Function to filter (validate/sanitize) strings with a view to discharge all not allowed HTML elements.

learn more… | top users | synonyms

2
votes
2answers
402 views

wp_kses_post only removes <script> tags, but not their content

Is there any way to remove the <script> tags including their contents? wp_kses_post seems to only remove the tags, while their content remains visible on the page. Thank you
0
votes
1answer
89 views

Any ideas how to allow CSS input to perfectly work in the text area with wp_kses?

I'm having issues with wp_kses. I have a text area that allows CSS input (only) While the rest of the CSS gets through (don't have any issues ever since). Until one user , inputs a CSS Code like this ...
2
votes
0answers
85 views

How to get SimplePie fetch_feed without stripping iframe code?

I'm grabbing a remote feed in my plugin and some entries have iframe code I want to keep. However, SimplePie keeps stripping it out. Here is my code and what I've tried already: ...
1
vote
0answers
70 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
1
vote
0answers
119 views

Only allow site url in text field using wp_kses/wp_filter_nohtml_kses?

I'm working on validation for a theme options page. Is there a built in way to add an argument to wp_kses/wp_filter_nohtml_kses that will allow a specific link to be entered(wrapped in a tags) but ...
0
votes
0answers
13 views

Is wp_kses safe against XSS

Is this code safe against complex types of XSS attack? $v = wp_kses(esc_attr( $bad_input ), $allowed); where $allowed = array( 'a' => array( 'href' => array(), 'title' ...
0
votes
0answers
256 views

How to modify wp_kses_post() so it will escape unknown HTML instead of remove it?

I have a site that uses the basic editor (not TinyMCE) to allow registered users to create posts. However, they need to be able to have text in their post that LOOKS like html. Since these are not ...