I'm developing a plugin which enables the user to send HTML emails from within the WordPress admin. How should I sanitize the textarea input? It has to be able to contain the whole range of HTML tags that might appear in an HTML email. If I use wp_kses() then I would have to use a huge list of allowed tags.

The textarea saves its content to the db via custom options.

1 Answer 1


There is already a huge list built for you, which can be returned by wp_kses_allowed_html() based on context, and filtered via the wp_kses_allowed_html filter, also contextually. Creating that list should not be hard.

However, "the whole range of HTML tags that might appear in an HTML email" should be pretty close to the range allowed for an ordinary post so wp_kses_post() ought to get you a long way with little effort.

  • Yes that is a big list. So I just import that as the parameter then add the extras I need, like <html> and <body> etc.
    – tommyf
    Mar 12, 2014 at 6:05
  • Yes, if you need your users to include that much markup. I'd generate that part for them, if it were me.
    – s_ha_dum
    Mar 12, 2014 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.