We have some custom built comments (ones tied to custom post types, that we can't integrate with WP's comment system). But we want to filter the comments when they are submitted the way WP does and also save them to the DB the way WP does so everything is filtered (not really for spam), basically sanitized for security purposes but also if we get the pretty

tags and emoticons that WP will do. We need this to be safe for front end and backend. As I was able to put in tags and have tested with SQL injections and also want to make sure that it doesnt get all the wierd \n \r\n garbage.

  • Check out the action hooks related to comments in the codex. From there you should be able to find out what functions hook into each of the actions you care about. Most if not all of them will be in wp-includes/comment.php. – user66711 Apr 12 '17 at 18:41
  • 1
    What's stopping you from using WP's comment system and using wp_new_comment? (which also sanitizes and validates comments data before inserting it to your database) – Swen Apr 13 '17 at 16:08

You can use wp_filter_kses() and then wp_unslash to filter the content.

  • Can you please explain why to do so? – Max Yudin Apr 14 '17 at 9:11
  • wordpress comments does not allow <script> tags when anyone posts comments without logging in. so if anyone is using custom comments then we can use the above functions to filter the content – Vipul Apr 14 '17 at 9:33

protected by Community May 8 '17 at 14:14

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.