I'm giving my users the option to store HTML in an option with a wp_editor(), using the wp settings api to handle the form. I currently do not apply any data sanatization to it, but realize I probably should (wp_kses_post($option) ?). I was also wondering if I should do any escaping.

Any tips for good practices on this matter?

  • 3
    Can I ask why your users need to store html? That is going to be error prone in several ways, not least in that you are giving them the ability to thoroughly break the site's formatting. Why is this particular solution necessary? What is the goal you are trying to achieve with this? – s_ha_dum Oct 16 '15 at 13:59
  • From my understanding, wp_editor() tinyMCE already takes care of sanitizing the data to safely be added to the database. You may need to escape it properly to actually display it though. – Howdy_McGee Oct 16 '15 at 14:03
  • @s_ha_dum it's a field where people can enter an email body text. I want to give them rich formatting options and prefer storing this in wp_options rather than creating a post for this purpose. – Ewout Oct 16 '15 at 14:13

Given that you are dealing with email, I'd run wp_kses() with a very limited $allowed_html array similar to this sample from the Codex:

    'a' => array(
        'href' => array(),
        'title' => array()
    'br' => array(),
    'em' => array(),
    'strong' => array(),

HTML rendering is even more squirrelly in email readers than browsers (and there are a lot more readers to worry about) so you want to be very careful what you allow. That is going to mean that you will need to truncate the visual option in your editor too. I am sure there are posts here about doing that.

All in all, I'll consider using a very simple markdown and skipping the complexity of the editor completely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.