Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [wp-kses]

Function to filter (validate/sanitize) strings with a view to discharge all not allowed HTML elements.

0
votes
1answer
24 views

Wordpress post_content gets deleted in cron after wp_update_post

I'm developing a Wordpress plugin (integrated with WooCommerce) that fetches HTML Content from an API, and add it to a WP Post as post_content into an iframe, this way: kses_remove_filters(); $...
1
vote
1answer
141 views

Escaping SVG with KSES

I'm trying to output an SVG file in a template, and PHPCS is telling me I need to escape the output. So I tried with KSES and it doesn't seem to want to include the viewbox attribute. $allowed_html =...
0
votes
1answer
82 views

Inline style HTML attribute is being stripped from all elements of a post

I am attempting to publish HTML generated from an external party within Wordpress, but I am getting very inconsistent results with style attribute on all HTML elements, in that if I programmatically ...
1
vote
1answer
68 views

HTML Entities displaying improperly as malformed escaped code

I'm having a strange issue that I've never seen before. I moved a WordPress site from Siteground over to GoDaddy a few days ago, and now the site appears to have problems displaying HTML entities in ...
0
votes
1answer
393 views

Change allowed HTML tags for comments

I've set up a HTML editor for WordPress comments, and I want to change the allowed HTML tags for comments accordingly. Some of the HTML tags also have inline styling, or classes added. I only want to ...
0
votes
1answer
439 views

Allow iframes from specific sites?

With kses filtering, WordPress only allows a subset of html tags within a post or page, and one of the tags it strips out is the <iframe> tag (for many good reasons). I'd like to allow ...
0
votes
2answers
1k views

wp_kses() strips data attributes even if it's in the allowed list

I added a function that will return the allowed html tags array if ( ! function_exists( 'allowed_html_tags' ) ) { /** * Allowed html tags for wp_kses() function * * @return array Array of ...
1
vote
1answer
37 views

Why is WordPress Breaking Custom Elements with Hyphens Into Element and Attribute?

Background I have a custom element in a page, which has a tagname of: column-set. On the front end, that gets written as <column -set="">. Question Why is this happening, and can it be ...
1
vote
0answers
25 views

I want to allow the use of a data-flw attribute in links in comments

I have come up with two ways I thought this should work and I'm having no joy with either. First I tried hooking into the preprocess_comment filter. // Set allowed html in comments. add_filter( '...
0
votes
1answer
212 views

wp_kses allow checkbox class and checked

I'm having a hard time getting wp_kses to allow the class for an input. These approaches didn't work: input' => array( 'type' => true, 'class' => true, 'name' => true, '...
1
vote
2answers
1k views

Quotes being escaped inside wp_editor when saved with wp_kses_post

Hi have a setting screen where I allow users to create HTML emails with the convenience of the editor they are already used to from posts and pages using wp_editor(); Everything seems to work fine ...
1
vote
1answer
64 views

Proper use of internationalization

Regarding internationalization which of the two would be the proper correct way to process the translation. echo '<p>' . esc_html__( 'Lorem ipsum dolor sit amet, consectetur adipisicing', '...
4
votes
1answer
271 views

how to escape wp_oembed_get for phpcs

I am using phpcs to help with making sure I write nice, valid WP theme code but am coming across the following issue regarding escaping before output. If I try to use echo wp_oembed_get( 'https://www....
1
vote
0answers
243 views

Add Attribute to p Tag of Post Content

I would like the default <p> elements that are added to the (TinyMCE) editor when users post content, to have a dir attribute as well. Reasoning: When the editor is displayed to users, it is ...
6
votes
1answer
773 views

What to use instead of wp_kses() in user output

I need some help here. While developing a theme, I want to make sure there are no security issues. So all dynamic data must be correctly escaped for the context where it is rendered. I know how to ...
9
votes
1answer
459 views

How to get SimplePie fetch_feed without stripping iframe code?

I'm grabbing a remote feed in my plugin and some entries have iframe code I want to keep. However, SimplePie fetch_feed keeps stripping it out. Here is my code and what I've tried already: ...
4
votes
1answer
2k views

Why is wp_kses not keeping style attributes as expected?

