wp_kses_split2( string $content, array[]|string $allowed_html, string[] $allowed_protocols ): string

1396function wp_kses_split2( $content, $allowed_html, $allowed_protocols ) {1397	$content = wp_kses_stripslashes( $content );1398 1399	/*1400	 * The regex pattern used to split HTML into chunks attempts1401	 * to split on HTML token boundaries. This function should1402	 * thus receive chunks that _either_ start with meaningful1403	 * syntax tokens, like a tag `<div>` or a comment `<!-- ... -->`.1404	 *1405	 * If the first character of the `$content` chunk _isn't_ one1406	 * of these syntax elements, which always starts with `<`, then1407	 * the match had to be for the final alternation of `>`. In such1408	 * case, it's probably standing on its own and could be encoded1409	 * with a character reference to remove ambiguity.1410	 *1411	 * In other words, if this chunk isn't from a match of a syntax1412	 * token, it's just a plaintext greater-than (`>`) sign.1413	 */1414	if ( ! str_starts_with( $content, '<' ) ) {1415		return '&gt;';1416	}1417 1418	/*1419	 * When certain invalid syntax constructs appear, the HTML parser1420	 * shifts into what's called the "bogus comment state." This is a1421	 * plaintext state that consumes everything until the nearest `>`1422	 * and then transforms the entire span into an HTML comment.1423	 *1424	 * Preserve these comments and do not treat them like tags.1425	 *1426	 * @see https://html.spec.whatwg.org/#bogus-comment-state1427	 */1428	if ( 1 === preg_match( '~^(?:</[^a-zA-Z][^>]*>|<![a-z][^>]*>)$~', $content ) ) {1429		/**1430		 * Since the pattern matches `</…>` and also `<!…>`, this will1431		 * preserve the type of the cleaned-up token in the output.1432		 */1433		$opener  = $content[1];1434		$content = substr( $content, 2, -1 );1435 1436		do {1437			$prev    = $content;1438			$content = wp_kses( $content, $allowed_html, $allowed_protocols );1439		} while ( $prev !== $content );1440 1441		// Recombine the modified inner content with the original token structure.1442		return "<{$opener}{$content}>";1443	}1444 1445	/*1446	 * Normative HTML comments should be handled separately as their1447	 * parsing rules differ from those for tags and text nodes.1448	 */1449	if ( str_starts_with( $content, '<!--' ) ) {1450		$content = str_replace( array( '<!--', '-->' ), '', $content );1451 1452		while ( ( $newstring = wp_kses( $content, $allowed_html, $allowed_protocols ) ) !== $content ) {1453			$content = $newstring;1454		}1455 1456		if ( '' === $content ) {1457			return '';1458		}1459 1460		// Prevent multiple dashes in comments.1461		$content = preg_replace( '/--+/', '-', $content );1462		// Prevent three dashes closing a comment.1463		$content = preg_replace( '/-$/', '', $content );1464 1465		return "<!--{$content}-->";1466	}1467 1468	// It's seriously malformed.1469	if ( ! preg_match( '%^<\s*(/\s*)?([a-zA-Z0-9-]+)([^>]*)>?$%', $content, $matches ) ) {1470		return '';1471	}1472 1473	$slash    = trim( $matches[1] );1474	$elem     = $matches[2];1475	$attrlist = $matches[3];