Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [wp-kses]

Function to filter (validate/sanitize) strings with a view to discharge all not allowed HTML elements.

0
votes
0answers
17 views

Remove all <span> elements and style attributes from HTML

I'm retrieving some HTML (regulatory press releases) from an external source via an API. This HTML will be inserted as custom posts into the WordPress database. Naturally, I want to sanitize the ...
0
votes
1answer
25 views

Wordpress post_content gets deleted in cron after wp_update_post

I'm developing a Wordpress plugin (integrated with WooCommerce) that fetches HTML Content from an API, and add it to a WP Post as post_content into an iframe, this way: kses_remove_filters(); $...
1
vote
1answer
217 views

Escaping SVG with KSES

I'm trying to output an SVG file in a template, and PHPCS is telling me I need to escape the output. So I tried with KSES and it doesn't seem to want to include the viewbox attribute. $allowed_html =...
0
votes
1answer
161 views

Inline style HTML attribute is being stripped from all elements of a post

I am attempting to publish HTML generated from an external party within Wordpress, but I am getting very inconsistent results with style attribute on all HTML elements, in that if I programmatically ...
1
vote
1answer
104 views

HTML Entities displaying improperly as malformed escaped code

I'm having a strange issue that I've never seen before. I moved a WordPress site from Siteground over to GoDaddy a few days ago, and now the site appears to have problems displaying HTML entities in ...
0
votes
1answer
419 views

Change allowed HTML tags for comments

I've set up a HTML editor for WordPress comments, and I want to change the allowed HTML tags for comments accordingly. Some of the HTML tags also have inline styling, or classes added. I only want to ...
0
votes
1answer
486 views

Allow iframes from specific sites?

With kses filtering, WordPress only allows a subset of html tags within a post or page, and one of the tags it strips out is the <iframe> tag (for many good reasons). I'd like to allow ...
0
votes
2answers
1k views

wp_kses() strips data attributes even if it's in the allowed list

I added a function that will return the allowed html tags array if ( ! function_exists( 'allowed_html_tags' ) ) { /** * Allowed html tags for wp_kses() function * * @return array Array of ...
1
vote
1answer
37 views

Why is WordPress Breaking Custom Elements with Hyphens Into Element and Attribute?

Background I have a custom element in a page, which has a tagname of: column-set. On the front end, that gets written as <column -set="">. Question Why is this happening, and can it be ...
1
vote
0answers
25 views

I want to allow the use of a data-flw attribute in links in comments

I have come up with two ways I thought this should work and I'm having no joy with either. First I tried hooking into the preprocess_comment filter. // Set allowed html in comments. add_filter( '...
0
votes
1answer
238 views

wp_kses allow checkbox class and checked

I'm having a hard time getting wp_kses to allow the class for an input. These approaches didn't work: input' => array( 'type' => true, 'class' => true, 'name' => true, '...
1
vote
2answers
2k views

Quotes being escaped inside wp_editor when saved with wp_kses_post

Hi have a setting screen where I allow users to create HTML emails with the convenience of the editor they are already used to from posts and pages using wp_editor(); Everything seems to work fine ...
1
vote
1answer
68 views

Proper use of internationalization

Regarding internationalization which of the two would be the proper correct way to process the translation. echo '<p>' . esc_html__( 'Lorem ipsum dolor sit amet, consectetur adipisicing', '...
4
votes
1answer
293 views

how to escape wp_oembed_get for phpcs

I am using phpcs to help with making sure I write nice, valid WP theme code but am coming across the following issue regarding escaping before output. If I try to use echo wp_oembed_get( 'https://www....
1
vote
0answers
249 views

Add Attribute to p Tag of Post Content

I would like the default <p> elements that are added to the (TinyMCE) editor when users post content, to have a dir attribute as well. Reasoning: When the editor is displayed to users, it is ...
6
votes
1answer
799 views

What to use instead of wp_kses() in user output

I need some help here. While developing a theme, I want to make sure there are no security issues. So all dynamic data must be correctly escaped for the context where it is rendered. I know how to ...
9
votes
1answer
471 views

How to get SimplePie fetch_feed without stripping iframe code?

