2

I'm creating a template for comments on my WordPress site. I noticed that a simple <script>alert(1);</script> slips through the default WP codex implementation of comments, using the comment_text() function to display my comments. No bueno.

How can i properly sanitize and/or escape WordPress comments? The esc_html() function, seems to do nothing in this case.

2
  • 3
    Are you sure this isn't because you tested this as an administrator with the unfiltered_html capability?
    – Tom J Nowell
    Apr 19 at 23:11
  • @TomJNowell You are 100% right. I did not know, that this capability extended to comments as well, but I guess that this makes sense after all.
    – p01ntbr34k
    Apr 19 at 23:29
1

After thinking about this a little bit, I guess that the proper way to ensure that your comments are properly escaped, is by doing something like this:

$the_comment = get_comment_text();
echo '<p>' . esc_html($the_comment) . '</p>'; 

Instead of simply using the function like this:

comment_text();

Why even have these handy functions in the first place, if they aren't properly escaped? The comment_author(); function IS, yet this is not for some reason?

Perhaps I am missing something?

I was missing something: the unfiltered_html capability given to the admin role, extends to comments. Read more here: https://wordpress.org/support/article/roles-and-capabilities/#unfiltered_html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.