Escape HTML on WP input

Question

I am slightly stuck on creating a widget, it has an input (bit like the default text widget) but got an issue adding html into it.

My code is:

$instance['content'] = ( ! empty( $new_instance['content'] ) ) ? esc_html( $new_instance['content'] ) : '';

This works partially as it let me saves the HTML (an iframe) but displays it as code in the frontend, I need it to convert the iframe code to a working video.

I have also tried:

$instance['content'] = ( ! empty( $new_instance['content'] ) ) ? strip_tags( $new_instance['content'] ) : '';

but it won't let me save the iframe content (it clears the box).

Which function do I need to use so my widget behaves the same as the default text widget.

Answer 1

The default text widget - WP_Widget_Text - can be found in wp-includes/default-widgets.php. The input is handled like this:

• stripslashes( wp_filter_post_kses( addslashes( $text ) ) ); for the text;

I assume this should work likewise for your custom widget. Additionally there is:

• wpautop( $text ) on the output, if the filter is set to do that;

But optimally you're taking a look at the source yourself.

Additionally the codex articles:

• Validating Sanitizing and Escaping User Data; and
• Data Validation

give you an good overview about sanitizing, escaping and validating possibilities with WP.