode(array('test'=>'my[][dfd]dfds[][][')).'"]'; //How to safe pass the array as attribute in shortcodes ?
0
votes
1answer
52 views

wordpress post not showing my “<somehting>” text>?

I am trying to make a post where there is a text line : some libraries to run which we will import by using "#include <filename.h>" command. instead of outputting the text as it is. It ...
0
votes
1answer
178 views

esc_url not working within add_settings_field callback

I'm trying to display a saved option of a url inside a text input on my themes' options page, but it's just simply not displaying. I've checked the database and my url is saved using the specified ...
0
votes
2answers
842 views

Trouble inserting string containing quotations marks with wpdb in save_post hook

I'm having trouble with inserting a string which is containing quotation marks in wordpress via wpdb. I've written a hook for save_post and trying to write the post_title in a table via wpdp->update. ...
0
votes
1answer
222 views

how can i send this to wp_head - escape problem

how can escape this char ----> ; i ask becuse i want to use this to send some javascript to the head using wp_head this is want i want to attach to wp_head: add_action('wp_head', '...