API Documentation » External

Functions

Regex callback for wp_kses_decode_entities()

_wp_kses_decode_entities_chr(array $match) : string

package	External

Parameters

$match

array

preg match

Returns

string

Regex callback for wp_kses_decode_entities()

_wp_kses_decode_entities_chr_hexdec(array $match) : string

package	External

Parameters

$match

array

preg match

Returns

string

Callback for wp_kses_split.

_wp_kses_split_callback($match)

package	External
since	3.1.0
access	private

Parameters

$match

Inline CSS filter

safecss_filter_attr($css, $deprecated = '')

package	External
since	2.8.1

Parameters

$css

$deprecated

Helper function to determine if a Unicode value is valid.

valid_unicode(integer $i) : boolean

package	External

Parameters

$i

integer

Unicode value

Returns

booleantrue if the value was a valid Unicode number

Sanitize content with allowed HTML Kses rules.

wp_filter_kses(string $data) : string

package	External
since	1.0.0
uses

Parameters

$data

string

Content to filter, expected to be escaped with slashes

Returns

stringFiltered content

Strips all of the HTML in the content.

wp_filter_nohtml_kses(string $data) : string

package	External
since	2.1.0

Parameters

$data

string

Content to strip all HTML from

Returns

stringFiltered content without any HTML

Sanitize content for allowed HTML tags for post content.

wp_filter_post_kses(string $data) : string

Post content refers to the page contents of the 'post' type and not $_POST data from forms.

package	External
since	2.0.0
uses

Parameters

$data

string

Post content to filter, expected to be escaped with slashes

Returns

stringFiltered post content with allowed HTML tags and attributes intact.

Filters content and keeps only allowable HTML elements.

wp_kses(string $string, array $allowed_html, array $allowed_protocols = array()) : string

This function makes sure that only the allowed HTML element names, attribute names and attribute values plus only sane HTML entities will occur in $string. You have to remove any slashes from PHP's magic quotes before you call this function.

The default allowed protocols are 'http', 'https', 'ftp', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet, 'mms', 'rtsp' and 'svn'. This covers all common link protocols, except for 'javascript' which should not be allowed for untrusted users.

package	External
since	1.0.0

Parameters

$string

string

Content to filter through kses

$allowed_html

array

List of allowed HTML elements

$allowed_protocols

array

Optional. Allowed protocol in links.

Returns

stringFiltered content with only allowed HTML elements

Goes through an array and changes the keys to all lower case.

wp_kses_array_lc(array $inarray) : array

package	External
since	1.0.0

Parameters

$inarray

array

Unfiltered array

Returns

arrayFixed array with all lowercase keys

Removes all attributes, if none are allowed for this element.

wp_kses_attr(string $element, string $attr, array $allowed_html, array $allowed_protocols) : string

If some are allowed it calls wp_kses_hair() to split them further, and then it builds up new HTML code from the data that kses_hair() returns. It also removes "<" and ">" characters, if there are any left. One more thing it does is to check if the tag has a closing XHTML slash, and if it does, it puts one in the returned code as well.

package	External
since	1.0.0

Parameters

$element

string

HTML element/tag

$attr

string

HTML attributes from HTML element to closing HTML element tag

$allowed_html

array

Allowed HTML elements

$allowed_protocols

array

Allowed protocols to keep

Returns

stringSanitized HTML element

Sanitize string from bad protocols.

wp_kses_bad_protocol(string $string, array $allowed_protocols) : string

This function removes all non-allowed protocols from the beginning of $string. It ignores whitespace and the case of the letters, and it does understand HTML entities. It does its work in a while loop, so it won't be fooled by a string like "javascript:javascript:alert(57)".

package	External
since	1.0.0

Parameters

$string

string

Content to filter bad protocols from

$allowed_protocols

array

Allowed protocols to keep

Returns

stringFiltered content

Sanitizes content from bad protocols and other characters.

wp_kses_bad_protocol_once(string $string, string $allowed_protocols) : string

This function searches for URL protocols at the beginning of $string, while handling whitespace and HTML entities.

package	External
since	1.0.0

Parameters

$string

string

Content to check for bad protocols

$allowed_protocols

string

Allowed protocols

Returns

stringSanitized content

Callback for wp_kses_bad_protocol_once() regular expression.

wp_kses_bad_protocol_once2(string $string, string $allowed_protocols) : string

This function processes URL protocols, checks to see if they're in the white-list or not, and returns different data depending on the answer.

package	External
access	private
since	1.0.0

Parameters

$string

string

URI scheme to check against the whitelist

$allowed_protocols

string

Allowed protocols

Returns

stringSanitized content

Performs different checks for attribute values.

wp_kses_check_attr_val(string $value, string $vless, string $checkname, mixed $checkvalue) : boolean

The currently implemented checks are "maxlen", "minlen", "maxval", "minval" and "valueless" with even more checks to come soon.

package	External
since	1.0.0

Parameters

$value

string

Attribute value

$vless

string

Whether the value is valueless. Use 'y' or 'n'

$checkname

string

What $checkvalue is checking for.

