I need to iframe a series of content on our site. I need to pass on the the user information via a URL - vendor request.

I have tons of shortcodes that display the username. It works fine. But when I append the src record it doesn't work.

<iframe src="https://test.com/video/112/[currentuser_username]" width="800" height="450">
    <p>Your browser does not support iframes.</p>

This should display:


but of course it displays...


I know of ways I can do this via templating and in php. Would like a way to do this inside the html editor so that our authors have more flexibility. Am I just having a brain fart or is it that complicated?

  • You could make a new shortcode that accepts a url as a parameter than appends the username to the end and outputs an iframe. – ngearing Jun 9 '16 at 23:24
  • @Nath - Yea I know there are work-arounds but then we have other issues. I can template these in, I can create short codes but then there are layers of other things. For instance the word video can change to 4 other parameters and the number 112 in the example can be any video number. So much easier if they can just change it in the text editor. – STing Jun 10 '16 at 3:49

Don't remember exactly when (4.3?) core had gone with a much more restrictive parsing of shortcodes due to many security problems that the lax parsing with combination of poorly implemented shortcodes had created. The end result is that you can not use a shortcode in an attribute.

The right solution is to have a shortcode that produces the whole iframe. Partial kinds of shortcodes are never a great idea as in most cases, they are not easy to understand and too easy to break with some accidental input.

  • 1
    There are a lot of reasons why I don't want to create a shortcode for this - one being is the code is used cross-site across a large group of authors... some of them not technical at all. I did read about the shortcode security issues. My reaction BOOOOO BOOO ignore Ignore. My sites are SSL sitting behind SSO - I could care less about some injection because of a bad shortcode. I just want this crap to work easy and for my authors to not have to memorize a book before adding content. – STing Jun 10 '16 at 5:23
  • :( just because you don't understand the secutity threat doesn't mean it doesn't exists. If it was a user display name it would have been easy to demonstrate, but with user name you might be ok. Anyway you had a question and this is the answer, and you don't have to like it ;) – Mark Kaplun Jun 10 '16 at 8:13
  • As a side note, this is exactly why wordpress is better then some CMS X. It doesn't let you easily shot yourself in the foot.You might not like the gun control, but usually it is a very good thing – Mark Kaplun Jun 10 '16 at 8:21
  • In my case your analogy is perfect. It is like putting the safety on a gun. But my gun is in the basement, locked in a cell of a police station. Meaning them breaking into the police station is the serious threat, not the safety being on our off. I am not saying my sites are unhackable... but you wouldn't even know what to hack - there are three layers of SSO and nothing visible. – STing Jun 10 '16 at 15:57
  • Bad coding has more to do with hacked sites than "stolen credentials". Last two major bugs reported in plugins where a direct remote execution that did not required any credentials and therefor no manner how many layers of SSO and the strength of certificate that you have would have protected you if you used any of the relevant plugins – Mark Kaplun Jun 10 '16 at 16:20
<iframe src=https://test.com/video/112/[currentuser_username] width="800" height="450">
    <p>Your browser does not support iframes.</p>

Simply removing the quotes around everything worked. All modern browsers add these back in - when that stops working (doubt anytime soon) we might have to create some advanced shortcode but this leaves us more options right now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.