Does WordPress apply any kind of data sanitization for its post content when saving it from admin area? (like stripping <script> tags) Or all it does is checks for some user capability (like current_user_can('edit_posts')?

I'm asking, because I'm making widget plugin:

  • It allows to add or edit HTML content which will be later shown of frontend .
  • It can be edited by site administrator or editor.
  • HTML content can have any structure, can contain script tags and can contain any attributes. So doing wp_kses isn't an option.

My question is, how safe is it do this without any kind of sanitization? (besides checking for current_user_can).

  • WordPress uses sanitize_post() internally – kero Oct 19 '17 at 15:34
  • 1
    There's a capability designed to allow users to add any HTML, including scripts. It's unfiltered_html. That would be the one to check when sanitizing. – Jacob Peattie Oct 20 '17 at 5:15

Safe against/for what? Is "a legitimate user can input any HTML" a safety issue?

If you might handle data from kind-of-but-not-really trusted users, how about giving admins the possibility to define which tags/attributes to strip out (optionally: per user group / role) and your plugin does the rest, or run the content through a filter where they can implement their own logic with add_filter?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.