2

I am having a bit of an issue right now with the VIP coding standards. I am trying to print out an admin notice as follows:

add_action( 'admin_notices', function() {
    $class = 'notice notice-warning is-dismissible';
    $message = __( 'We suggest that you use the <b>API Key file</b> for your API Keys.', 'package-wordpress' );

    print wp_sprintf( '<div class="%s"><p>%s</p></div>', $class, $message );

});

It is successful in that it prints and displays the notice, however, when I run my code standards check, it throws escaping function errors.

----------------------------------------------------------------------
FOUND 2 ERRORS AFFECTING 1 LINE
----------------------------------------------------------------------
101 | ERROR | Expected next thing to be an escaping function (see
    |       | Codex for 'Data Validation'), not '$class'
101 | ERROR | Expected next thing to be an escaping function (see
    |       | Codex for 'Data Validation'), not '$message'
----------------------------------------------------------------------

I have done some research on this issue and found that it really wants me to escape the html when printing it to the screen, however when I do that, it of course removes the ability to have HTML inside of the message. What are the suggestions for doing this while still passing the coding standards?

3

One way you can handle this would be to do the wp_sprintf when assigning the value of the $message variable and then use wp_kses when you want to output. You could also output the div and paragraph tags before and after the message, which would eliminate the need for wp_sprintf in this instance.

add_action( 'admin_notices', function() {
        $message = __( 'We suggest that you use the <b>API Key file</b> for your API Keys.', 'package-wordpress' );
        echo '<div class="notice notice-warning is-dismissible"><p>' . wp_kses( $message, array( 'b' => array() ) ) . '</p></div>';
});

If you wanted to keep it closer to the original you could do something like:

add_action( 'admin_notices', function() {
        $class = 'notice notice-warning is-dismissible';
        $message = wp_sprintf( __( '<div class="%s"><p>We suggest that you use the <b>API Key file</b> for your API Keys.</p></div>', 'package-wordpress' ), $class );

        echo wp_kses( $message, array(
            'div' => array( 'class' => array() ),
            'p' => array(),
            'b' => array(),
        ));
});
  • Can you explain to me why this work. It also seems very hackish to me. – bretterer Aug 29 '16 at 18:43
  • The above escapes the variable $message before being output, which is what the standards require. The first example in the Codex breaks out of PHP in the function to output the HTML markup, which to me seems worse and I personally prefer to avoid that if possible. Yes, it would probably be better if WP had something built in where you could just pass the notice classes and the message to a function that would output the markup but it doesn't AFAIK. Added another example above if you want to keep it closer to the original. – Bjorn Aug 29 '16 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.