0
votes
0answers
35 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
0
votes
4answers
57 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
1
vote
2answers
2k views

why is esc_html() returning nothing given a string containing a high-bit character?

In PHP 5.2, filter_var() sanitizes text. In WP, esc_html() sanitizes text. The former works with a high-bit character in the text string, e.g. à , but the latter doesn't. esc_html seems to be ...
1
vote
1answer
507 views

How Could I sanitize the receive data from this code

<form id="tellastory" method="post" action=""> <label for="fullname">Full Name </label> <input id="fullname" name="fullname" type="text" maxlength="255" value=""/> ...