-1

I've been looking for ways to do this, and this is what I have so far. As you can see, I've tried many things and I looked around, all the answers for this sort of question are for how to enable execution, not disable it, I'd like to not have to use a plugin, if possible. The pre and code tags do not display here but what you'd see is that there are pre, code and textarea readonly="readonly" tags before and after this. I also tried using esc_html which didn't work.


    
    esc_html(add_action('wp_ajax_nopriv_mytheme_more_post_ajax', 'mytheme_more_post_ajax');
    add_action('wp_ajax_mytheme_more_post_ajax', 'mytheme_more_post_ajax');
    $t = 0;
    if (!function_exists('mytheme_more_post_ajax')) {
        function mytheme_more_post_ajax(){

$ppp = (isset($_POST[&#39;ppp&#39;])) ? $_POST[&#39;ppp&#39;] : 3; $cat = (isset($_POST[&#39;cat&#39;])) ? $_POST[&#39;cat&#39;] : &#39;&#39;; $offset = (isset($_POST[&#39;offset&#39;])) ? $_POST[&#39;offset&#39;] : 0; $post_type = (isset($_POST[&#39;post_type&#39;])) ? $_POST[&#39;post_type&#39;] : &#39;&#39;; $args = array( &#39;post_type&#39; =&gt; $post_type, &#39;posts_per_page&#39; =&gt; $ppp, &#39;post_status&#39; =&gt; &#39;publish&#39;, &#39;post__not_in&#39; =&gt; $do_not_duplicate, &#39;cat&#39; =&gt; $cat, &#39;offset&#39; =&gt; $offset, ); $loop = new WP_Query($args); $out = &#39;&#39;; if ($loop -&gt; have_posts()) : while ($loop -&gt; have_posts()) : $loop -&gt; the_post(); $category_out = array(); $categories = get_the_category(); foreach ($categories as $category_one) { $category_out[] =&#39;&lt;a href=&quot;&#39;.esc_url( get_category_link( $category_one-&gt;term_id ) ).&#39;&quot; class=&quot;&#39;.strtolower($category_one-&gt;name).&#39;&quot;&gt;&#39; .$category_one-&gt;name.&#39;&lt;/a&gt;&#39;; } $category_out = implode(&#39;, &#39;, $category_out); $cat_out = (!empty($categories)) ? &#39;&lt;span class=&quot;cat-links&quot;&gt;&lt;span class=&quot;screen-reader-text&quot;&gt;&#39;.esc_html__(&#39;Categories&#39;, &#39;creativesfeed&#39;).&#39;&lt;/span&gt;&#39;.$category_out.&#39;&lt;/span&gt;&#39; : &#39;&#39;; $id = get_the_ID(); if ($t == 2) : $out .= &#39;&lt;div class=&quot;col-md-4 col-sm-12&quot;&gt; &lt;div class=&quot;adinspire&quot;&gt; &lt;/div&gt; &lt;/div&gt;&#39;; elseif ($t == 5) : $out .= &#39;&lt;div class=&quot;col-sm-12&quot;&gt; &lt;div class=&quot;adlong2&quot;&gt; &lt;/div&gt; &lt;/div&gt;&#39;; endif; if ($t == 9 || $t == 16) : $out .= &#39;&lt;div class=&quot;col-md-4 col-sm-12&quot;&gt;&#39;; else : $out .= &#39;&lt;div class=&quot;col-md-4 col-sm-6&quot;&gt;&#39;; endif; $out .= &#39;&lt;div class=&quot;squarepost hvrlines&quot;&gt; &lt;div class=&quot;noflow&quot;&gt;&#39;; $out .= &#39;&lt;a class=&quot;postLink&quot; href=&quot;&#39;.esc_url(get_permalink()).&#39;&quot; aria-hidden=&quot;true&quot; style=&quot;opacity: 1;&quot;&gt;&#39;; $out .= srcset_post_thumbnail(); $out .= &#39;&lt;/a&gt;&#39;; $out .= &#39;&lt;/div&gt; &lt;h4 class=&quot;info&quot;&gt;&lt;span&gt;&#39;.print_categories().&#39;&lt;/span&gt;&lt;/h4&gt; &lt;h2 class=&quot;head3&quot;&gt;&lt;a&gt;&#39;.get_the_title().&#39;&lt;/h2&gt; &lt;p class=&quot;smallp&quot;&gt;By: &#39;.get_field(&#39;design_company&#39;, $id).&#39;&lt;/p&gt; &lt;/div&gt; &lt;/div&gt;&#39;; $t ; endwhile; endif; wp_reset_postdata(); wp_die($out); } })</code></pre></textarea>
  • 3
    I don't know what your pastebin contains or is supposed to be, but PHP execution does not happen in the post content by default, so turn off whatever you have that enables that and then it will be disabled. – Otto May 1 '18 at 14:26
  • downvoted s question should be self contained. You are welcome to edit it to make all the relevant information available at the question itself – Mark Kaplun May 1 '18 at 14:39
  • I suspect that what you mean my PHP execution isn't what most people do, or, information is missing. E.g. the AJAX endpoint in your question seems unrelated and out of place, can you edit your question with more context? E.g. can you copy paste PHP code into the post are and it runs? Or do you mean HTML shows up in post content? – Tom J Nowell May 1 '18 at 14:47
  • Also note that questions are written in markdown not HTML, look at the relevant formatting options and quick guides in the edit question UI. Is your question that you want to embed code on a page, but it gets interpreted as markup by the browser instead? PHP Execution happens on the server, aka eval( 'echo 1+1' ); would send the number 2 to the browser. I strongly suspect your problem is escaping not PHP execution – Tom J Nowell May 1 '18 at 14:48
  • My intention is to display a code snippet without executing it but after trying several things, it still executes this code and displays actual post thumbnails. – Joshua Wilkeson May 1 '18 at 14:54
2

I think your answer is about escaping not execution, e.g.:

    Why does this text appear bold  

versus:

    <b>Why does this text appear bold</b>  

The problem is escaping, but first, some notes:

The Problem With Calling it Execution

Executing is the wrong word to use, which is why your googling did not yield results. No PHP is being executed here. Instead, your browser is returning HTML markup, and the browser is displaying it. What you want is to display a code snippet without it showing as real HTML. So escaping/encoding is the problem, not execution, and people will get confused if you call it execution.

Execution implies that code runs, no code is running here.

esc_html and how functions work

You can't just wrap a code block in esc_html( <code goes here>), that's not how functions work. esc_html isn't a magic modifier that wraps things like an if statement or a while loop, it isn't a language construct, it's a function.

Functions take something, do work on that something, then return it.

function func ( $in ) {
    return 'output';
}
$in = 'input';
$out = func( $in );
echo $out; // output

esc_html is an escaping function. It takes unsafe input, escapes it, and returns it.

E.g.

echo esc_html( '<script>dangerous();</script>');

Outputs this in the HTML source:

&lt;script&gt;dangerous();&lt;/script&gt;

Which will render in the browser as a readable string like this:

<script>dangerous();</script>

For Your Situation

$out = 'unescaped html code with no html entities';
echo esc_html( $out );

Additionally, you may want to look into other escaping functions for your other code as a security measure.

0

I found the solution was that I had an html element higher up in the post that wasn't escaped and so the php was attaching to that and showing the posts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.