I'm grabbing a remote feed in my plugin and some entries have iframe code I want to keep. However, SimplePie fetch_feed keeps stripping it out. Here is my code and what I've tried already: ...
4
votes
1answer
2k views

Why is wp_kses not keeping style attributes as expected?

I want to keep the style attribute. $str is just an example, here's my code: $allowed_html = array( 'div' => array( 'title' => array(), 'class' => array(), '...
2
votes
4answers
3k views

wp_kses_post only removes <script> tags, but not their content

Is there any way to remove the <script> tags including their contents? wp_kses_post seems to only remove the tags, while their content remains visible on the page. Thank you
2
votes
0answers
179 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
1
vote
1answer
891 views

wp_kses ignore allowed and allow everything

Here is an example: $allowedPart = "<a href='http://alink.com'></a>"; $unsafePart = "<h1>A title</h1>"; $unsafePart .= "<script>alert('a script!!!');</script>";...
5
votes
1answer
873 views

wp_kses vs wp_strip_all_tags

Apart from providing a granular control for allowed HTML tags does wp_kses provide any additional benefits over wp_strip_all_tags? Essentially, if I were to use wp_kses and set it to not allow any ...
0
votes
1answer
292 views

Any ideas how to allow CSS input to perfectly work in the text area with wp_kses?

I'm having issues with wp_kses. I have a text area that allows CSS input (only) While the rest of the CSS gets through (don't have any issues ever since). Until one user , inputs a CSS Code like this ...
2
votes
1answer
552 views

Remove tags from the kses filter

I know one can modify the kses filter to add new allowed tags to it, but is there a way to remove some of them? I can't find how. I need to disallow DIV tags. Any ideas? Thanks
0
votes
1answer
306 views

Add Protocol to Custom Menus

I've been using tel: links in Custom Menus combined with Responsive Design to add a "Call Now" button to my themes for smartphones. It's been working well. A client just asked me to also add a "Send ...
0
votes
1answer
388 views

wp_filter_kses allow HTML5 video?

Is there a way to allow my users to add HTML5 video tag (without shortcodes) into my textfield/textarea? Allowed anchor styles and bold tags are working, but as soon I add 'video' and 'source' it ...
1
vote
1answer
321 views

wp_kses and magic quotes

In the wp_kses codex page it says: You have to remove any slashes from PHP's magic quotes before you call this function. I am new(ish) to PHP and I wiki'd Magic Quotes and it was apparently ...
4
votes
1answer
305 views

Allowing more elements in comments via functions.php

I would like to allow certain HTML elements in my comments and have edited kses.php directly in the past. However, I have been hacked recently and replaced all the core Wordpress files and feel I ...
0
votes
1answer
93 views

Why is `--` converted into ndash and how can I get rid of it?

I have a blog where I publish Linux tutorials. Some of the commands I listed have a -- before command-line arguments. e.g.: dpkg --get-selections. The problem is that WordPress automatically switches ...
1
vote
0answers
166 views

Only allow site url in text field using wp_kses/wp_filter_nohtml_kses?

I'm working on validation for a theme options page. Is there a built in way to add an argument to wp_kses/wp_filter_nohtml_kses that will allow a specific link to be entered(wrapped in a tags) but ...
1
vote
1answer
110 views

Make WordPress process admin group comments using $allowedtags

WP uses $allowedtags to limit the set of allowable tags for comments.However, comments from administrators are unfiltered. What's the easiest way to ensure admin comments are also constrained to the ...
3
votes
2answers
2k views

WP Editor strips input placeholder attribute

Why WP Editor also strips the "placeholder" attribute of the input text element ? Ofcourse, i am using the HTML mode. Here is the input: <input type="text" value="" name="s" style="width: 550px;" ...
3
votes
1answer
1k views

What is the difference between strip_tags and wp_filter_nohtml_kses?

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
0
votes
2answers
1k views

sanitize vimeo embed code?

I have a custom meta box with a textarea where users can drop in vimeo embed code. Should I sanitize this code before I update_post_meta, and, if so, how should I go about it? I don't want to strip ...
8
votes
6answers
9k views

Typical wp_kses $allowed

I have a custom post textbox that I want to sanitize using wp_kses before I update my post meta. I was looking for examples of common $allowed settings, but I have only seen this example: $allowed = ...