sanitize_html_class( string $classname, string $fallback = '' ): string
- Since
- 2.8.0
- Source
wp-includes/formatting.php:2434
Sanitizes an HTML classname to ensure it only contains valid characters.
Description
Strips the string down to A-Z,a-z,0-9,_,-. If this results in an empty string then it will return the alternative value supplied.
Parameters
$classnamestring- The classname to be sanitized.
$fallbackstringoptional- The value to return if the sanitization ends up as an empty string. Default empty string.Default:
''
Return
string- The sanitized value.
Hooks fired · 1
One hook fires while sanitize_html_class() runs, in this order:
- apply_filters( sanitize_html_class )filterline 2453 (+19 into the body)
Filters a sanitized HTML class string.
Uses · 2
- sanitize_html_class()Sanitizes an HTML classname to ensure it only contains valid characters.
- apply_filters()Calls the callback functions that have been added to a filter hook.
Used by · 16
- WP_Media_List_Table::column_title()Handles the title column output.
- WP_Plugin_Install_List_Table::display_rows()Generates the list table rows.
- WP_Screen::add_help_tab()Adds a help tab to the contextual help for the screen.
- WP_Theme_JSON::remove_insecure_settings()Processes a setting node and returns the same node without the insecure settings.
- _WP_Editors::editor_settings()
- _navigation_markup()Wraps passed links in navigational markup.
- _wp_menu_output()Display menu.
- attachment_submitbox_metadata()Displays non-editable attachment metadata in the publish meta box.
- gallery_shortcode()Builds the Gallery shortcode output.
- get_body_class()Retrieves an array of the class names for the body element.
- get_comment_class()Returns the classes for the comment div as an array.
- get_post_class()Retrieves an array of the class names for the post container element.
Show all 16
- iframe_header()Generic Iframe header for use with Thickbox.
- img_caption_shortcode()Builds the Caption shortcode output.
- login_header()Outputs the login page header.
- sanitize_html_class()Sanitizes an HTML classname to ensure it only contains valid characters.
Source
function sanitize_html_class( $classname, $fallback = '' ) { // Strip out any percent-encoded characters. $sanitized = preg_replace( '|%[a-fA-F0-9][a-fA-F0-9]|', '', $classname ); // Limit to A-Z, a-z, 0-9, '_', '-'. $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $sanitized ); if ( '' === $sanitized && $fallback ) { return sanitize_html_class( $fallback ); } /** * Filters a sanitized HTML class string. * * @since 2.8.0 * * @param string $sanitized The sanitized HTML class. * @param string $classname HTML class before sanitization. * @param string $fallback The fallback string. */ return apply_filters( 'sanitize_html_class', $sanitized, $classname, $fallback );}History
Introduced in 2.8.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
About this page
- Parsed data
- Generated from the wordpress-develop 6.9.7 tag, from
src/wp-includes/formatting.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it. - Corrections
- Something wrong on this page? Report it and it gets fixed in the next regeneration.