I am trying to write a short plugin that will filter html characters from the search form. In the event someone enters in <script>alert('some infectious js!');</script> into the search form i want to remove the possibility of this command to be entered into the search form.

I tried this:

function SearchFilter( $query ) {
     if ( is_search() ) {
          $query = strip_tags($query);
 add_action ('pre_get_posts', 'SearchFilter');

When I go to test it, i enter <script>alert('some infectious js!');</script> above into the search field and all I get is a blank white page in wordpress. The search still works but anytime i type in script it breaks the box. This seems odd that wordpress doesn't handle this by default OR am i totally wrong on this?

Thanks in advance.

1 Answer 1


WP does handle that case already, the script will never be executed, because the function the_search_query() will return its output escaped.

Escaping this prior to the actual search would break searching in code. If you blog about script injections your visitors should be able to search for that.


Here is one of my older plugins. It enables searching in escaped code and breaks the search for unescaped <, & or >. Unfortunately, it has some side effects when it is used together with search plugins like Relevanssi or Search Unleashed.

<?php # -*- coding: utf-8 -*-
 * Plugin Name: T5 Search escaped characters
 * Description: Enable to search for escaped &lt;, &gt; and &amp;.
 * Plugin URI:
 * Version:     2012.08.25
 * Author:      Thomas Scholz
 * Author URI:  http://toscho.de
 * License:     MIT
 * License URI: http://www.opensource.org/licenses/mit-license.php

add_filter( 'posts_search', 't5_search_escaped_characters', 10, 2 );

function t5_search_escaped_characters( $search, $obj = NULL )
    if ( $obj->is_search and empty ( $search ) and is_main_query() )
        remove_filter( current_filter(), __FUNCTION__ );
        return ' AND 1 = 2 ';
    $s   = $obj->query_vars['s'];
    // Double-encoding FALSE in case another plugin did that already.
    $esc = htmlspecialchars( $s, ENT_NOQUOTES, 'utf-8', FALSE );
    return str_replace( "%$s%", "%$esc%", $search ) . ' ';

Might be a start if you want to touch the search string early enough.

  • thanks for the reply. We had a security scan from a 3rd party source done on our website and the results indicate that the scrip injection is actually reaching the database. Perhaps this is also a false positive. I don't see the js execute, but it does return a page with all of our blog posts listed on it, which I thought was odd. I'd rather it be completely denied and show a 404 page or an error page. Anyway to get it to do that in this case?
    – Robbiegod
    Oct 14, 2012 at 14:17
  • oh yeah, also there is no reason why someone on my website would want or need to search for script injections so i would rather just prevent those words altogether. If Wordpress already has this type of defense then its probably a false positive we are getting from the results of our security scan.
    – Robbiegod
    Oct 14, 2012 at 18:09
  • interesting...I will take a look at that...that might do the trick.
    – Robbiegod
    Oct 15, 2012 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.