wp_kses() WordPress Function
The wp_kses() function is a security function that allows you to specify which HTML tags and attributes are allowed in a string. It is useful for preventing cross-site scripting (XSS) attacks.
wp_kses( string $string, array[]|string $allowed_html, string[] $allowed_protocols = array() ) #
Filters text content and strips out disallowed HTML.
Description
This function makes sure that only the allowed HTML element names, attribute names, attribute values, and HTML entities will occur in the given text string.
This function expects unslashed data.
See also
- wp_kses_post(): for specifically filtering post content and fields.
- wp_allowed_protocols(): for the default allowed protocols in link URLs.
Parameters
- $string
(string)(Required)Text content to filter.
- $allowed_html
(array[]|string)(Required)An array of allowed HTML elements and attributes, or a context name such as 'post'. See wp_kses_allowed_html() for the list of accepted context names.
- $allowed_protocols
(string[])(Optional)Array of allowed URL protocols.
Default value: array()
Return
(string) Filtered content containing only the allowed HTML.
More Information
KSES is a recursive acronym which stands for “KSES Strips Evil Scripts”.
For parameter $allowed_protocols, the default allowed protocols are http, https, ftp, mailto, news, irc, gopher, nntp, feed, and telnet. This covers all common link protocols, except for javascript, which should not be allowed for untrusted users.
Source
File: wp-includes/kses.php
function wp_kses( $string, $allowed_html, $allowed_protocols = array() ) {
if ( empty( $allowed_protocols ) ) {
$allowed_protocols = wp_allowed_protocols();
}
$string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
$string = wp_kses_normalize_entities( $string );
$string = wp_kses_hook( $string, $allowed_html, $allowed_protocols );
return wp_kses_split( $string, $allowed_html, $allowed_protocols );
}
Expand full source codeCollapse full source codeView on TracView on GitHub
Changelog
| Version | Description |
|---|---|
| 1.0.0 | Introduced. |