sanitize_html_class( string $classname, string $fallback = '' ): string
- Since
- 2.8.0
- Source
wp-includes/formatting.php:2438
Description
Strips the string down to A-Z,a-z,0-9,_,-. If this results in an empty string then it will return the alternative value supplied.
Compatibility
- WordPress
- since 2.8.0
- PHP
- 7.4–8.6-dev
- 6.7.7
- 6.8.8
- 6.9.7
- 7.0.4
- 7.1.0
Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.
Parameters
$classnamestring- The classname to be sanitized.
$fallbackstringoptional- The value to return if the sanitization ends up as an empty string.
Default empty string.Default:''
Return value
string- The sanitized value.
Performance profile
How much work a call to sanitize_html_class() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.
- Cost class
- Trivial
- Scaling
- Constant
- Instructions
- 14–17
- Plugin surface
- 1 hook
- Called by
- 17
Touches nothing outside its own arguments.
No loop in the body: the same number of instructions runs whatever you pass in.
Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 21.
Third-party callbacks on 'sanitize_html_class' run inside this call, and their cost is not bounded by anything here.
17 places in core call this, so the cost is paid more often than your own code shows.
What it touches
- hookthird-party callbacks
apply_filters()called directly
What one call costs · 2 distinct outcomes
One number would be a lie: the work depends on which branch runs. These are every distinct cost sanitize_html_class() can have, taken from its control-flow graph on PHP 8.5.
| When | Instructions | Calls it makes |
|---|---|---|
$sanitized === "" | 14 | sanitize_html_class() |
| always | 16–17 | apply_filters() |
Across PHP versions
| PHP | Compiled | Executed | Branches | Notes |
|---|---|---|---|---|
| 8.6-dev | 21 | 14–17 | 2 | |
| 8.5 | 21 | 14–17 | 2 | |
| 8.4 | 21 | 14–17 | 2 | 7 fewer instructions than PHP 8.3 |
| 8.3 | 28 | 21–24 | 2 | |
| 8.2 | 28 | 21–24 | 2 | |
| 8.1 | 28 | 21–24 | 2 | |
| 7.4 | 28 | 21–24 | 2 |
An instruction is not a fixed amount of time, so a matching count is not necessarily the same speed; what it rules out is a difference in the work itself.
Hooks and filters fired · 1
One hook fires while sanitize_html_class() runs, in this order:
- apply_filters( sanitize_html_class )filterline 2457 (+19 into the body)
Filters a sanitized HTML class string.
Uses · 2
- sanitize_html_class()Sanitizes an HTML classname to ensure it only contains valid characters.
- apply_filters()Calls the callback functions that have been added to a filter hook.
Used by · 17
- WP_Media_List_Table::column_title()Handles the title column output.
- WP_Plugin_Install_List_Table::display_rows()Generates the list table rows.
- WP_Screen::add_help_tab()Adds a help tab to the contextual help for the screen.
- WP_Theme_JSON::remove_insecure_settings()Processes a setting node and returns the same node without the insecure settings.
- _WP_Editors::editor_settings()
- _navigation_markup()Wraps passed links in navigational markup.
- _wp_menu_output()Display menu.
- attachment_submitbox_metadata()Displays non-editable attachment metadata in the publish meta box.
- gallery_shortcode()Builds the Gallery shortcode output.
- get_body_class()Retrieves an array of the class names for the body element.
- get_comment_class()Returns the classes for the comment div as an array.
- get_post_class()Retrieves an array of the class names for the post container element.
Show all 17
- iframe_header()Generic Iframe header for use with Thickbox.
- img_caption_shortcode()Builds the Caption shortcode output.
- login_header()Outputs the login page header.
- sanitize_html_class()Sanitizes an HTML classname to ensure it only contains valid characters.
- wp_iframe()Outputs the iframe to display the media upload page.
Source code
function sanitize_html_class( $classname, $fallback = '' ) { // Strip out any percent-encoded characters. $sanitized = preg_replace( '|%[a-fA-F0-9][a-fA-F0-9]|', '', $classname ); // Limit to A-Z, a-z, 0-9, '_', '-'. $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $sanitized ); if ( '' === $sanitized && $fallback ) { return sanitize_html_class( $fallback ); } /** * Filters a sanitized HTML class string. * * @since 2.8.0 * * @param string $sanitized The sanitized HTML class. * @param string $classname HTML class before sanitization. * @param string $fallback The fallback string. */ return apply_filters( 'sanitize_html_class', $sanitized, $classname, $fallback );}Changelog
Introduced in 2.8.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
About this page
- Parsed data
- Generated from the wordpress-develop 7.1.0 tag, from
src/wp-includes/formatting.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it. - Corrections
- Something wrong on this page? Report it and it gets fixed in the next regeneration.