Hi have a setting screen where I allow users to create HTML emails with the convenience of the editor they are already used to from posts and pages using wp_editor();

Everything seems to work fine except when I try to save with texts which are in quotes when the value returns it has the escaping, I know that's because wp_kses_post(); sanitizes the data but what if user wants to create an HTML email with quotes in it?

I know I could do a str_replace, but is there another way? Should I even be using wp_kses_post(); if I plan to allow quotes?

wp_editor code:

wp_nonce_field('tld_wcdpue_settings_nonce_action', 'tld_wcdpue_settings_nonce_field');

$tld_wcdpue_settings_email_content = get_option('tld_wcdpue_settings_email_content');

wp_editor( $tld_wcdpue_settings_email_content, 'tld_wcdpue_settings_wpeditor', array( 'wpautop' => false ) );

wp_editor saving code:

if( isset(//does authentication here) ){

update_option( 'tld_wcdpue_settings_email_content', wp_kses_post( $_POST['tld_wcdpue_settings_wpeditor'] ) );


When this gets saved to the DB it gets escaped so the return is:

enter image description here

I know I could simply do a str_replace but wouldn't that be defeating the purpose of wp_kses_post? Should I even be using it in this case? I also realize I am not escaping when pulling the data from the db, not sure how I should since I want HTML to render in the editor


Wordpress always escapes quotes encountered in the super globals variables. It is done in https://developer.wordpress.org/reference/functions/wp_magic_quotes/

You will most likely want to strip it with stripslashes before saving it into the DB. something like

update_option( 'tld_wcdpue_settings_email_content', wp_kses_post( stripslashes($_POST['tld_wcdpue_settings_wpeditor'] ) ));


I don't believe you need to use wp_kses_post().

update_option() runs sanitize_option() which should take care of everything for you.

Test it and let me know what happens.

  • It turns out I would need wp_kses_post, because if I didn't then users would be able to add JS to the db when only HTML should be allowed. – Uriahs Victor Oct 29 '16 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.