Here is an example:

$allowedPart = "<a href='http://alink.com'></a>";
$unsafePart = "<h1>A title</h1>";
$unsafePart .= "<script>alert('a script!!!');</script>";

$unsafeString = $allowedPart . $unsafePart;

$allowed = array("a"=>array(

$sanitizedString = wp_kses($unsafeString, $allowed);

$sanitizedString should be equals to $allowedPart, but something goes wrong and $sanitizedString remains the same as $unsafeString.

What's wrong?


Sorry, after saving to the database, I did location.reload(), and consequently in the textarea was maintained the original content, but in database the value is almost correct. This secondary issue was solved using:

window.location.href = window.location.href;

However there is a problem, 'href' disappears too, why?

For example

<a href='http://alink.com'>Link</a> becomes <a>Link</a>

Trying something like: $allowed = array( 'img'=>array( 'src'=>array(), ));

<img src='img.png' /> becomes <img />

It's as if wp_kses() recognize as unallowed all the attributes in sub-array (like href or src), filtering them and their content.


Using double quotes instead of single ones seems to solve.

$allowed = array( 'img'=>array( 'src'=>array(), ));

<img src="img.png" />

  • I just had the same experience, replaced single quotes with double quotes and now it works as expected. Seems buggy to me. May 9, 2017 at 11:51

1 Answer 1


wp_kses (Codex) removes unallowed tags, but it doesn't remove their content. So, if you have a <script>{something}</script>, wp_kses only removes the tags, not the content, returning {something}. Thus, this is intended behaviour and your issue doesn't seem to be a bug.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.