| 1 |
<?php |
| 2 |
/** |
| 3 |
* WordPress Escaping and Sanitization |
| 4 |
**/ |
| 5 |
|
| 6 |
// esc html content before rendering |
| 7 |
function wpcomment_esc_html($content) { |
| 8 |
|
| 9 |
global $allowedposttags; |
| 10 |
$allowed_atts = array( |
| 11 |
'align' => array(), |
| 12 |
'class' => array(), |
| 13 |
'type' => array(), |
| 14 |
'id' => array(), |
| 15 |
'dir' => array(), |
| 16 |
'lang' => array(), |
| 17 |
'style' => array(), |
| 18 |
'xml:lang' => array(), |
| 19 |
'src' => array(), |
| 20 |
'alt' => array(), |
| 21 |
'href' => array(), |
| 22 |
'rel' => array(), |
| 23 |
'rev' => array(), |
| 24 |
'target' => array(), |
| 25 |
'novalidate' => array(), |
| 26 |
'type' => array(), |
| 27 |
'value' => array(), |
| 28 |
'name' => array(), |
| 29 |
'tabindex' => array(), |
| 30 |
'action' => array(), |
| 31 |
'method' => array(), |
| 32 |
'for' => array(), |
| 33 |
'width' => array(), |
| 34 |
'height' => array(), |
| 35 |
'data' => array(), |
| 36 |
'data-metatype' => array(), |
| 37 |
'data-meta-id' => array(), |
| 38 |
'data-opt-index' => array(), |
| 39 |
'data-condition-type' => array(), |
| 40 |
'title' => array(), |
| 41 |
); |
| 42 |
$allowedposttags['form'] = $allowed_atts; |
| 43 |
$allowedposttags['label'] = $allowed_atts; |
| 44 |
$allowedposttags['input'] = $allowed_atts; |
| 45 |
$allowedposttags['select'] = $allowed_atts; |
| 46 |
$allowedposttags['option'] = $allowed_atts; |
| 47 |
$allowedposttags['textarea'] = $allowed_atts; |
| 48 |
$allowedposttags['iframe'] = $allowed_atts; |
| 49 |
$allowedposttags['script'] = $allowed_atts; |
| 50 |
$allowedposttags['style'] = $allowed_atts; |
| 51 |
$allowedposttags['strong'] = $allowed_atts; |
| 52 |
$allowedposttags['small'] = $allowed_atts; |
| 53 |
$allowedposttags['table'] = $allowed_atts; |
| 54 |
$allowedposttags['span'] = $allowed_atts; |
| 55 |
$allowedposttags['abbr'] = $allowed_atts; |
| 56 |
$allowedposttags['code'] = $allowed_atts; |
| 57 |
$allowedposttags['pre'] = $allowed_atts; |
| 58 |
$allowedposttags['div'] = $allowed_atts; |
| 59 |
$allowedposttags['img'] = $allowed_atts; |
| 60 |
$allowedposttags['h1'] = $allowed_atts; |
| 61 |
$allowedposttags['h2'] = $allowed_atts; |
| 62 |
$allowedposttags['h3'] = $allowed_atts; |
| 63 |
$allowedposttags['h4'] = $allowed_atts; |
| 64 |
$allowedposttags['h5'] = $allowed_atts; |
| 65 |
$allowedposttags['h6'] = $allowed_atts; |
| 66 |
$allowedposttags['ol'] = $allowed_atts; |
| 67 |
$allowedposttags['ul'] = $allowed_atts; |
| 68 |
$allowedposttags['li'] = $allowed_atts; |
| 69 |
$allowedposttags['em'] = $allowed_atts; |
| 70 |
$allowedposttags['hr'] = $allowed_atts; |
| 71 |
$allowedposttags['br'] = $allowed_atts; |
| 72 |
$allowedposttags['tr'] = $allowed_atts; |
| 73 |
$allowedposttags['td'] = $allowed_atts; |
| 74 |
$allowedposttags['p'] = $allowed_atts; |
| 75 |
$allowedposttags['a'] = $allowed_atts; |
| 76 |
$allowedposttags['b'] = $allowed_atts; |
| 77 |
$allowedposttags['i'] = $allowed_atts; |
| 78 |
|
| 79 |
// $allowed_tags = wp_kses_allowed_html('post'); |
| 80 |
|
| 81 |
return wp_kses(stripslashes_deep($content), $allowedposttags); |
| 82 |
} |
| 83 |
|
| 84 |
// sanitization array data before saving data |
| 85 |
function wpcomment_sanitize_array_data($array) { |
| 86 |
foreach ( $array as $key => &$value ) { |
| 87 |
if ( is_array( $value ) ) { |
| 88 |
$array[$key] = wpcomment_sanitize_array_data($value); |
| 89 |
} |
| 90 |
else { |
| 91 |
if( in_array($key, wpcomment_fields_with_html()) ){ |
| 92 |
$array[$key] = wpcomment_esc_html($value); |
| 93 |
}else{ |
| 94 |
$array[$key] = sanitize_text_field( $value ); |
| 95 |
} |
| 96 |
} |
| 97 |
} |
| 98 |
return $array; |
| 99 |
} |
| 100 |
|
| 101 |
|
| 102 |
// wpcomment_fields keys requires html |
| 103 |
function wpcomment_fields_with_html() { |
| 104 |
|
| 105 |
$have_html = ['description', 'heading', 'html','checked']; |
| 106 |
return apply_filters('wpcomment_fields_with_html', $have_html); |
| 107 |
} |
