Tag Info

Hot answers tagged

4

Technical difference is kinda obvious. PHP one is single function, using logic in PHP code. WP one is one of family of functions, based on third party KSES library. Is there practical difference between these two specific functions? I think the important point is that strip_tags() was made for utility, while KSES was made for security. So, while results ...


3

I would disagree with the solution posted by @JaredCobb, wp_kses() is much more flexible than the method he presented. It can strip out unwanted attributes from tags without destroying the tags themselves. For example, if the user put in <strong class='foo'>, wp_kses() would return <strong> if you did not allow class, whereas strip_tags() would ...


3

Here is an example how to allow a commenter to insert HTML5 video into the comment. Both <video> and <source> elements has two allowed attributes. preprocess_comment filter is applied when saving the comment to the DB. See /wp-includes/kses.php for $allowedtags array structure. function myAllowHtmlComments($comment) { global $allowedtags; ...


2

You need to add a custom validation/sanitization callback, and hook it into publish_post (and/or draft_post and/or future_post, as applicable). For example: <?php function wpse_44807_update_custom_post_meta() { // Globalize the $post object global $post; // If our custom post meta key is set, sanitize it; // otherwise, return false ...


2

I would start out with the same $allowedtags array that WordPress uses for their comments. You can find their array in the [wordpress directory]/wp-includes/kses.php file. These seem like sensible defaults to me, and a good starting point. Here is their array... $allowedtags = array( 'a' => array( 'href' => true, 'title' => ...


2

The list of allowed elements and attributes is stored in the global variable $allowedposttags which is set in wp-includes/kses.php. To override it create a simple mu plugin with the following content: <?php # -*- coding: utf-8 -*- /** * Plugin Name: Enable placeholder attribute for input elements in post tags. * Version: 2012.07.18 */ add_action( ...


2

I wouldn't call it a benefit or disadvantage, but more of a difference: wp_strip_all_tags simply strips all tags (except for the allowed tags) by calling the PHP function strip_tags, after removing script and style tags in full, including their contents. wp_kses does no such thing: // Returns 'alert( "test" )' (content of script tag) wp_kses( ...


1

kses_init is hooked onto the init hook with default priority, and (after first removing any of the kses filters) adds filters which strip out tags (wp_filter_post_kses for posts and wp_filter_kses for comments) if the user does not have the capability 'unfiltered_html'. Since the capability determines whether or not the user can post 'unfiltered_html' ...


1

I've only used wp_kses when I've specifically needed to allow / filter attributes of HTML tags (for example, I want them to be allowed to have an <image> tag, with a src="" attribute but I don't want them to be able to but href="" or style="" or anything else on the image tag. In that case, wp_kses comes in handy because (as you can see in the example ...


1

WordPress is still adding slashes to data sent per POST, so yes, in some cases you might have to remove the slashes. There are two options: Use stripslashes_deep( $value ). This function accepts an array, an object or a string and removes the slashes. Get POST data per: $data = file_get_contents( 'php://input' ); This takes the data from the raw input ...


1

The allowed tags are stored in $allowedposttags (located in /wp-includes/kses.php) as an array. For each element it looks something like this: $allowedposttags = array( 'div' => array( 'align' => true, 'dir' => true, 'lang' => true, 'xml:lang' => true, ) ); You can remove a single element of an array via unset ...


1

wp_kses (Codex) removes unallowed tags, but it doesn't remove their content. So, if you have a "{something}", wp_kses only removes the tags, not the content, returning "{something}". Thus, this is intended behaviour and your issue doesn't seem to be a bug.



Only top voted, non community-wiki answers of a minimum length are eligible