wp_kses_attr( string $element, string $attr, array[]|string $allowed_html, string[] $allowed_protocols ): string
- Since
- 1.0.0, 5.9.0
- Source
wp-includes/kses.php:1437
Description
If some are allowed it calls wp_kses_hair() to split them further, and then it builds up new HTML code from the data that wp_kses_hair() returns. It also removes < and > characters, if there are any left. One more thing it does is to check if the tag has a closing XHTML slash, and if it does, it puts one in the returned code as well.
An array of allowed values can be defined for attributes. If the attribute value doesn't fall into the list, the attribute will be removed from the tag.
Attributes can be marked as required. If a required attribute is not present, KSES will remove all attributes from the tag. As KSES doesn't match opening and closing tags, it's not possible to safely remove the tag itself, the safest fallback is to strip all attributes from the tag, instead.
Compatibility
- WordPress
- since 5.9.0
- PHP
- 7.4–8.6-dev
- 6.7.7
- 6.8.8
- 6.9.7
- 7.0.4
- 7.1.0
Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.
Parameters
$elementstring- HTML element/tag.
$attrstring- HTML attributes from HTML element to closing HTML element tag.
$allowed_htmlarray[]|string- An array of allowed HTML elements and attributes, or a context name such as 'post'. See wp_kses_allowed_html() for the list of accepted context names.
$allowed_protocolsstring[]- Array of allowed URL protocols.
Return value
string- Sanitized HTML element.
Performance profile
How much work a call to wp_kses_attr() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.
- Cost class
- Trivial
- Scaling
- Constant
- Instructions
- 4–6
- Plugin surface
- None
- Called by
- 1
Touches nothing outside its own arguments.
No loop in the body: the same number of instructions runs whatever you pass in.
Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 104.
Nothing here hands control to plugin code.
1 place in core call this, so the cost is paid more often than your own code shows.
What it touches
- hookthird-party callbacks
apply_filters()one call below wp_kses_attr()
Further down the call graph this can also reach query, option, cache, serialize and transient. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.
What one call costs · 1 distinct outcome
One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_kses_attr() can have, taken from its control-flow graph on PHP 8.5.
| When | Instructions | Calls it makes |
|---|---|---|
| always | 4–6 | none |
Across PHP versions
| PHP | Compiled | Executed | Branches | Notes |
|---|---|---|---|---|
| 8.6-dev | 104 | 4–6 | 12 | |
| 8.5 | 104 | 4–6 | 12 | |
| 8.4 | 104 | 4–6 | 12 | 6 fewer instructions than PHP 8.3 |
| 8.3 | 110 | 4–6 | 12 | |
| 8.2 | 110 | 4–6 | 12 | |
| 8.1 | 110 | 4–6 | 12 | |
| 7.4 | 110 | 4–6 | 12 |
An instruction is not a fixed amount of time, so a matching count is not necessarily the same speed; what it rules out is a difference in the work itself.
Uses · 3
- wp_kses_allowed_html()Returns an array of allowed HTML tags and attributes for a given context.
- wp_kses_hair()Builds an attribute list from string containing attributes.
- wp_kses_attr_check()Determines whether an attribute is allowed.
Used by · 1
- wp_kses_split2()Callback for `wp_kses_split()` for fixing malformed HTML tags.
Source code
function wp_kses_attr( $element, $attr, $allowed_html, $allowed_protocols ) { if ( ! is_array( $allowed_html ) ) { $allowed_html = wp_kses_allowed_html( $allowed_html ); } // Is there a closing XHTML slash at the end of the attributes? $xhtml_slash = ''; if ( preg_match( '%\s*/\s*$%', $attr ) ) { $xhtml_slash = ' /'; } // Are any attributes allowed at all for this element? $element_low = strtolower( $element ); if ( empty( $allowed_html[ $element_low ] ) || true === $allowed_html[ $element_low ] ) { return "<$element$xhtml_slash>"; } // Split it. $attrarr = wp_kses_hair( $attr, $allowed_protocols ); // Check if there are attributes that are required. $required_attrs = array_filter( $allowed_html[ $element_low ], static function ( $required_attr_limits ) { return isset( $required_attr_limits['required'] ) && true === $required_attr_limits['required']; } ); /* * If a required attribute check fails, we can return nothing for a self-closing tag, * but for a non-self-closing tag the best option is to return the element with attributes, * as KSES doesn't handle matching the relevant closing tag. */ $stripped_tag = ''; if ( empty( $xhtml_slash ) ) { $stripped_tag = "<$element>"; } // Go through $attrarr, and save the allowed attributes for this element in $attr2. $attr2 = ''; foreach ( $attrarr as $arreach ) { // Check if this attribute is required. $required = isset( $required_attrs[ strtolower( $arreach['name'] ) ] ); if ( wp_kses_attr_check( $arreach['name'], $arreach['value'], $arreach['whole'], $arreach['vless'], $element, $allowed_html ) ) { $attr2 .= ' ' . $arreach['whole']; // If this was a required attribute, we can mark it as found. if ( $required ) { unset( $required_attrs[ strtolower( $arreach['name'] ) ] ); } } elseif ( $required ) { // This attribute was required, but didn't pass the check. The entire tag is not allowed. return $stripped_tag; } } // If some required attributes weren't set, the entire tag is not allowed. if ( ! empty( $required_attrs ) ) { return $stripped_tag; } // Remove any "<" or ">" characters. $attr2 = preg_replace( '/[<>]/', '', $attr2 ); return "<$element$attr2$xhtml_slash>";}Changelog
Introduced in 1.0.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
Added support for required attributes.from the docblock
About this page
- Parsed data
- Generated from the wordpress-develop 6.9.7 tag, from
src/wp-includes/kses.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it. - Corrections
- Something wrong on this page? Report it and it gets fixed in the next regeneration.