wp_kses_split2( string $content, array[]|string $allowed_html, string[] $allowed_protocols ): string

1396function wp_kses_split2( $content, $allowed_html, $allowed_protocols ) {1397	$content = wp_kses_stripslashes( $content );1398 1399	/*1400	 * The regex pattern used to split HTML into chunks attempts1401	 * to split on HTML token boundaries. This function should1402	 * thus receive chunks that _either_ start with meaningful1403	 * syntax tokens, like a tag `<div>` or a comment `<!-- ... -->`.1404	 *1405	 * If the first character of the `$content` chunk _isn't_ one1406	 * of these syntax elements, which always starts with `<`, then1407	 * the match had to be for the final alternation of `>`. In such1408	 * case, it's probably standing on its own and could be encoded1409	 * with a character reference to remove ambiguity.1410	 *1411	 * In other words, if this chunk isn't from a match of a syntax1412	 * token, it's just a plaintext greater-than (`>`) sign.1413	 */1414	if ( ! str_starts_with( $content, '<' ) ) {1415		return '&gt;';1416	}1417 1418	/*1419	 * When certain invalid syntax constructs appear, the HTML parser1420	 * shifts into what's called the "bogus comment state." This is a1421	 * plaintext state that consumes everything until the nearest `>`1422	 * and then transforms the entire span into an HTML comment.1423	 *1424	 * Preserve these comments and do not treat them like tags.1425	 *1426	 * @see https://html.spec.whatwg.org/#bogus-comment-state1427	 */1428	if ( 1 === preg_match( '~^(?:</[^a-zA-Z][^>]*>|<![a-z][^>]*>)$~', $content ) ) {1429		/**1430		 * Since the pattern matches `</…>` and also `<!…>`, this will1431		 * preserve the type of the cleaned-up token in the output.1432		 */1433		$opener  = $content[1];1434		$content = substr( $content, 2, -1 );1435 1436		do {1437			$prev    = $content;1438			$content = wp_kses( $content, $allowed_html, $allowed_protocols );1439		} while ( $prev !== $content );1440 1441		// Recombine the modified inner content with the original token structure.1442		return "<{$opener}{$content}>";1443	}1444 1445	/*1446	 * Normative HTML comments should be handled separately as their1447	 * parsing rules differ from those for tags and text nodes.1448	 */1449	if ( str_starts_with( $content, '<!--' ) ) {1450		$content = str_replace( array( '<!--', '-->' ), '', $content );1451 1452		while ( ( $newstring = wp_kses( $content, $allowed_html, $allowed_protocols ) ) !== $content ) {1453			$content = $newstring;1454		}1455 1456		if ( '' === $content ) {1457			return '';1458		}1459 1460		// Prevent multiple dashes in comments.1461		$content = preg_replace( '/--+/', '-', $content );1462		// Prevent three dashes closing a comment.1463		$content = preg_replace( '/-$/', '', $content );1464 1465		return "<!--{$content}-->";1466	}1467 1468	// It's seriously malformed.1469	if ( ! preg_match( '%^<\s*(/\s*)?([a-zA-Z0-9-]+)([^>]*)>?$%', $content, $matches ) ) {1470		return '';1471	}1472 1473	$slash    = trim( $matches[1] );1474	$elem     = $matches[2];1475	$attrlist = $matches[3];
When	Instructions	Calls it makes
`!$content`	10	`wp_kses_stripslashes()`
`!preg_match()`	21	`wp_kses_stripslashes(), preg_match()`
`$content`	29–38	`wp_kses_stripslashes(), wp_kses()`
`preg_match() && is_array($allowed_html)`	32–37	`wp_kses_stripslashes(), preg_match(), strtolower()`
`preg_match() && !is_array($allowed_html)`	36–41	`wp_kses_stripslashes(), preg_match(), wp_kses_allowed_html(), strtolower()`
`preg_match() && is_array($allowed_html) && isset($allowed_html) && $slash === ""`	40	`wp_kses_stripslashes(), preg_match(), strtolower(), wp_kses_attr()`
`preg_match() && !is_array($allowed_html) && isset($allowed_html) && $slash === ""`	44	`wp_kses_stripslashes(), preg_match(), wp_kses_allowed_html(), strtolower(), wp_kses_attr()`
PHP	Compiled	Executed	Branches	Notes
8.6-dev	95	10–44	10
8.5	95	10–44	10
8.4	95	10–44	10	24 fewer instructions than PHP 8.3
8.3	119	13–56	10
8.2	119	13–56	10
8.1	119	13–56	10
7.4	119	13–56	10