i am building a custom meta box having a classic editor input rather than just input. The reason for using wp_editor is that I wanted to add paragraphs of text inside div but the simple input escaped the html. Now i am using this function. Now the problem is that when I output the data of this editor input, it escapes html. Here is the code I use for output.
echo get_post_meta($post_id, 'skyscraper_post', true );
I use this code for adding meta boxes.
add_action( 'add_meta_boxes_post', function ( $post ) {
if ( $post->_wp_page_template === 'page-templates/skyscraper-post.php' ) {
add_meta_box( 'sky_post_excerpt', 'SkyScraper Post Excerpt and Links', 'sky_post_excerpts', 'post', 'advanced', 'high' );
}
});
function sky_post_excerpts() {
global $post;
$values = get_post_custom( $post->ID );
$data = get_post_meta($post->ID, 'skyscraper_post', true);
$strong_title = isset( $values['skyscraper_strong'] ) ? esc_html( $values['skyscraper_strong'][0] ) : "";
$title = isset( $values['skyscraper_post_title'] ) ? esc_attr( $values['skyscraper_post_title'][0] ) : "";
$text = isset( $values['skyscraper_post'] ) ? $values['skyscraper_post'][0] : "";
$image = isset( $values['skyscraper_post_image'] ) ? esc_attr( $values['skyscraper_post_image'][0] ) : "";
// We'll use this nonce field later on when saving.
wp_nonce_field( 'my_post_meta_box_nonce', 'post_meta_box_nonce' );
?>
<table class="form-table">
<tbody>
<tr valign="top">
<th scope="row">
<label><strong>Skyscraper Title</strong></label>
</th>
<td>
<p><input class="widefat" name="skyscraper_strong" id="skyscraper_strong" ><?php echo $strong_title; ?></input>
</p>
<p><input class="widefat" rows="4" name="skyscraper_post_title" id="skyscraper_post_title" value="<?php echo $title; ?>"/>
</p>
</td>
</tr>
<tr valign="top">
<th scope="row">
<label for="skyscraper_post"><strong>Skyscraper Page Excerpt</strong></label>
</th>
<td>
<?php wp_editor( $data, 'post_meta_box', $settings = array('textarea_name'=>'skyscraper_post')); ?>
</p>
</td>
</tr>
<tr valign="top">
<th scope="row">
<label for="skyscraper_image"><strong>SVG Image Link</strong></label>
</th>
<td>
<p><input class="widefat" rows="4" name="skyscraper_post_image" id="skyscraper_post_image" value="<?php echo $image; ?>"/>
</p>
</td>
</tr>
</tbody>
</table>
<?php
}
To save the data I use this code.
add_action( 'save_post', 'post_meta_box_save' );
function post_meta_box_save( $post_id ) {
// Bail if we're doing an auto save
if( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) return;
// if our nonce isn't there, or we can't verify it, bail
if( !isset( $_POST['post_meta_box_nonce'] ) || !wp_verify_nonce( $_POST['post_meta_box_nonce'], 'my_post_meta_box_nonce' ) ) return;
// if our current user can't edit this post, bail
if( !current_user_can( 'edit_post' ) ) return;
//$allowed = wp_kses_allowed_html();
$allowed= array(
'p' => array(
'class' => array(),
'id' => array(),
),
'strong' => array(),
);
// Make sure your data is set before trying to save it
if( isset( $_POST['skyscraper_post'] ) )
update_post_meta( $post_id, 'skyscraper_post', wp_kses( $_POST['skyscraper_post'], $allowed ) );
// Make sure your data is set before trying to save it
if( isset( $_POST['skyscraper_post_image'] ) )
update_post_meta( $post_id, 'skyscraper_post_image', wp_kses( $_POST['skyscraper_post_image'], $allowed ) );
// Make sure your data is set before trying to save it
if( isset( $_POST['skyscraper_strong'] ) )
update_post_meta( $post_id, 'skyscraper_strong', wp_kses( $_POST['skyscraper_strong'], $allowed ) );
// Make sure your data is set before trying to save it
if( isset( $_POST['skyscraper_post_title'] ) )
update_post_meta( $post_id, 'skyscraper_post_title', wp_kses(
$_POST['skyscraper_post_title'], $allowed ) );
}
I don't know why the html is being escaped. Any help will be appreciated, Thanks.
htmlspecialchars($_POST['skyscraper_post'])
. Perhaps you could just remove that and thehtmlspecialchars_decode()
?wp_specialchars_decode
instead ofhtmlspecialchars_decode
? Also you could use thesanitize_text_field
instead ofwp_kses
to sanitize the $_POST data.