Tag Info

Hot answers tagged

10

We have to look a bit deeper here to get an answer to your question. So, bloginfo is a simple wrapper around get_bloginfo. <?php function bloginfo( $show='' ) { echo get_bloginfo( $show, 'display' ); } Notice the second argument display. Let's see what that does. <?php function get_bloginfo( $show = '', $filter = 'raw' ) { // snip snip, ...


9

Escaping depends entirely on the context in which you are using the functions. What is safe for displaying inside <h1> tags, is not necessarily safe to display for the value attribute of an input field, and even that wouldn't necessarily be safe as a href attribute value.... In short - perform the sanitisation yourself as you output it. Though in the ...


9

The general rule, at least as espoused by Mark Jaquith, is sanitize on input, escape on output (the corollary to this rule being sanitize early, escape late). So: use sanitization filters (such as the kses() family) when storing untrusted data in the database, and use escaping filters (i.e. the esc_*() family) when outputting untrusted data in the template. ...


6

From the Codex entry for Data Validation: URLs: esc_url( $url, (array) $protocols = null ) (since 2.8) Always use esc_url when sanitizing URLs (in text nodes, attribute nodes or anywhere else). Rejects URLs that do not have one of the provided whitelisted protocols (defaulting to http, https, ftp, ftps, mailto, news, irc, gopher, nntp, ...


5

I just installed SyntaxHighlighter Evolved, and while testing on an existing post I was dismayed to find that all the quotes " had been converted to &quot; (the single quotes were fine). I was using the HTML editor. In case you are also in this position, I found that it's just the post preview that is escaped - when you Publish it appears fine.


5

I figured out a solution to my question. First of all, in my original query, I should have specified OR instead of AND for searching between group names and group descriptions. (It was skewing the results.) And I needed to double escape my '%'s in the LIKE statements. Here is the updated query which works correctly: SELECT * FROM ...


4

You can look at the Codex. Encodes < > & " ' (less than, greater than, ampersand, double quote, single quote). Will never double encode entities. Given that, arguably, both of those strings need sanitization. Imagine a site name like >> "My" Website's Great Title <<" Also, since you are using this in Javascript, you should ...


4

Yes and no - depends on whether you want html in those functions to be output or not. If you escape the_content(), for example, and it contains a <div> tag, that tag would actually be output to the page as &lt;div&gt; instead. By the way, if you do escape the output of those functions, you'll want to use their "get_" equivalents (ex. ...


4

esc_html and esc_attr are near-identical, the only difference is that output gets passed through differently named filters ( esc_html and attribute_escape respectively). esc_url is more complex and specific, it deals with characters that can't be in URLs and allowed protocols (list of which can be passed as second argument). It will also prepend input with ...


4

stripslashes(wp_filter_post_kses(addslashes($_POST['sidebar_code']))); but you should know that the kses filter is not 100% safe.


4

Sanitization and escaping is always heavily context-dependent and I'm not an expert in this field, anyway I did some 'research' myself recently so I'll try to supply you with some general guidelines until someone with more insight will come and offer the ultimate in-depth answer (which I'll be eager to read too.) Codex article on Data Validation is a good ...


4

The kses functions should be used when you want to allow some subset of html to be in the result. For example, comments allow some HTML in them for bold, italic, links, and such. The esc_html function should be used to escape html completely. No HTML will go through it without being converted to something that will be interpreted as non-HTML by a browser.


3

I face this issue quite often on my own site where I publish code tutorials. Unfortunately, there isn't a good solution. Instead, I recommend this workflow: Use the WYSIWYG editor to build your article content leaving placeholders for your code snippets. Switch to the HTML editor to add your code snippets The visual editor (TinyMCE) tries to escape ...


3

If I'm allowed to answer my own question here: I found a way to stop the conversion of my html entities back to characters by using <?php esc_textarea( $text ) ?>, as detailed by the codex here: http://codex.wordpress.org/Function_Reference/esc_textarea. Not sure if this is the right way of doing it, but its working. My (snipped) metabox code now ...


