Passing html tags as shortcode parameters

Question

I want to let the user of my plugin define html tags to use before and after the text output by the shortcode, so I am using parameters where they can enter the tags. However the tags are being converted to html entities. I therefore resorted to using html_entity_decode(), is this good practice?

    extract( shortcode_atts( array(             
            'count'         => -1,
            'category_name' => '',
            'q_before'      => '<h3>',
            'q_after'       => '</h3>',
            'orderby'       => 'date', //'none','ID','author','title','name','date','modified','parent','rand','menu_order'
            'order'         => 'ASC', //'DESC'  
    ), $atts, 'myfaq' ) );

    $q_before   = html_entity_decode( $q_before );
    $q_after    = html_entity_decode( $q_after );

Answer 1

When I create shortcodes that accept html tags i only take the tag name, meaning that if the tag is <h3> then i ask the user to enter h3 and i add the <, </ and > in the shortcode handler ex:

extract( shortcode_atts( array(
    'count'         => -1,
    'category_name' => '',
    'q_tag'         => 'h3',
    'orderby'       => 'date', //'none','ID','author','title','name','date','modified','parent','rand','menu_order'
    'order'         => 'ASC', //'DESC'  
), $atts, 'myfaq' ) );

$q_before   = '<'.$q_tag.'>';
$q_after    = '</'.$q_tag.'>';

I'm not saying that its best practice but at least I'm only asking the user to provide on tag name instead of opening and closing tags and i don't need any extra conversions using html_entity_decode.

Answer 2

I guess it Would be ok as long as you also verify what tags are being passed, with a filter like th wp_kses function.

extract( shortcode_atts( array(             
        'count'         => -1,
        'category_name' => '',
        'q_before'      => '<h3>',
        'q_after'       => '</h3>',
        'orderby'       => 'date', //'none','ID','author','title','name','date','modified','parent','rand','menu_order'
        'order'         => 'ASC', //'DESC'  
), $atts, 'myfaq' ) );
$allowed_tags = array(
                    'a' => array(
                       'href' => array(),
                       'title' => array()
                    ),
                    'br' => array(),
                    'em' => array(),
                    'strong' => array(),
                );
$q_before   = wp_kses(html_entity_decode( $q_before ),$allowed_tags);
$q_after    =  wp_kses(html_entity_decode( $q_after ),$allowed_tags);

This would allow the user to enter more than 1 tag but only br, em, strong and a tags and only the attributes href and title for the links