I want to keep the style attribute. $str is just an example, here's my code: $allowed_html = array( 'div' => array( 'title' => array(), 'class' => array(), '...
2
votes
3answers
3k views

wp_kses_post only removes <script> tags, but not their content

Is there any way to remove the <script> tags including their contents? wp_kses_post seems to only remove the tags, while their content remains visible on the page. Thank you
1
vote
0answers
173 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
1
vote
1answer
865 views

wp_kses ignore allowed and allow everything

Here is an example: $allowedPart = "<a href='http://alink.com'></a>"; $unsafePart = "<h1>A title</h1>"; $unsafePart .= "<script>alert('a script!!!');</script>";...
5
votes
1answer
818 views

wp_kses vs wp_strip_all_tags

Apart from providing a granular control for allowed HTML tags does wp_kses provide any additional benefits over wp_strip_all_tags? Essentially, if I were to use wp_kses and set it to not allow any ...
0
votes
1answer
291 views

Any ideas how to allow CSS input to perfectly work in the text area with wp_kses?

I'm having issues with wp_kses. I have a text area that allows CSS input (only) While the rest of the CSS gets through (don't have any issues ever since). Until one user , inputs a CSS Code like this ...
2
votes
1answer
518 views

Remove tags from the kses filter

I know one can modify the kses filter to add new allowed tags to it, but is there a way to remove some of them? I can't find how. I need to disallow DIV tags. Any ideas? Thanks
0
votes
1answer
299 views

Add Protocol to Custom Menus

I've been using tel: links in Custom Menus combined with Responsive Design to add a "Call Now" button to my themes for smartphones. It's been working well. A client just asked me to also add a "Send ...
0
votes
1answer
369 views

wp_filter_kses allow HTML5 video?

Is there a way to allow my users to add HTML5 video tag (without shortcodes) into my textfield/textarea? Allowed anchor styles and bold tags are working, but as soon I add 'video' and 'source' it ...
1
vote
1answer
305 views

wp_kses and magic quotes

In the wp_kses codex page it says: You have to remove any slashes from PHP's magic quotes before you call this function. I am new(ish) to PHP and I wiki'd Magic Quotes and it was apparently ...
4
votes
1answer
302 views

Allowing more elements in comments via functions.php

I would like to allow certain HTML elements in my comments and have edited kses.php directly in the past. However, I have been hacked recently and replaced all the core Wordpress files and feel I ...
0
votes
1answer
93 views

Why is `--` converted into ndash and how can I get rid of it?

I have a blog where I publish Linux tutorials. Some of the commands I listed have a -- before command-line arguments. e.g.: dpkg --get-selections. The problem is that WordPress automatically switches ...
1
vote
0answers
162 views

Only allow site url in text field using wp_kses/wp_filter_nohtml_kses?

I'm working on validation for a theme options page. Is there a built in way to add an argument to wp_kses/wp_filter_nohtml_kses that will allow a specific link to be entered(wrapped in a tags) but ...
1
vote
1answer
109 views

Make WordPress process admin group comments using $allowedtags

WP uses $allowedtags to limit the set of allowable tags for comments.However, comments from administrators are unfiltered. What's the easiest way to ensure admin comments are also constrained to the ...
3
votes
2answers
2k views

WP Editor strips input placeholder attribute

Why WP Editor also strips the "placeholder" attribute of the input text element ? Ofcourse, i am using the HTML mode. Here is the input: <input type="text" value="" name="s" style="width: 550px;" ...
3
votes
1answer
1k views

What is the difference between strip_tags and wp_filter_nohtml_kses?

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
0
votes
2answers
1k views

sanitize vimeo embed code?

I have a custom meta box with a textarea where users can drop in vimeo embed code. Should I sanitize this code before I update_post_meta, and, if so, how should I go about it? I don't want to strip ...
7
votes
6answers
9k views

Typical wp_kses $allowed

I have a custom post textbox that I want to sanitize using wp_kses before I update my post meta. I was looking for examples of common $allowed settings, but I have only seen this example: $allowed = ...