1

I have this code in my php file that creates a button labeled from a field called speaker_file_label and links to a pdf file based on the url entered in the speker_file_url. The fields are created by ACF

    echo do_shortcode(  "[av_button label='".get_sub_field('speaker_file_label')."' link='manually,".get_sub_field ('speaker_file_url')."' link_target='_blank' size='medium' position='left' color='theme-color']" ).'<br>';

This works perfectly when someone just enters text. However if they say somehting like "joe's files" (without quotes) Then the shortcode breaks and the label just becomes "click"

How can i make wordpress not interpret that apostrophe as part of code?

0

you could apply the content filters:

    echo do_shortcode(  "[av_button label='".apply_filters('the_content',(get_sub_field('speaker_file_label'))."' link='manually,".get_sub_field ('speaker_file_url')."' link_target='_blank' size='medium' position='left' color='theme-color']" ).'<br>';

the above added pp marks <p></p>

try this:

    echo do_shortcode(  "[av_button label='".wptexturize( get_sub_field('speaker_file_label'))."' link='manually,".get_sub_field ('speaker_file_url')."' link_target='_blank' size='medium' position='left' color='theme-color']" ).'<br>';
  • this brought the text back but added paragraphs into my text, can i stop that portion with the filter? – pressword Nov 3 '16 at 20:46
  • made changes...use wptexturize – rudtek Nov 3 '16 at 20:59
  • If he uses the the_content filter hook, the content of the field will go through all functions hooked to it, weird things will follow. – Nabil Kadimi Nov 3 '16 at 21:14
2

Wrap user input in esc_html().

Using your example:

    echo do_shortcode( "[av_button 
        label='" . esc_html( get_sub_field( 'speaker_file_label' ) ) . "' 
        link='manually," . esc_html( get_sub_field ( 'speaker_file_url' ) )."' 
        link_target='_blank'
        size='medium' position='left' color='theme-color']" ).'<br>';

You can make it more readable:

$shortcode = sprintf( "[av_button label='%1$s' link='manually,%2$s' link_target='_blank' size='medium' position='left' color='theme-color']"
    , esc_html( get_sub_field( 'speaker_file_label' ) )
    , esc_html( get_sub_field( 'speaker_file_url' ) )
);

echo do_shortcode( $shortcode ) . '<br>';
  • There are multiple benefits to this approach. esc_html is very powerful – klewis Nov 4 '16 at 3:20
0

Two ways to fix it, would be to invert your quotes from the outset (replace all double quotes (") with single quotes (') and vice versa.

echo do_shortcode(  '[av_button label="' . get_sub_field('speaker_file_label') . '" link="manually,' . get_sub_field ('speaker_file_url') . '" link_target="_blank" size="medium" position="left" color="theme-color"]' ).'<br>';

But that won't stop if people use double quotes ("), so you can escape them, by using addslashes

echo do_shortcode(  '[av_button label="' . addslashes( get_sub_field('speaker_file_label') ) . '" link="manually,' . addslashes( get_sub_field ('speaker_file_url') ) . '" link_target="_blank" size="medium" position="left" color="theme-color"]' ) . '<br>';

This should fix most issues, the first one might fix them all if you don't expect people to use double quotes. I haven't tested either, so let me know if they worked for you or not.

  • this didn't work. The first option you're correct, someone might use quotes. The 2nd option didn't make any changes... – pressword Nov 3 '16 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.