3

The visual editor will automatically escape HTML tags (the <> brackets in particular) to prevent code you intend to display from being interpreted by the browser as markup. The easiest way to make sure the content is exactly what you type is to use the HTML editor rather than the Visual editor. I use a code highlighting plug-in called Code Colorer, ...


3

General difference between esc_attr and esc_attr_* The difference between esc_attr() and esc_attr__(), esc_attr_e(), esc_attr_x() is that the later three are just "wrappers" or in other words higher level API functions. When you look at the source of the later three, then you'll see that those put in a single argument wrapped in a call to translate() (or ...


2

YES. You always escape output that originally comes from user submitted data. To be safe, you always escape variable output, period.


2

I am not sure if this helpful or not. As s_ha_dum said, you should post how you are processing the submitted data and sending to db. But for starters, you might look at escaping the outputted data in the form: <input style="width:100%" type="text" name="data[title]" id="title" value="<?php $title = get_option('data_test'); echo ...


2

Look at the source of the_content(): function the_content($more_link_text = null, $stripteaser = false) { $content = get_the_content($more_link_text, $stripteaser); $content = apply_filters('the_content', $content); $content = str_replace(']]>', ']]&gt;', $content); echo $content; } As you can see, there is no filter to prevent ...


2

I'm pretty sure you have to explicitly name all allowed attributes - just use: $allowedposttags['iframe'] = array ( 'align' => true, 'frameborder' => true, 'height' => true, 'width' => true, 'sandbox' => true, 'seamless' => true, 'scrolling' => true, 'srcdoc' => true, ...


2

Perhaps because the entity is a non-UTF8 character? Here's what esc_html() does: function esc_html( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES ); return apply_filters( 'esc_html', $safe_text, $text ); } If not that, then it's getting sanitized when filtered by ...


2

esc_attr() is written specifically for escaping a string that is to be used as an html attribute, which means also escaping single and double-quote characters etc. In general, it's better to use the data validation API that WP provides rather than the generic PHP functions.


1

This isn't a complete answer to your question, but possibly pointing you in the right direction: You could try <?php esc_textarea( $text ) ?>, as detailed by the codex here: http://codex.wordpress.org/Function_Reference/esc_textarea. My own metabox textarea snippets look like this: <?php if ( $meta_box['type'] == "textarea" ) { ...


1

* SOLVED * sorry for the bother. my problem wasnt this char at all --> ; but this line which i missed: echo '$('a.lightbox').lightBox(); // Select all links with lightbox class' . "\n"; Sometimes sterring at code i miss such stuff.. sorry = thanks for anyone who watched.


1

$post_content = '&quot;Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit...&quot;'; Try encoding special characters. See: http://www.w3schools.com/tags/ref_entities.asp & http://php.net/manual/en/function.htmlentities.php


1

Try stripslashes. See the php documentation. To clarify, the slashes are inserted to escape the content prior to insertion into the database. You should use the above function when you want to display the content.


1

You use esc_attr() when you are outputting something intended to be in an HTML attribute. In your case, you should be using esc_js(), or possibly json_encode() instead.


1

EDIT: Disable magic_quotes_gpc in your server. try adding in .HTACCESS file (if you on shared hosting): php_flag magic_quotes_gpc off If you'll get 500 server error after you added it - delete it and put this: ini_set ('magic_quotes_gpc', 0); in theme's functions.php file. And with function bellow check is it on. You can create php file with this content ...


1

This was a case of UTF-8 character encoding taking over the presentational view of your browser and converting those HTML entities into their counter parts, human readable text. After all, you might have very well wanted a string that looked like; "BLA for some reason or another to the eyes of your viewer instead of &quot;BLA. From a security ...



Only top voted, non community-wiki answers of a minimum length are eligible