I need a way to run through all submitted values throghh the htmlentities() filter in gravity forms. I am using the gform_pre_submission filter. I am successfuly able to find the type of field since we donot want to do this for URLS or file inputs. But I do not know how to actually grab the fields within the form object. Here's the code I am using.

add_action( 'gform_pre_submission', 'pre_submission_handler' );
public function pre_submission_handler( $form ) 
    foreach ( $form['fields'] as $field ) {
        if ($field->type !== 'fileupload') {
            /* Run the field through htmlentitites filter */
  • 1
    htmlentities is the sort of function you'd run on output, as part of escaping. Why do you need to run it on submission? – Jacob Peattie Nov 16 '18 at 10:47
  • What do you mean by output? I want to run it on the values submitted within the form by the user – Fahad Sohail Nov 16 '18 at 11:38
  • Well normally this function is something you'd run right before outputting into an HTML or XML document, to make sure it doesn't get interpreted as HTML. It's not something you would need to do when saving to the database. – Jacob Peattie Nov 16 '18 at 11:41
  • We're hooking into the email through the hook 'gform_pre_send_email' I just need a way that the values entered by the user on the form are already escaped before they are access by the 'gform_pre_send_email' hook. I couldn't find a hierarchy of how hooks are executed on forms. Could you possibly guide me how – Fahad Sohail Nov 16 '18 at 11:46
  • Gravity Forms doesn't already do this? I'd be surprised if Gravity Forms allowed unescaped HTML into notification emails. – Jacob Peattie Nov 16 '18 at 11:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.