I have a Theme Options page where the user can add certain options like Facebook links, etc. One of the options is for some ad code and when saving it as an option it gets escaped over and over again.

What's the best approach for saving code inserted in an admin page <textarea> using update_option( 'sidebar_code', $_POST['sidebar_code'] ); ?


but you should know that the kses filter is not 100% safe.

  • 2
    what do you mean by not 100% safe? – Amit Jan 13 '11 at 22:09
  • I mean someone could still XSS your site if they are really good at it. If I'm not mistaken the last wp patch fixed a xss vulnerability in the kses functions – onetrickpony Jan 14 '11 at 0:29
  • kses strips out all of the extra class and html attributes (e.g. class="classname" width="100") is there any way to get around that? – Talon Oct 17 '12 at 22:07

I took another approach to this. I encoded and decoded my options with HTML entities. One thing I'm not sure of is whether this opens up a nasty back door for folks to drive compromising HTML through. I am relying on the fact that only admins will be editing theme options anyway, but maybe I'm being naive?

Here is what it looks like when I save an option:

update_option('my_option', htmlentities(stripslashes($_REQUEST['my_option'])));

And this is what it looks like when I retrieve an option:


This isn't a complete answer to your question, but possibly pointing you in the right direction: You could try <?php esc_textarea( $text ) ?>, as detailed by the codex here: http://codex.wordpress.org/Function_Reference/esc_textarea.

My own metabox textarea snippets look like this:

  if ( $meta_box['type'] == "textarea" ) {
    $meta_box_value = esc_textarea( get_post_meta($post->ID, $meta_box['name'].'_value', true) );
    echo '<textarea class="meta-textarea" style="width: 100%;" cols="20" rows="2" name="' . $meta_box['name'] . '_value">' . $meta_box_value . '</textarea><br />';
  • Depends on what you are doing. esc_textarea will convert any html to HTML entities codes, so you can't use it with a richtext area like tinyMCE. – Jake Jul 16 '12 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.