1

I want to let the user of my plugin define html tags to use before and after the text output by the shortcode, so I am using parameters where they can enter the tags. However the tags are being converted to html entities. I therefore resorted to using html_entity_decode(), is this good practice?

    extract( shortcode_atts( array(             
            'count'         => -1,
            'category_name' => '',
            'q_before'      => '<h3>',
            'q_after'       => '</h3>',
            'orderby'       => 'date', //'none','ID','author','title','name','date','modified','parent','rand','menu_order'
            'order'         => 'ASC', //'DESC'  
    ), $atts, 'myfaq' ) );

    $q_before   = html_entity_decode( $q_before );
    $q_after    = html_entity_decode( $q_after );
  • Yes it is a good practice . I do the same in my themes - more customizability than the Bainternet's answer as the tag then can be in any place like title='My<br>title' – Tolea Bivol Oct 9 '14 at 19:10
1

When I create shortcodes that accept html tags i only take the tag name, meaning that if the tag is <h3> then i ask the user to enter h3 and i add the <, </ and > in the shortcode handler ex:

extract( shortcode_atts( array(
    'count'         => -1,
    'category_name' => '',
    'q_tag'         => 'h3',
    'orderby'       => 'date', //'none','ID','author','title','name','date','modified','parent','rand','menu_order'
    'order'         => 'ASC', //'DESC'  
), $atts, 'myfaq' ) );

$q_before   = '<'.$q_tag.'>';
$q_after    = '</'.$q_tag.'>';

I'm not saying that its best practice but at least I'm only asking the user to provide on tag name instead of opening and closing tags and i don't need any extra conversions using html_entity_decode.

0

I guess it Would be ok as long as you also verify what tags are being passed, with a filter like th wp_kses function.

extract( shortcode_atts( array(             
        'count'         => -1,
        'category_name' => '',
        'q_before'      => '<h3>',
        'q_after'       => '</h3>',
        'orderby'       => 'date', //'none','ID','author','title','name','date','modified','parent','rand','menu_order'
        'order'         => 'ASC', //'DESC'  
), $atts, 'myfaq' ) );
$allowed_tags = array(
                    'a' => array(
                       'href' => array(),
                       'title' => array()
                    ),
                    'br' => array(),
                    'em' => array(),
                    'strong' => array(),
                );
$q_before   = wp_kses(html_entity_decode( $q_before ),$allowed_tags);
$q_after    =  wp_kses(html_entity_decode( $q_after ),$allowed_tags);

This would allow the user to enter more than 1 tag but only br, em, strong and a tags and only the attributes href and title for the links

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.