1

Hi have a setting screen where I allow users to create HTML emails with the convenience of the editor they are already used to from posts and pages using wp_editor();

Everything seems to work fine except when I try to save with texts which are in quotes when the value returns it has the escaping, I know that's because wp_kses_post(); sanitizes the data but what if user wants to create an HTML email with quotes in it?

I know I could do a str_replace, but is there another way? Should I even be using wp_kses_post(); if I plan to allow quotes?

wp_editor code:

wp_nonce_field('tld_wcdpue_settings_nonce_action', 'tld_wcdpue_settings_nonce_field');

$tld_wcdpue_settings_email_content = get_option('tld_wcdpue_settings_email_content');

wp_editor( $tld_wcdpue_settings_email_content, 'tld_wcdpue_settings_wpeditor', array( 'wpautop' => false ) );

wp_editor saving code:

if( isset(//does authentication here) ){

update_option( 'tld_wcdpue_settings_email_content', wp_kses_post( $_POST['tld_wcdpue_settings_wpeditor'] ) );

}

When this gets saved to the DB it gets escaped so the return is:

enter image description here

I know I could simply do a str_replace but wouldn't that be defeating the purpose of wp_kses_post? Should I even be using it in this case? I also realize I am not escaping when pulling the data from the db, not sure how I should since I want HTML to render in the editor

2 Answers 2

3

Wordpress always escapes quotes encountered in the super globals variables. It is done in https://developer.wordpress.org/reference/functions/wp_magic_quotes/

You will most likely want to strip it with stripslashes before saving it into the DB. something like

update_option( 'tld_wcdpue_settings_email_content', wp_kses_post( stripslashes($_POST['tld_wcdpue_settings_wpeditor'] ) ));

0
0

I don't believe you need to use wp_kses_post().

update_option() runs sanitize_option() which should take care of everything for you.

Test it and let me know what happens.

1
  • 1
    It turns out I would need wp_kses_post, because if I didn't then users would be able to add JS to the db when only HTML should be allowed. Commented Oct 29, 2016 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.