Tag Info

Hot answers tagged

4

Technical difference is kinda obvious. PHP one is single function, using logic in PHP code. WP one is one of family of functions, based on third party KSES library. Is there practical difference between these two specific functions? I think the important point is that strip_tags() was made for utility, while KSES was made for security. So, while results ...


3

I would disagree with the solution posted by @JaredCobb, wp_kses() is much more flexible than the method he presented. It can strip out unwanted attributes from tags without destroying the tags themselves. For example, if the user put in <strong class='foo'>, wp_kses() would return <strong> if you did not allow class, whereas strip_tags() would ...


3

Here is an example how to allow a commenter to insert HTML5 video into the comment. Both <video> and <source> elements has two allowed attributes. preprocess_comment filter is applied when saving the comment to the DB. See /wp-includes/kses.php for $allowedtags array structure. function myAllowHtmlComments($comment) { global $allowedtags; ...


2

I would start out with the same $allowedtags array that WordPress uses for their comments. You can find their array in the [wordpress directory]/wp-includes/kses.php file. These seem like sensible defaults to me, and a good starting point. Here is their array... $allowedtags = array( 'a' => array( 'href' => true, 'title' => ...


2

You need to add a custom validation/sanitization callback, and hook it into publish_post (and/or draft_post and/or future_post, as applicable). For example: <?php function wpse_44807_update_custom_post_meta() { // Globalize the $post object global $post; // If our custom post meta key is set, sanitize it; // otherwise, return false ...


2

The list of allowed elements and attributes is stored in the global variable $allowedposttags which is set in wp-includes/kses.php. To override it create a simple mu plugin with the following content: <?php # -*- coding: utf-8 -*- /** * Plugin Name: Enable placeholder attribute for input elements in post tags. * Version: 2012.07.18 */ add_action( ...


1

kses_init is hooked onto the init hook with default priority, and (after first removing any of the kses filters) adds filters which strip out tags (wp_filter_post_kses for posts and wp_filter_kses for comments) if the user does not have the capability 'unfiltered_html'. Since the capability determines whether or not the user can post 'unfiltered_html' ...


1

The allowed tags are stored in $allowedposttags (located in /wp-includes/kses.php) as an array. For each element it looks something like this: $allowedposttags = array( 'div' => array( 'align' => true, 'dir' => true, 'lang' => true, 'xml:lang' => true, ) ); You can remove a single element of an array via unset ...


1

I've only used wp_kses when I've specifically needed to allow / filter attributes of HTML tags (for example, I want them to be allowed to have an <image> tag, with a src="" attribute but I don't want them to be able to but href="" or style="" or anything else on the image tag. In that case, wp_kses comes in handy because (as you can see in the example ...



Only top voted, non community-wiki answers of a minimum length are eligible