Tag Info

Hot answers tagged

11

We have to look a bit deeper here to get an answer to your question. So, bloginfo is a simple wrapper around get_bloginfo. <?php function bloginfo( $show='' ) { echo get_bloginfo( $show, 'display' ); } Notice the second argument display. Let's see what that does. <?php function get_bloginfo( $show = '', $filter = 'raw' ) { // snip snip, ...


9

Escaping depends entirely on the context in which you are using the functions. What is safe for displaying inside <h1> tags, is not necessarily safe to display for the value attribute of an input field, and even that wouldn't necessarily be safe as a href attribute value.... In short - perform the sanitisation yourself as you output it. Though in the ...


9

The general rule, at least as espoused by Mark Jaquith, is sanitize on input, escape on output (the corollary to this rule being sanitize early, escape late). So: use sanitization filters (such as the kses() family) when storing untrusted data in the database, and use escaping filters (i.e. the esc_*() family) when outputting untrusted data in the template. ...


6

From the Codex entry for Data Validation: URLs: esc_url( $url, (array) $protocols = null ) (since 2.8) Always use esc_url when sanitizing URLs (in text nodes, attribute nodes or anywhere else). Rejects URLs that do not have one of the provided whitelisted protocols (defaulting to http, https, ftp, ftps, mailto, news, irc, gopher, nntp, ...


5

I just installed SyntaxHighlighter Evolved, and while testing on an existing post I was dismayed to find that all the quotes " had been converted to &quot; (the single quotes were fine). I was using the HTML editor. In case you are also in this position, I found that it's just the post preview that is escaped - when you Publish it appears fine.


5

The kses functions should be used when you want to allow some subset of html to be in the result. For example, comments allow some HTML in them for bold, italic, links, and such. The esc_html function should be used to escape html completely. No HTML will go through it without being converted to something that will be interpreted as non-HTML by a browser.


5

I figured out a solution to my question. First of all, in my original query, I should have specified OR instead of AND for searching between group names and group descriptions. (It was skewing the results.) And I needed to double escape my '%'s in the LIKE statements. Here is the updated query which works correctly: SELECT * FROM ...


4

You can look at the Codex. Encodes < > & " ' (less than, greater than, ampersand, double quote, single quote). Will never double encode entities. Given that, arguably, both of those strings need sanitization. Imagine a site name like >> "My" Website's Great Title <<" Also, since you are using this in Javascript, you should ...


4

Yes and no - depends on whether you want html in those functions to be output or not. If you escape the_content(), for example, and it contains a <div> tag, that tag would actually be output to the page as &lt;div&gt; instead. By the way, if you do escape the output of those functions, you'll want to use their "get_" equivalents (ex. ...


4

esc_html and esc_attr are near-identical, the only difference is that output gets passed through differently named filters ( esc_html and attribute_escape respectively). esc_url is more complex and specific, it deals with characters that can't be in URLs and allowed protocols (list of which can be passed as second argument). It will also prepend input with ...


4

stripslashes(wp_filter_post_kses(addslashes($_POST['sidebar_code']))); but you should know that the kses filter is not 100% safe.


4

Sanitization and escaping is always heavily context-dependent and I'm not an expert in this field, anyway I did some 'research' myself recently so I'll try to supply you with some general guidelines until someone with more insight will come and offer the ultimate in-depth answer (which I'll be eager to read too.) Codex article on Data Validation is a good ...


3

The visual editor will automatically escape HTML tags (the <> brackets in particular) to prevent code you intend to display from being interpreted by the browser as markup. The easiest way to make sure the content is exactly what you type is to use the HTML editor rather than the Visual editor. I use a code highlighting plug-in called Code Colorer, ...


3

I face this issue quite often on my own site where I publish code tutorials. Unfortunately, there isn't a good solution. Instead, I recommend this workflow: Use the WYSIWYG editor to build your article content leaving placeholders for your code snippets. Switch to the HTML editor to add your code snippets The visual editor (TinyMCE) tries to escape ...