$checkvalue

mixed

What constraint the value should pass

Returns

booleanWhether check passes

Sanitize content with allowed HTML Kses rules.

wp_kses_data(string $data) : string

package	External
since	2.9.0
uses

Parameters

$data

string

Content to filter, expected to not be escaped

Returns

stringFiltered content

Convert all entities to their character counterparts.

wp_kses_decode_entities(string $string) : string

This function decodes numeric HTML entities (A and A). It doesn't do anything with other entities like ä, but we don't need them in the URL protocol whitelisting system anyway.

package	External
since	1.0.0

Parameters

$string

string

Content to change entities

Returns

stringContent after decoded entities

Builds an attribute list from string containing attributes.

wp_kses_hair(string $attr, array $allowed_protocols) : array

This function does a lot of work. It parses an attribute list into an array with attribute data, and tries to do the right thing even if it gets weird input. It will add quotes around attribute values that don't have any quotes or apostrophes around them, to make it easier to produce HTML code that will conform to W3C's HTML specification. It will also remove bad URL protocols from attribute values. It also reduces duplicate attributes by using the attribute defined first (foo='bar' foo='baz' will result in foo='bar').

package	External
since	1.0.0

Parameters

$attr

string

Attribute list from HTML element to closing HTML element tag

$allowed_protocols

array

Allowed protocols to keep

Returns

arrayList of attributes after parsing

You add any kses hooks here.

wp_kses_hook(string $string, array $allowed_html, array $allowed_protocols) : string

There is currently only one kses WordPress hook and it is called here. All parameters are passed to the hooks and expected to recieve a string.

package	External
since	1.0.0

Parameters

$string

string

Content to filter through kses

$allowed_html

array

List of allowed HTML elements

$allowed_protocols

array

Allowed protocol in links

Returns

stringFiltered content through 'pre_kses' hook

Handles parsing errors in wp_kses_hair().

wp_kses_html_error(string $string) : string

The general plan is to remove everything to and including some whitespace, but it deals with quotes and apostrophes as well.

package	External
since	1.0.0

Parameters

$string

string

Returns

string

Removes the HTML JavaScript entities found in early versions of Netscape 4.

wp_kses_js_entities(string $string) : string

package	External
since	1.0.0

Parameters

$string

string

Returns

string

Callback for wp_kses_normalize_entities() regular expression.

wp_kses_named_entities(array $matches) : string

This function only accepts valid named entity references, which are finite, case-sensitive, and highly scrutinized by HTML and XML validators.

package	External
since	3.0.0

Parameters

$matches

array

preg_replace_callback() matches array

Returns

stringCorrectly encoded entity

Removes any NULL characters in $string.

wp_kses_no_null(string $string) : string

package	External
since	1.0.0

Parameters

$string

string

Returns

string

Converts and fixes HTML entities.

wp_kses_normalize_entities(string $string) : string

This function normalizes HTML entities. It will convert "AT&T" to the correct "AT&T", ":" to ":", "&#XYZZY;" to "&#XYZZY;" and so on.

package	External
since	1.0.0

Parameters

$string

string

Content to normalize entities

Returns

stringContent with normalized entities

Callback for wp_kses_normalize_entities() regular expression.

wp_kses_normalize_entities2(array $matches) : string

This function helps wp_kses_normalize_entities() to only accept 16 bit values and nothing more for &#number; entities.

package	External
access	private
since	1.0.0

Parameters

$matches

array

preg_replace_callback() matches array

Returns

stringCorrectly encoded entity

Callback for wp_kses_normalize_entities() for regular expression.

wp_kses_normalize_entities3(array $matches) : string

This function helps wp_kses_normalize_entities() to only accept valid Unicode numeric entities in hex form.

package	External
access	private

Parameters

$matches

array

preg_replace_callback() matches array

Returns

stringCorrectly encoded entity

Sanitize content for allowed HTML tags for post content.

wp_kses_post(string $data) : string

Post content refers to the page contents of the 'post' type and not $_POST data from forms.

package	External
since	2.9.0
uses

Parameters

$data

string

Post content to filter

Returns

stringFiltered post content with allowed HTML tags and attributes intact.

Searches for HTML tags, no matter how malformed.

wp_kses_split(string $string, array $allowed_html, array $allowed_protocols) : string

It also matches stray ">" characters.

package	External
since	1.0.0

Parameters

$string

string

Content to filter

$allowed_html

array

Allowed HTML elements

$allowed_protocols

array

Allowed protocols to keep

Returns

stringContent with fixed HTML tags

Callback for wp_kses_split for fixing malformed HTML tags.

wp_kses_split2(string $string, array $allowed_html, array $allowed_protocols) : string

This function does a lot of work. It rejects some very malformed things like

<:::>. It returns an empty string, if the element isn't allowed (look ma, no strip_tags()!). Otherwise it splits the tag into an element and an attribute list. After the tag is split into an element and an attribute list, it is run through another filter which will remove illegal attributes and once that is completed, will be returned.

package	External
access	private
since	1.0.0
uses

Parameters

$string

string

Content to filter

$allowed_html

array

Allowed HTML elements

$allowed_protocols

array

Allowed protocols to keep

Returns

stringFixed HTML element

Strips slashes from in front of quotes.

wp_kses_stripslashes(string $string) : string

This function changes the character sequence \" to just ". It leaves all other slashes alone. It's really weird, but the quoting from preg_replace(//e) seems to require this.

package	External
since	1.0.0

Parameters

$string

string

String to strip slashes

Returns

stringFixed strings with quoted slashes

This function returns kses' version number.

wp_kses_version() : string

package	External
since	1.0.0

Returns

stringKSES Version Number

Constants

BP_CUSTOM_TAGS

BP_CUSTOM_TAGS = false

package	External