1

I have this code in my php file that creates a button labeled from a field called speaker_file_label and links to a pdf file based on the url entered in the speker_file_url. The fields are created by ACF

    echo do_shortcode(  "[av_button label='".get_sub_field('speaker_file_label')."' link='manually,".get_sub_field ('speaker_file_url')."' link_target='_blank' size='medium' position='left' color='theme-color']" ).'<br>';

This works perfectly when someone just enters text. However if they say somehting like "joe's files" (without quotes) Then the shortcode breaks and the label just becomes "click"

How can i make wordpress not interpret that apostrophe as part of code?

4 Answers 4

0

you could apply the content filters:

    echo do_shortcode(  "[av_button label='".apply_filters('the_content',(get_sub_field('speaker_file_label'))."' link='manually,".get_sub_field ('speaker_file_url')."' link_target='_blank' size='medium' position='left' color='theme-color']" ).'<br>';

the above added pp marks <p></p>

try this:

    echo do_shortcode(  "[av_button label='".wptexturize( get_sub_field('speaker_file_label'))."' link='manually,".get_sub_field ('speaker_file_url')."' link_target='_blank' size='medium' position='left' color='theme-color']" ).'<br>';
3
  • this brought the text back but added paragraphs into my text, can i stop that portion with the filter?
    – pressword
    Nov 3, 2016 at 20:46
  • made changes...use wptexturize
    – rudtek
    Nov 3, 2016 at 20:59
  • If he uses the the_content filter hook, the content of the field will go through all functions hooked to it, weird things will follow. Nov 3, 2016 at 21:14
2

Wrap user input in esc_html().

Using your example:

    echo do_shortcode( "[av_button 
        label='" . esc_html( get_sub_field( 'speaker_file_label' ) ) . "' 
        link='manually," . esc_html( get_sub_field ( 'speaker_file_url' ) )."' 
        link_target='_blank'
        size='medium' position='left' color='theme-color']" ).'<br>';

You can make it more readable:

$shortcode = sprintf( "[av_button label='%1$s' link='manually,%2$s' link_target='_blank' size='medium' position='left' color='theme-color']"
    , esc_html( get_sub_field( 'speaker_file_label' ) )
    , esc_html( get_sub_field( 'speaker_file_url' ) )
);

echo do_shortcode( $shortcode ) . '<br>';
1
  • There are multiple benefits to this approach. esc_html is very powerful
    – klewis
    Nov 4, 2016 at 3:20
0

Two ways to fix it, would be to invert your quotes from the outset (replace all double quotes (") with single quotes (') and vice versa.

echo do_shortcode(  '[av_button label="' . get_sub_field('speaker_file_label') . '" link="manually,' . get_sub_field ('speaker_file_url') . '" link_target="_blank" size="medium" position="left" color="theme-color"]' ).'<br>';

But that won't stop if people use double quotes ("), so you can escape them, by using addslashes

echo do_shortcode(  '[av_button label="' . addslashes( get_sub_field('speaker_file_label') ) . '" link="manually,' . addslashes( get_sub_field ('speaker_file_url') ) . '" link_target="_blank" size="medium" position="left" color="theme-color"]' ) . '<br>';

This should fix most issues, the first one might fix them all if you don't expect people to use double quotes. I haven't tested either, so let me know if they worked for you or not.

1
  • this didn't work. The first option you're correct, someone might use quotes. The 2nd option didn't make any changes...
    – pressword
    Nov 3, 2016 at 20:46
0

You can write "&#39;" instead of ' (single quotation mark) in your text fields.

1
  • The question is about processing user input though. You can't ask your users to do that, nor can you rely on them, nor should you.
    – Rup
    Sep 17, 2021 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.