4

I have a form that allows any registered user to submit a post (it's a custom post type - forum related), and I'm using wp_insert_post() to insert it into the db.

From what I've seen in this function a sanitize_post() function is run automatically, but I think this only handles db escaping and such.

So how do I sanitize the input data the same way as the wp-admin editor does? I mean apply the kses filter and all the other stuff...

||improve this question
4

When a post is created/edited from the admin, edit_post() is called.

This function simply collects all the $_POST arguments and passes them to wp_update_post().

wp_update_post() then does some more logical checks and passes the data along to wp_insert_post().

wp_insert_post() calls sanitize_post(), which does all the heavy duty sanitization.

So, yes, wp_insert_post() is the correct way to do it.

||improve this answer
  • but I still can submit any type of HTML, like <script> etc. so wp_filter_kses() is not applied to the post_content from wp_insert_post() ? In the admin it seems it is. – onetrickpony Feb 16 '11 at 18:09
  • First, make sure the user you're logged-in as does not have the 'unfiltered_html' capability. – scribu Feb 16 '11 at 22:05
  • can editors post unfiltered html? – onetrickpony Feb 17 '11 at 3:27
  • You can find out with a plugin, such as Capability Manager – scribu Feb 17 '11 at 14:32
2

Otto did a blog about using kses last year, see if that helps.
http://ottopress.com/2010/wp-quickie-kses/

||improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.