Unfiltered html with update_post_meta

Question

I have buddypress installation. When posting an acitivity, I'm including some data (html) as meta. Let me show some code:

this is an action triggered when acitivty is posted.

function add_activitylink_to_activity( $content, $user_id, $activity_id ) { ?>
<script type="text/javascript" >
    var activity_id = '<?php echo $activity_id; ?>';
    if ( !jQuery('#add_activity_link_area').hasClass('empty') ) {
        var add_link = jQuery("#add_activity_link_area").html();
        jQuery.ajax({
            type : 'POST',
            url : ajaxurl,
            data : {
                action : 'addActivityMeta',
                activity_id: activity_id,
                add_link: add_link
            },
            dataType: "html",
            success : function(data) {
                jQuery("#activity-" + activity_id).find(".activity-inner").after(jQuery("<div class='meta-activitylink'></div>").html(add_link));
            },
            error: function(MLHttpRequest, textStatus, errorThrown){
                alert(textStatus);
            }
        })
    }
</script>
<?php }
add_action( 'bp_activity_posted_update', 'add_activitylink_to_activity', 10, 3 );

and here is a ajax handler:

function addActivityMeta() {
    bp_activity_update_meta( $_POST['activity_id'], 'activitylink', $_POST['add_link'] );
    die('success');
}

everything works fine as long as I'm logged in as administrator, but with normal users, the meta does not get posted

as I understand it, it's because "unfiltered html", but I don't understand much of it and this maybe sound stupid: can I filter it somehow? :D

there are table and image links and such.

or is there any workaround? for example I'm thinking about inserting this meta with mysql query? Is this bad solution?

Answer 1

Do you really want your members to be able to insert unfiltered html in the database? By default, it's not allowed as a security measure to protect your installation.

You could allow it by adjusting kses filters. Or by-pass the filters via a custom sql query.