I want to embed WordPress default gallery in comments which has embed code like this:

[gallery link="file" columns="2" size="medium" ids="1,2"]

To do so, I added this code which enables shortcodes in the comments:

add_filter( 'comment_text', 'do_shortcode' )

But someone suggested that is not a secure way to do so. Hence, how should I enable shortcodes in comments the right way or for now I can manage with only gallery shortcode too if there is a way to do that?

1 Answer 1


Indeed, if you allow all kinds of shortcodes to be used in comments, you do not know what effects you get. It might even become a security issue if you have powerful shortcodes installed (perhaps even without knowing it, as a feature you do not use). So, the trick is to selectively allow certain shortcodes. First, let's add a filter to get_comment_text (other than comment_text this will also affect your comments feed).

add_filter ('get_comment_text','wpse334485_filter_shortcodes',10,3);

Now we must make sure that this filter will apply only the gallery filter. That is, we need to strip all shortcodes from the comment except the gallery shortcode. Here we go:

function wpse334485_filter_shortcodes ($comment_text, $comment, $args) {
  $comment_text = strip_shortcodes ($comment_text);
  return do_shortcode ($comment_text);

The above code will strip all shortcodes, so it's not complete. Luckily the strip_shortcodes function has a filter which allows you to influence which tags are removed. Here it is:

add_filter ('strip_shortcodes_tagnames','wpse334485_allow_gallery_shortcode',10,2);
function wpse334485_allow_gallery_shortcode ($tags_to_remove, $comment_text) {
  return array ('[gallery]');

Note that I didn't test this code, so some debugging may be necessary.

  • Hi, thanks for sharing an answer. I added all above code to theme functions.php. I think till the stripping part code is working. I removed the code add_filter( 'comment_text', 'do_shortcode' ) so the embed code was displaying as raw in comment content. After adding the above code, the embed code disappeared from comment text. I am not sure how do I debug further. Can you advise?
    – luckyankit
    Apr 16, 2019 at 9:45
  • I checked the global shortcode_tags variable and apparently the []-brackets are part of the array key. I updated the answer to reflect that. You could echo the $tags_to_remove variable inside the last filter to see what exactly is parsed there and make sure what you return from the filter is formatted in the same way.
    – cjbj
    Apr 16, 2019 at 9:58
  • Brilliant :) That worked. [gallery] was correct although I didn't test it via echo. Also, can you please tell me if I had to allow another shortcode in the future, how do I add multiple shortcodes in the above code?
    – luckyankit
    Apr 16, 2019 at 10:16
  • Well, in the last filter you return an array, so you could add more shortcodes there
    – cjbj
    Apr 16, 2019 at 10:50
  • Like: return array ('[code1]'); return array ('[code2]'); This way?
    – luckyankit
    Apr 16, 2019 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.