10

I'm developing a plugin which enables the user to send HTML emails from within the WordPress admin. How should I sanitize the textarea input? It has to be able to contain the whole range of HTML tags that might appear in an HTML email. If I use wp_kses() then I would have to use a huge list of allowed tags.

The textarea saves its content to the db via custom options.

Improve this question
15

There is already a huge list built for you, which can be returned by wp_kses_allowed_html() based on context, and filtered via the wp_kses_allowed_html filter, also contextually. Creating that list should not be hard.

However, "the whole range of HTML tags that might appear in an HTML email" should be pretty close to the range allowed for an ordinary post so wp_kses_post() ought to get you a long way with little effort.

Improve this answer
2
  • Yes that is a big list. So I just import that as the parameter then add the extras I need, like <html> and <body> etc. – tommyf Mar 12 '14 at 6:05
  • Yes, if you need your users to include that much markup. I'd generate that part for them, if it were me. – s_ha_dum Mar 12 '14 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.