3

If I'm allowed to answer my own question here: I found a way to stop the conversion of my html entities back to characters by using <?php esc_textarea( $text ) ?>, as detailed by the codex here: http://codex.wordpress.org/Function_Reference/esc_textarea. Not sure if this is the right way of doing it, but its working. My (snipped) metabox code now ...


3

General difference between esc_attr and esc_attr_* The difference between esc_attr() and esc_attr__(), esc_attr_e(), esc_attr_x() is that the later three are just "wrappers" or in other words higher level API functions. When you look at the source of the later three, then you'll see that those put in a single argument wrapped in a call to translate() (or ...


2

Perhaps because the entity is a non-UTF8 character? Here's what esc_html() does: function esc_html( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES ); return apply_filters( 'esc_html', $safe_text, $text ); } If not that, then it's getting sanitized when filtered by ...


2

esc_attr() is written specifically for escaping a string that is to be used as an html attribute, which means also escaping single and double-quote characters etc. In general, it's better to use the data validation API that WP provides rather than the generic PHP functions.


2

This was a case of UTF-8 character encoding taking over the presentational view of your browser and converting those HTML entities into their counter parts, human readable text. After all, you might have very well wanted a string that looked like; "BLA for some reason or another to the eyes of your viewer instead of &quot;BLA. From a security ...


2

Look at the source of the_content(): function the_content($more_link_text = null, $stripteaser = false) { $content = get_the_content($more_link_text, $stripteaser); $content = apply_filters('the_content', $content); $content = str_replace(']]>', ']]&gt;', $content); echo $content; } As you can see, there is no filter to prevent ...


2

I'm pretty sure you have to explicitly name all allowed attributes - just use: $allowedposttags['iframe'] = array ( 'align' => true, 'frameborder' => true, 'height' => true, 'width' => true, 'sandbox' => true, 'seamless' => true, 'scrolling' => true, 'srcdoc' => true, ...


2

I am not sure if this helpful or not. As s_ha_dum said, you should post how you are processing the submitted data and sending to db. But for starters, you might look at escaping the outputted data in the form: <input style="width:100%" type="text" name="data[title]" id="title" value="<?php $title = get_option('data_test'); echo ...


2

YES. You always escape output that originally comes from user submitted data. To be safe, you always escape variable output, period.


2

I'm not sure if this is a bug, but it need further investigation. I've run a few quick tests on the name field in a tax_query, and whenever a term name has got a special character or have more than one word, the tax_query is excluded from the SQL query TEST 1 I have use two terms here, your term Ski-in/Ski-out and one of the terms on my test site Uit die ...


1

I would suggest using esc_html instead of esc_attr for that, e.g. <a href="<?php echo esc_url( $url );?>" class="<?php echo esc_attr( $classes ); ?>"> <?php echo esc_html( $title ); ?> </a> <div> <?php echo wp_kses_post( $html_with_safe_tags );?> </div> <script> <?php echo wp_json_encode( ...


1

And the strange part: both codes echo the same string for $url!!! No, they don't. Look at the page source. esc_url() is encoding the & control character. You can't do that and expect the HTTP request to work correctly. Use esc_url_raw() instead. Note the description in the Codex concerning that function: The esc_url_raw() function is similar to ...


1

The function for the pre_get_posts action uses a WP_Query object (http://codex.wordpress.org/Plugin_API/Action_Reference/pre_get_posts) When using functions such as get_posts or classes such as WP_Query and WP_User_Query, WordPress takes care of the necessary sanitization in querying the database. However, when retrieving data from a custom table, or ...


1

Your string example is wrong. You´re ending the echo statement right after opening the <div>. It should look like this: echo '<div class="quarter"><img src="' .$image[0]. '" alt="Logo"></div>';


1

You have to escape th < and the > with &lt; and &gt;, otherwise WordPress will remove the “unknown tags”. You could also filter pre_kses to change the output before it gets stripped. add_filter( 'pre_kses', function( $str ) { // find and escape < and > on specific positions, then return $str; });



Only top voted, non community-wiki answers of a minimum length are eligible