In trying to post an article on one of the new SE blogs, I came across the following problem. I'm listed as an author which means that my abilities are somewhat restricted. In particular, I'm not allowed to post arbitrary HTML, rather my entries are sent through the kses parser first. This seems a Good Thing in general (I don't want to be held responsible for the HTML!) but it interferes with one piece of the Markdown processor: quotes. I can't write:

> this is a quote

because the > gets escaped by the kses routines. Now, modifying the kses code to allow that through is tricky, and is the Wrong Solution (because it would make the kses parser knit too tightly to the Markdown one; actually, the Right Solution would be to validate the data after it had been processed, but never mind ...). This isn't a big problem because, of course, I can just use the <blockquote>...</blockquote> tags directly. Only that turns off the Markdown processor inside it. Since we're using PHPMarkdownExtra (at least, tests seem to indicate that we are), I can use the markdown="1" fake attribute to turn on Markdown inside the blockquote. But this gets taken out by kses as it's not on the list of approved attributes!

However, adding markdown to the list of approved attributes seems much easier than adding support for the > quote syntax; in particular there is an array $allowedposttags that holds this information so it would mean simply changing that array in an obvious way.

But, and this is the question, where is the right place to do that modification? Clearly, modifying kses.php is the Last Resort. My guess would be that the Right Place would be for the markdown.php file to do this modification (since that's the file that knows that Markdown is going to be used). But if I don't want to change anything that might be changed upstream, where should I put the required change?

(When I say "I" in the above, I don't actually mean "me" since I want this to be changed on the SE blogs; so please explain it in language that Rebecca Chernoff can understand!)

1 Answer 1


In detail there's the constant CUSTOM_TAGS that allowes defining $allowedposttags, $allowedtags, $allowedentitynames.

Then you can simply set CUSTOM_TAGS to true and define the globals in a function hooked before kses gets included.

The first available hook to fire an action that defines $allowedposttags would be muplugins_loaded, but I don't know if kses is loaded before or after it.

// Set custom tags to override $allowedposttags, $allowedtags, $allowedentitynames
if ( ! defined( 'CUSTOM_TAGS' ) )
    define( 'CUSTOM_TAGS', true );

You also got the wp_kses_hook() that contains a self explanatory filter:

apply_filters('pre_kses', $string, $allowed_html, $allowed_protocols);
  • Looking at the code, I wasn't sure that CUSTOM_TAGS actually defined $allowedposttags but rather that it stopped kses defining it itself (so preventing kses overwriting an earlier definition). You still have to actually define it. Also, my question was: where, meaning "in what file", should I put the new definition of $allowedposttags? My apologies if this was not clear. Jul 28, 2011 at 13:14
  • Write a plugin and hook it as early as possible.
    – kaiser
    Jul 28, 2011 at 13:30
  • You'd want to define the constant before kses.php is included(technically it's a require_once call, but you get the point) by wp-settings.php ... the require happens before any actions in wp-settings.php though, so i'd suggest trying the config file(seems strange, but i'd consider it appropriate due to the load sequence of core WordPress files). Else you'll fire on an action that occurs after kses has been included and defined the data already..
    – t31os
    Jul 28, 2011 at 13:39
  • ... the more ideal solution might be to hook the kses filter instead, so you don't have to define the tags using the constant.
    – t31os
    Jul 28, 2011 at 13:41
  • @t31os: I guess that if I know my file is loaded after kses.php then I can redefine $allowedposttags as I wish: the danger was that kses.php would overwrite my changes (in fact, defining it afterwards has some advantages as I only need to add the changes rather than define the whole array). Still, where to put plugin configurations isn't clear to me. Jul 28, 2011 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.