Avoiding stripping of HTML in Custom Taxonomy Meta Field

Question

I'm using a custom form field on a Custom Taxonomy to hold various data. All working well except in one particular case where I'm trying to save an iframe embed code (from Bandcamp) which is to be echoed in a template later. Wordpress is inserting \ before any " in the output.

I've tried using htmlspecialchars on my output, I've also added that to the value of my edit form field action. I guess I'm missing part of the process somewhere, perhaps on save?

Save function is:

function save_taxonomy_custom_meta_bandcamp_embed_music( $term_id ) {
    if ( isset( $_POST['term_meta'] ) ) {
        $t_id = $term_id;
        $term_meta = get_option( "taxonomy_$t_id" );
        $cat_keys = array_keys( $_POST['term_meta'] );
        foreach ( $cat_keys as $key ) {
            if ( isset ( $_POST['term_meta'][$key] ) ) {
                $term_meta[$key] = $_POST['term_meta'][$key];
            }
        }
        // Save the option array.
        update_option( "taxonomy_$t_id", $term_meta );
    }
}  
add_action( 'edited_hhie_artists', 'save_taxonomy_custom_meta_bandcamp_embed_music', 10, 2 );  
add_action( 'create_hhie_artists', 'save_taxonomy_custom_meta_bandcamp_embed_music', 10, 2 );

Answer 1

you can use esc_attr

function save_taxonomy_custom_meta_bandcamp_embed_music( $term_id ) {
    if ( isset( $_POST['term_meta'] ) ) {
        $t_id = $term_id;
        $term_meta = get_option( "taxonomy_$t_id" );
        $cat_keys = array_keys( $_POST['term_meta'] );
        foreach ( $cat_keys as $key ) {
            if ( isset ( $_POST['term_meta'][$key] ) ) {
                $term_meta[$key] = esc_attr( $_POST['term_meta'][$key] ); // encoded text with HTML entities
            }
        }
        // Save the option array.
        update_option( "taxonomy_$t_id", $term_meta );
    }
}  
add_action( 'edited_hhie_artists', 'save_taxonomy_custom_meta_bandcamp_embed_music', 10, 2 );  
add_action( 'create_hhie_artists', 'save_taxonomy_custom_meta_bandcamp_embed_music', 10, 2 );

Answer 2

wordpress always slashes all parameters of $_GET and $_POST. You should unslash them when updating your option in your code.