Here is an example:
$allowedPart = "<a href='http://alink.com'></a>";
$unsafePart = "<h1>A title</h1>";
$unsafePart .= "<script>alert('a script!!!');</script>";
$unsafeString = $allowedPart . $unsafePart;
$allowed = array("a"=>array(
"href"=>array()
));
$sanitizedString = wp_kses($unsafeString, $allowed);
$sanitizedString
should be equals to $allowedPart
, but something goes wrong and
$sanitizedString
remains the same as $unsafeString
.
What's wrong?
==========================
Sorry, after saving to the database, I did location.reload()
, and consequently in the textarea was maintained the original content, but in database the value is almost correct. This secondary issue was solved using:
window.location.href = window.location.href;
However there is a problem, 'href' disappears too, why?
For example
<a href='http://alink.com'>Link</a>
becomes
<a>Link</a>
Trying something like:
$allowed = array(
'img'=>array(
'src'=>array(),
));
<img src='img.png' />
becomes
<img />
It's as if wp_kses() recognize as unallowed all the attributes in sub-array (like href or src), filtering them and their content.
==========================
Using double quotes instead of single ones seems to solve.
$allowed = array(
'img'=>array(
'src'=>array(),
));
<img src="img.png" />