Function to filter (validate/sanitize) strings with a view to discharge all not allowed HTML elements.

learn more… | top users | synonyms

0
votes
0answers
14 views

How to modify wp_kses_post() so it will escape unknown HTML instead of remove it?

I have a site that uses the basic editor (not TinyMCE) to allow registered users to create posts. However, they need to be able to have text in their post that LOOKS like html. Since these are not ...
1
vote
1answer
87 views

wp_kses_post only removes <script> tags, but not their content

Is there any way to remove the <script> tags including their contents? wp_kses_post seems to only remove the tags, while their content remains visible on the page. Thank you
1
vote
0answers
49 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
0
votes
1answer
78 views

wp_kses ignore allowed and allow everything

Here is an example: $allowedPart = "<a href='http://alink.com'></a>"; $unsafePart = "<h1>A title</h1>"; $unsafePart .= "<script>alert('a ...
5
votes
1answer
138 views

wp_kses vs wp_strip_all_tags

Apart from providing a granular control for allowed HTML tags does wp_kses provide any additional benefits over wp_strip_all_tags? Essentially, if I were to use wp_kses and set it to not allow any ...
0
votes
0answers
52 views

wp_kses enable HTML comment code.filter

Is there a way to enable the category description to allow HTML comment EX: <!-- example of the HTML comment --> How it looks in the category description. <!-- This story is about the ...
0
votes
1answer
51 views

Any ideas how to allow CSS input to perfectly work in the text area with wp_kses?

I'm having issues with wp_kses. I have a text area that allows CSS input (only) While the rest of the CSS gets through (don't have any issues ever since). Until one user , inputs a CSS Code like this ...
2
votes
1answer
86 views

Remove tags from the kses filter

I know one can modify the kses filter to add new allowed tags to it, but is there a way to remove some of them? I can't find how. I need to disallow DIV tags. Any ideas? Thanks
0
votes
0answers
79 views

Inserting HTML elements into table with TinyMCE, security

I am working on a wordpress plugin where the administrator can fill out a form that adds products to a table. For most inputs I am using sanitize_text_field(), and then inserting the data. But for ...
0
votes
1answer
63 views

Add Protocol to Custom Menus

I've been using tel: links in Custom Menus combined with Responsive Design to add a "Call Now" button to my themes for smartphones. It's been working well. A client just asked me to also add a "Send ...
0
votes
1answer
133 views

wp_filter_kses allow HTML5 video?

Is there a way to allow my users to add HTML5 video tag (without shortcodes) into my textfield/textarea? Allowed anchor styles and bold tags are working, but as soon I add 'video' and 'source' it ...
1
vote
1answer
69 views

wp_kses and magic quotes

In the wp_kses codex page it says: You have to remove any slashes from PHP's magic quotes before you call this function. I am new(ish) to PHP and I wiki'd Magic Quotes and it was apparently ...
4
votes
1answer
181 views

Allowing more elements in comments via functions.php

I would like to allow certain HTML elements in my comments and have edited kses.php directly in the past. However, I have been hacked recently and replaced all the core Wordpress files and feel I ...
0
votes
1answer
81 views

Why is `--` converted into ndash and how can I get rid of it?

I have a blog where I publish Linux tutorials. Some of the commands I listed have a -- before command-line arguments. e.g.: dpkg --get-selections. The problem is that WordPress automatically switches ...
1
vote
0answers
100 views

Only allow site url in text field using wp_kses/wp_filter_nohtml_kses?

I'm working on validation for a theme options page. Is there a built in way to add an argument to wp_kses/wp_filter_nohtml_kses that will allow a specific link to be entered(wrapped in a tags) but ...
1
vote
1answer
86 views

Make WordPress process admin group comments using $allowedtags

WP uses $allowedtags to limit the set of allowable tags for comments.However, comments from administrators are unfiltered. What's the easiest way to ensure admin comments are also constrained to the ...
3
votes
2answers
771 views

WP Editor strips input placeholder attribute

Why WP Editor also strips the "placeholder" attribute of the input text element ? Ofcourse, i am using the HTML mode. Here is the input: <input type="text" value="" name="s" style="width: 550px;" ...
3
votes
1answer
978 views

What is the difference between strip_tags and wp_filter_nohtml_kses?

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
0
votes
2answers
616 views

sanitize vimeo embed code?

I have a custom meta box with a textarea where users can drop in vimeo embed code. Should I sanitize this code before I update_post_meta, and, if so, how should I go about it? I don't want to strip ...
2
votes
4answers
2k views

Typical wp_kses $allowed

I have a custom post textbox that I want to sanitize using wp_kses before I update my post meta. I was looking for examples of common $allowed settings, but I have only seen this example: $allowed = ...