I’m working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses function (external urls, etc.) but it would be great if user will be able to insert internal link to another publication and … Read more
In my Custom Post Type (CPT), I altered the display of the post title using the method mentioned here. But for my custom use case, I need to pass some HTML like <sup></sup>. But by default WP List Table class is designed to suppress any HTML tags using wp_strip_all_tags(). But I can see there might … Read more
I know one can modify the kses filter to add new allowed tags to it, but is there a way to remove some of them? I can’t find how. I need to disallow DIV tags. Any ideas? Thanks 1 Answer 1 The allowed tags are stored in $allowedposttags (located in /wp-includes/kses.php) as an array. For … Read more
When I paste a table into the WordPress editor, I always get widths like <td width=”232″>. I want to remove all widths when tables are added to the editor. If it was regex, I would write something like: width=”([0-9]+)”. How do I go about accomplishing this? 1 Answer 1 I would approach this by modifying … Read more
I added a function that will return the allowed html tags array if ( ! function_exists( ‘allowed_html_tags’ ) ) { /** * Allowed html tags for wp_kses() function * * @return array Array of allowed html tags. */ function allowed_html_tags() { return array( ‘a’ => array( ‘href’ => array(), ‘title’ => array(), ‘class’ => array(), … Read more
Why WP Editor also strips the “placeholder” attribute of the input text element ? Ofcourse, i am using the HTML mode. Here is the input: <input type=”text” value=”” name=”s” style=”width: 550px;” placeholder=”Search this website..”> After updating the post (after strip): <input type=”text” value=”” name=”s” style=”width: 550px;”> I do not want WP Editor to strip such … Read more
I’m inserting a post using wp_post_insert(). And my post’s content looks like this: <img src=”data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAN4AAAB6CA { … } but on the insert process, WordPress removes the data attribute. So above code becomes this: <img src=”image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAN4AAAB6CA { … } I’ve tried something like this but no luck: function my_filter_allowed_html($allowed, $context){ if (is_array($context)) { return … Read more
What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html even though thats what the codex says. I think the kses functions are expensive so I wonder why not use strip_tags if all it … Read more
I would like to allow certain HTML elements in my comments and have edited kses.php directly in the past. However, I have been hacked recently and replaced all the core WordPress files and feel I would like to avoid editing those files. Is it possible to allow more elements via the functions.php file? 1 Answer … Read more
Is there any way to remove the <script> tags including their contents? wp_kses_post seems to only remove the tags, while their content remains visible on the page. Thank you 5 Answers 5 KSES is designed to prevent execution of undesired and potentially dangerous tags, not preventing display of the innerHTML. Blocking the content would require … Read more
