_wp_kses_sanitize_note_mention_classes( string $content ): string
- Since
- 7.1.0
- Source
wp-includes/kses.php:1196
span classes in comment content to the note mention tokens.Description
_wp_kses_allow_note_mention_span() lets class through kses on span so the mention chip survives, but class is an open-ended styling and scripting hook, so this companion pass - running right after wp_filter_kses at priority 10 - strips every class token except the two the mention markup uses: wp-note-mention and user-N. span is the only comment tag allowed to carry class at all, so walking span tags covers the entire allowance.
The pass only applies while the restrictive comment allowlist is active: users with unfiltered_html are filtered through wp_filter_post_kses (or not at all), where arbitrary classes are already permitted, and narrowing their markup here would restrict what core allows them to post.
Compatibility
- WordPress
- since 7.1.0
- PHP
- 7.4–8.6-dev
- 6.7.7
- 6.8.8
- 6.9.7
- 7.0.4
- 7.1.0
Present in 1 of the 5 tracked releases, added in 7.1.0, and compiles on PHP 7.4 through 8.6-dev.
Parameters
$contentstring- Slashed comment content, already filtered by kses.
Return value
string- Slashed comment content with span classes reduced.
Performance profile
How much work a call to _wp_kses_sanitize_note_mention_classes() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.
- Cost class
- Light
- Scaling
- Scales with input
- Instructions
- 10–29
- Plugin surface
- None
- Called by
- 0
Touches nothing outside its own arguments.
The body loops, so the work grows with what you pass in.
Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 43.
Nothing here hands control to plugin code.
Nothing in core calls this; the cost is only what you spend yourself.
What one call costs · 2 distinct outcomes
One number would be a lie: the work depends on which branch runs. These are every distinct cost _wp_kses_sanitize_note_mention_classes() can have, taken from its control-flow graph on PHP 8.5.
| When | Instructions | Calls it makes |
|---|---|---|
| always | 10–11 | has_filter() |
!->next_tag() | 28–29 | has_filter(), wp_unslash(), ->next_tag(), ->get_updated_html(), wp_slash() |
Across PHP versions
| PHP | Compiled | Executed | Branches | Notes |
|---|---|---|---|---|
| 8.6-dev | 43 | 10–29 | 7 | |
| 8.5 | 43 | 10–29 | 7 | |
| 8.4 | 43 | 10–29 | 7 | 3 fewer instructions than PHP 8.3 |
| 8.3 | 46 | 10–29 | 7 | |
| 8.2 | 46 | 10–29 | 7 | 1 fewer instruction than PHP 8.1 |
| 8.1 | 47 | 11–29 | 7 | |
| 7.4 | 47 | 11–29 | 7 |
An instruction is not a fixed amount of time, so a matching count is not necessarily the same speed; what it rules out is a difference in the work itself.
Uses · 4
- has_filter()Checks if any filter has been registered for a hook.
- wp_unslash()Removes slashes from a string or recursively removes slashes from strings within an array.
- wp_slash()Adds slashes to a string or recursively adds slashes to strings within an array.
- WP_HTML_Tag_Processor::__construct()Constructor.
Source code
function _wp_kses_sanitize_note_mention_classes( $content ): string { if ( ! is_string( $content ) ) { $content = ''; } if ( false === has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) { return $content; } $processor = new WP_HTML_Tag_Processor( wp_unslash( $content ) ); while ( $processor->next_tag( 'SPAN' ) ) { foreach ( $processor->class_list() as $token ) { if ( 'wp-note-mention' !== $token && ! preg_match( '/^user-[1-9][0-9]*$/', $token ) ) { // Removing the last class also removes the attribute itself. $processor->remove_class( $token ); } } } return wp_slash( $processor->get_updated_html() );}Changelog
Introduced in 7.1.0.
Signature, return type and hooks compared across 1 parsed release.
About this page
- Parsed data
- Generated from the wordpress-develop 7.1.0 tag, from
src/wp-includes/kses.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it. - Corrections
- Something wrong on this page? Report it and it gets fixed in the next regeneration.