So I just found this great WPSE thread about security for themes/plugins. It answered most of my questions but it was created before the new wp_editor() function was built.

I have two TinyMCE editors on my Theme Options and I'm wondering whether I need to use esc_html() or esc_textarea() in a validation callback before saving the theme option. It seems to me that TinyMCE takes care of a lot of that stuff (as well as the Settings API security that's taken care of), but there's still not a lot of documentation out there about wp_editor().

Any resources and answers appreciated.

2 Answers 2


esc_html() and esc_textarea() are, appropriate to their names, escaping functions and really meant for display rather than sanitizing or validating. I would use wp_kses() or wp_kses_post() (which is just wp_kses() with the global $allowedposttags) to sanitize input from a wp_editor() field before saving.

  • Thanks for your answer @helenhousandi. For you (or anyone else reading this), it seems that @bueltge's answer implies that TinyMCE is essentially doing what wp_kses() does already so it's not necessary. But I don't know the answer (hence the question in the first place), so I'm not the best judge of that.
    – mrwweb
    May 10, 2012 at 21:45
  • TinyMCE is capable of doing this, but does not by default. Also realize that a user could switch to using the area as a textarea (HTML mode) instead, so you always need to be sanitizing and validating data on the server side. May 11, 2012 at 1:30

The TinyMCE has an Filter for all allowed tags. You can change the tags, there are set in standard for your options and the editor filter the tags. Its not necassary, that you filter after save.

Example for enhanced tags:

function fb_change_mce_options( $initArray ) {
    // Comma separated string od extendes tags
    // Command separated string of extended elements
    $ext = 'pre[id|name|class|style],iframe[align|longdesc|name|width|height|frameborder|scrolling|marginheight|marginwidth|src]';
    if ( isset( $initArray['extended_valid_elements'] ) ) {
        $initArray['extended_valid_elements'] .= ',' . $ext;
    } else {
        $initArray['extended_valid_elements'] = $ext;
    // set tiny paramter verify_html
    $initArray['verify_html'] = true;
    return $initArray;
add_filter( 'tiny_mce_before_init', 'fb_change_mce_options' );

You can also filter the tags, all tags inside the array $initArray is allowed. Its easy to kill tags fromthe array. unset( $initArray['pre'] )

read the items inside the array via var_dump( $initArray );


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.