wp_check_comment_disallowed_list( string $author, string $email, string $url, string $comment, string $user_ip, string $user_agent ): bool

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$authorstring

The author of the comment

$emailstring

The email of the comment

$urlstring

The url used in the comment

$commentstring

The comment content

$user_ipstring

The comment author's IP address

$user_agentstring

The author's browser user agent

Return value

bool

True if comment contains disallowed content, false if comment does not

Performance profile

How much work a call to wp_check_comment_disallowed_list() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reads stored settings via get_option(), cached per request but not free on a cold cache.

Scaling

Scales with input

The body loops, so the work grows with what you pass in.

Instructions

38–78

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 81.

Plugin surface

2 hooks

Third-party callbacks on 'wp_blacklist_check', 'wp_check_comment_disallowed_list' run inside this call, and their cost is not bounded by anything here.

Called by

2

2 places in core call this, so the cost is paid more often than your own code shows.

What it touches

• hookthird-party callbacksdo_action_deprecated()called directly
• optionoption read or writeget_option()called directly
• cacheobject cachewp_cache_get()one call below wp_check_comment_disallowed_list()
• serializeserialisationmaybe_unserialize()one call below wp_check_comment_disallowed_list()

Further down the call graph this can also reach query and transient. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 3 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_check_comment_disallowed_list() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 2

2 hooks fire while wp_check_comment_disallowed_list() runs, in this order:

1. 1
   do_action( wp_blacklist_check )action_deprecatedline 1339 (+14 into the body)

   Fires before the comment is tested for disallowed characters or words.

2. 2
   do_action( wp_check_comment_disallowed_list )actionline 1359 (+34 into the body)

   Fires before the comment is tested for disallowed characters or words.

Uses · 5

• do_action_deprecated()Fires functions attached to a deprecated action hook.
• __()Retrieves the translation of $text.
• do_action()Calls the callback functions that have been added to an action hook.
• get_option()Retrieves an option value based on an option name.
• wp_strip_all_tags()Properly strips all HTML tags including 'script' and 'style'.

Used by · 2

• wp_blacklist_check()Does comment contain disallowed characters or words.
• wp_check_comment_data()Checks whether comment data passes internal checks or has disallowed content.

Source code

View on Trac ↗View on GitHub ↗

1325function wp_check_comment_disallowed_list( $author, $email, $url, $comment, $user_ip, $user_agent ) {1326	/**1327	 * Fires before the comment is tested for disallowed characters or words.1328	 *1329	 * @since 1.5.01330	 * @deprecated 5.5.0 Use {@see 'wp_check_comment_disallowed_list'} instead.1331	 *1332	 * @param string $author     Comment author.1333	 * @param string $email      Comment author's email.1334	 * @param string $url        Comment author's URL.1335	 * @param string $comment    Comment content.1336	 * @param string $user_ip    Comment author's IP address.1337	 * @param string $user_agent Comment author's browser user agent.1338	 */1339	do_action_deprecated(1340		'wp_blacklist_check',1341		array( $author, $email, $url, $comment, $user_ip, $user_agent ),1342		'5.5.0',1343		'wp_check_comment_disallowed_list',1344		__( 'Please consider writing more inclusive code.' )1345	);1346 1347	/**1348	 * Fires before the comment is tested for disallowed characters or words.1349	 *1350	 * @since 5.5.01351	 *1352	 * @param string $author     Comment author.1353	 * @param string $email      Comment author's email.1354	 * @param string $url        Comment author's URL.1355	 * @param string $comment    Comment content.1356	 * @param string $user_ip    Comment author's IP address.1357	 * @param string $user_agent Comment author's browser user agent.1358	 */1359	do_action( 'wp_check_comment_disallowed_list', $author, $email, $url, $comment, $user_ip, $user_agent );1360 1361	$mod_keys = trim( get_option( 'disallowed_keys' ) );1362	if ( '' === $mod_keys ) {1363		return false; // If moderation keys are empty.1364	}1365 1366	// Ensure HTML tags are not being used to bypass the list of disallowed characters and words.1367	$comment_without_html = wp_strip_all_tags( $comment );1368 1369	$words = explode( "\n", $mod_keys );1370 1371	foreach ( (array) $words as $word ) {1372		$word = trim( $word );1373 1374		// Skip empty lines.1375		if ( empty( $word ) ) {1376			continue; }1377 1378		// Do some escaping magic so that '#' chars in the spam words don't break things:1379		$word = preg_quote( $word, '#' );1380 1381		$pattern = "#$word#iu";1382		if ( preg_match( $pattern, $author )1383			|| preg_match( $pattern, $email )1384			|| preg_match( $pattern, $url )1385			|| preg_match( $pattern, $comment )1386			|| preg_match( $pattern, $comment_without_html )1387			|| preg_match( $pattern, $user_ip )1388			|| preg_match( $pattern, $user_agent )1389		) {1390			return true;1391		}1392	}1393	return false;1394}

Changelog

Introduced in 5.5.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 6.7.7 tag, from src/wp-includes/comment.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.