So I just found this great WPSE thread about security for themes/plugins. It answered most of my questions but it was created before the new wp_editor() function was built.

I have two TinyMCE editors on my Theme Options and I’m wondering whether I need to use esc_html() or esc_textarea() in a validation callback before saving the theme option. It seems to me that TinyMCE takes care of a lot of that stuff (as well as the Settings API security that’s taken care of), but there’s still not a lot of documentation out there about wp_editor().

Any resources and answers appreciated.

2 Answers
2

esc_html() and esc_textarea() are, appropriate to their names, escaping functions and really meant for display rather than sanitizing or validating. I would use wp_kses() or wp_kses_post() (which is just wp_kses() with the global $allowedposttags) to sanitize input from a wp_editor() field before saving.

Leave a Reply

Your email address will not be published. Required fields are marked *