0

I've just started code according to VIP WordPress Coding Standards and I stuck with sanitization. I know that all outputs need sanitization without any exception. But how can I do sanitization of a function which has HTML code output itself? Eg. function yoast_breadcrumb() from Yoast's WordPress SEO plugin which outputs HTML formatted breadcumb..?

<?php echo yoast_breadcrumb( '', '', false ); ?>

Output:

<span prefix="v: http://rdf.data-vocabulary.org/#"><span typeof="v:Breadcrumb"><a href="https://rnc-wordpress-wrongware.c9.io" rel="v:url" property="v:title">Main Page</a></span> › <span typeof="v:Breadcrumb"><span class="breadcrumb_last" property="v:title">Page doesn't exist</span></span></span>
Improve this question
8
  • You don't. yoast_breadcrumb() is already sanitizing by itself.
    – TheDeadMedic
    Commented Mar 9, 2015 at 10:58
  • I know that it's. But please read VIP WP standards, you have to sanitize everything. Here is good explanation - vip.wordpress.com/2014/06/20/…
    – Emetrop
    Commented Mar 9, 2015 at 11:02
  • Check out wp_kses() for sanitizing HTML.
    – TheDeadMedic
    Commented Mar 9, 2015 at 11:04
  • So do I need every single function check for output, find out which html tags are used and write them all to the wp_kses function ok? It's so much work.
    – Emetrop
    Commented Mar 9, 2015 at 11:12
  • 1
    Agreed, but unlikely. There is no shortcut or win-win. If you want to strictly adhere to VIP coding standards, you need to put the work in - and accept there will always (potentially) be a consequence of aggressive sanitization.
    – TheDeadMedic
    Commented Mar 9, 2015 at 11:23

1 Answer 1

Reset to default
0

The more elaborate data is, the harder it is to both formulate and implement sanitization process.

For a number this might be as simple as "integer" and (int)$number.

For HTML this is highly not trivial with different possibilities of desired scope (no HTML tags? some blacklisted tags? some whitelisted tags? what about embedded scripts? CSS?) and very challenging implementation.

While WP does have wp_kses() implementing sanitization of HTML, it's relatively slow and its reputation is less than stellar (or so I read in context of other established sanitization libraries).

I would say that in question as stated, the practical expectation is that function engineered to act as template tag is expected to produce sanitized output.

If you don't believe it to, it would probably make more sense to audit it (and report any discovered shortcomings to developer) rather than try to sanitize complex output.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.