Function to filter (validate/sanitize) strings with a view to discharge all not allowed HTML elements.

learn more… | top users | synonyms

0
votes
0answers
35 views

Is wp_kses safe against XSS

Is this code safe against complex types of XSS attack? $v = wp_kses(esc_attr( $bad_input ), $allowed); where $allowed = array( 'a' => array( 'href' => array(), 'title' =&...
6
votes
1answer
277 views

What to use instead of wp_kses() in user output

I need some help here. While developing a theme, I want to make sure there are no security issues. So all dynamic data must be correctly escaped for the context where it is rendered. I know how to ...
3
votes
0answers
159 views

How to get SimplePie fetch_feed without stripping iframe code?

I'm grabbing a remote feed in my plugin and some entries have iframe code I want to keep. However, SimplePie keeps stripping it out. Here is my code and what I've tried already: kses_remove_filters();...
3
votes
1answer
440 views

Why is wp_kses not keeping style attributes as expected?

I want to keep the style attribute. $str is just an example, here's my code: $allowed_html = array( 'div' => array( 'title' => array(), 'class' => array(), '...
2
votes
3answers
876 views

wp_kses_post only removes <script> tags, but not their content

Is there any way to remove the <script> tags including their contents? wp_kses_post seems to only remove the tags, while their content remains visible on the page. Thank you
1
vote
0answers
92 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
0
votes
1answer
310 views

wp_kses ignore allowed and allow everything

Here is an example: $allowedPart = "<a href='http://alink.com'></a>"; $unsafePart = "<h1>A title</h1>"; $unsafePart .= "<script>alert('a script!!!');</script>";...
5
votes
1answer
319 views

wp_kses vs wp_strip_all_tags

Apart from providing a granular control for allowed HTML tags does wp_kses provide any additional benefits over wp_strip_all_tags? Essentially, if I were to use wp_kses and set it to not allow any ...
0
votes
1answer
139 views

Any ideas how to allow CSS input to perfectly work in the text area with wp_kses?

I'm having issues with wp_kses. I have a text area that allows CSS input (only) While the rest of the CSS gets through (don't have any issues ever since). Until one user , inputs a CSS Code like this ...
2
votes
1answer
206 views

Remove tags from the kses filter

I know one can modify the kses filter to add new allowed tags to it, but is there a way to remove some of them? I can't find how. I need to disallow DIV tags. Any ideas? Thanks
0
votes
1answer
156 views

Add Protocol to Custom Menus

I've been using tel: links in Custom Menus combined with Responsive Design to add a "Call Now" button to my themes for smartphones. It's been working well. A client just asked me to also add a "Send ...
0
votes
1answer
222 views

wp_filter_kses allow HTML5 video?

Is there a way to allow my users to add HTML5 video tag (without shortcodes) into my textfield/textarea? Allowed anchor styles and bold tags are working, but as soon I add 'video' and 'source' it ...
1
vote
1answer
165 views

wp_kses and magic quotes

In the wp_kses codex page it says: You have to remove any slashes from PHP's magic quotes before you call this function. I am new(ish) to PHP and I wiki'd Magic Quotes and it was apparently ...
4
votes
1answer
243 views

Allowing more elements in comments via functions.php

I would like to allow certain HTML elements in my comments and have edited kses.php directly in the past. However, I have been hacked recently and replaced all the core Wordpress files and feel I ...
0
votes
1answer
86 views

Why is `--` converted into ndash and how can I get rid of it?

I have a blog where I publish Linux tutorials. Some of the commands I listed have a -- before command-line arguments. e.g.: dpkg --get-selections. The problem is that WordPress automatically switches ...
1
vote
0answers
136 views

Only allow site url in text field using wp_kses/wp_filter_nohtml_kses?

I'm working on validation for a theme options page. Is there a built in way to add an argument to wp_kses/wp_filter_nohtml_kses that will allow a specific link to be entered(wrapped in a tags) but ...
1
vote
1answer
97 views

Make WordPress process admin group comments using $allowedtags

WP uses $allowedtags to limit the set of allowable tags for comments.However, comments from administrators are unfiltered. What's the easiest way to ensure admin comments are also constrained to the ...
3
votes
2answers
1k views

WP Editor strips input placeholder attribute

Why WP Editor also strips the "placeholder" attribute of the input text element ? Ofcourse, i am using the HTML mode. Here is the input: <input type="text" value="" name="s" style="width: 550px;" ...
3
votes
1answer
1k views

What is the difference between strip_tags and wp_filter_nohtml_kses?

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
0
votes
2answers
923 views

sanitize vimeo embed code?

I have a custom meta box with a textarea where users can drop in vimeo embed code. Should I sanitize this code before I update_post_meta, and, if so, how should I go about it? I don't want to strip ...
5
votes
5answers
4k views

Typical wp_kses $allowed

I have a custom post textbox that I want to sanitize using wp_kses before I update my post meta. I was looking for examples of common $allowed settings, but I have only seen this example: $allowed = ...