I'm retrieving some HTML (regulatory press releases) from an external source via an API. This HTML will be inserted as custom posts into the WordPress database.

Naturally, I want to sanitize the data, but also clean up the messy HTML formatting to a reasonable extent. I'm thinking removing all <span> elements and all style="" attributes is a good start.

I've looked into the wp_kses($string, $allowed_html) function which looks like it might suit this purpose. Instead of building my own $allowed_html, which would be tedious, error prone and susceptible to obsoletion, I'm considering just using the WordPress default, as provided by wp_kses_allowed_html($context) and modify it. Like so:

$allowed_html = wp_kses_allowed_html( 'post' );
unset( $allowed_html[ 'span' ] );
foreach ( $allowed_html as &$attributes ) {
    unset( $attributes[ 'style' ] );
unset ($attributes);

My question is: Is there a more canonical/elegant way to disallow certain elements and attributes. The loop above looks so home brewed.

  • I think you first hunch was correct, but it needn't be so tedious, just copy paste the allowed html it uses from the source code, and adjust it for your needs – Tom J Nowell Mar 7 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.