wp_kses ignore allowed and allow everything

Question

Here is an example:

$allowedPart = "<a href='http://alink.com'></a>";
$unsafePart = "<h1>A title</h1>";
$unsafePart .= "<script>alert('a script!!!');</script>";

$unsafeString = $allowedPart . $unsafePart;

$allowed = array("a"=>array(
                    "href"=>array()
           ));

$sanitizedString = wp_kses($unsafeString, $allowed);

$sanitizedString should be equals to $allowedPart, but something goes wrong and $sanitizedString remains the same as $unsafeString.

What's wrong?

==========================

Sorry, after saving to the database, I did location.reload(), and consequently in the textarea was maintained the original content, but in database the value is almost correct. This secondary issue was solved using:

window.location.href = window.location.href;

However there is a problem, 'href' disappears too, why?

For example

<a href='http://alink.com'>Link</a> becomes <a>Link</a>

Trying something like: $allowed = array( 'img'=>array( 'src'=>array(), ));

<img src='img.png' /> becomes <img />

It's as if wp_kses() recognize as unallowed all the attributes in sub-array (like href or src), filtering them and their content.

==========================

Using double quotes instead of single ones seems to solve.

$allowed = array( 'img'=>array( 'src'=>array(), ));

<img src="img.png" />

Answer 1

wp_kses (Codex) removes unallowed tags, but it doesn't remove their content. So, if you have a <script>{something}</script>, wp_kses only removes the tags, not the content, returning {something}. Thus, this is intended behaviour and your issue doesn't seem to be a bug.