| [ Index ] |
PHP Cross Reference of WordPress |
[Source view] [Print] [Project Stats]
kses 0.2.2 - HTML/XHTML filter that only allows some elements and attributes Copyright (C) 2002, 2003, 2005 Ulf Harnhammar This program is free software and open source software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
| Author: | Ulf Harnhammar <http://advogato.org/person/metaur/> |
| Copyright: | (C) 2002, 2003, 2005 |
| Version: | 0.2.2 |
| File Size: | 2583 lines (68 kb) |
| Included or required: | 1 time |
| Referenced: | 0 times |
| Includes or requires: | 0 files |
| wp_kses( $string, $allowed_html, $allowed_protocols = array() X-Ref |
| Filters text content and strips out disallowed HTML. This function makes sure that only the allowed HTML element names, attribute names, attribute values, and HTML entities will occur in the given text string. This function expects unslashed data. return: string Filtered content containing only the allowed HTML. param: string $string Text content to filter. param: array[]|string $allowed_html An array of allowed HTML elements and attributes, param: string[] $allowed_protocols Array of allowed URL protocols. since: 1.0.0 |
| wp_kses_one_attr( $string, $element ) X-Ref |
| Filters one HTML attribute and ensures its value is allowed. This function can escape data in some situations where `wp_kses()` must strip the whole attribute. return: string Filtered attribute. param: string $string The 'whole' attribute, including name and value. param: string $element The HTML element name to which the attribute belongs. since: 4.2.3 |
| wp_kses_allowed_html( $context = '' ) X-Ref |
| Returns an array of allowed HTML tags and attributes for a given context. return: array Array of allowed HTML tags and their allowed attributes. param: string|array $context The context for which to retrieve tags. Allowed values are 'post', since: 3.5.0 since: 5.0.1 `form` removed as allowable HTML tag. |
| wp_kses_hook( $string, $allowed_html, $allowed_protocols ) X-Ref |
| You add any KSES hooks here. There is currently only one KSES WordPress hook, {@see 'pre_kses'}, and it is called here. All parameters are passed to the hooks and expected to receive a string. return: string Filtered content through {@see 'pre_kses'} hook. param: string $string Content to filter through KSES. param: array[]|string $allowed_html An array of allowed HTML elements and attributes, param: string[] $allowed_protocols Array of allowed URL protocols. since: 1.0.0 |
| wp_kses_version() X-Ref |
| Returns the version number of KSES. return: string KSES version number. since: 1.0.0 |
| wp_kses_split( $string, $allowed_html, $allowed_protocols ) X-Ref |
| Searches for HTML tags, no matter how malformed. It also matches stray `>` characters. return: string Content with fixed HTML tags param: string $string Content to filter. param: array[]|string $allowed_html An array of allowed HTML elements and attributes, param: string[] $allowed_protocols Array of allowed URL protocols. since: 1.0.0 |
| wp_kses_uri_attributes() X-Ref |
| Returns an array of HTML attribute names whose value contains a URL. This function returns a list of all HTML attributes that must contain a URL according to the HTML specification. This list includes URI attributes both allowed and disallowed by KSES. return: string[] HTML attribute names whose value contains a URL. since: 5.0.1 |
| _wp_kses_split_callback( $match ) X-Ref |
| Callback for `wp_kses_split()`. return: string param: array $match preg_replace regexp matches since: 3.1.0 |
| wp_kses_split2( $string, $allowed_html, $allowed_protocols ) X-Ref |
| Callback for `wp_kses_split()` for fixing malformed HTML tags. This function does a lot of work. It rejects some very malformed things like `<:::>`. It returns an empty string, if the element isn't allowed (look ma, no `strip_tags()`!). Otherwise it splits the tag into an element and an attribute list. After the tag is split into an element and an attribute list, it is run through another filter which will remove illegal attributes and once that is completed, will be returned. return: string Fixed HTML element param: string $string Content to filter. param: array[]|string $allowed_html An array of allowed HTML elements and attributes, param: string[] $allowed_protocols Array of allowed URL protocols. since: 1.0.0 |
| wp_kses_attr( $element, $attr, $allowed_html, $allowed_protocols ) X-Ref |
| Removes all attributes, if none are allowed for this element. If some are allowed it calls `wp_kses_hair()` to split them further, and then it builds up new HTML code from the data that `wp_kses_hair()` returns. It also removes `<` and `>` characters, if there are any left. One more thing it does is to check if the tag has a closing XHTML slash, and if it does, it puts one in the returned code as well. An array of allowed values can be defined for attributes. If the attribute value doesn't fall into the list, the attribute will be removed from the tag. Attributes can be marked as required. If a required attribute is not present, KSES will remove all attributes from the tag. As KSES doesn't match opening and closing tags, it's not possible to safely remove the tag itself, the safest fallback is to strip all attributes from the tag, instead. return: string Sanitized HTML element. param: string $element HTML element/tag. param: string $attr HTML attributes from HTML element to closing HTML element tag. param: array[]|string $allowed_html An array of allowed HTML elements and attributes, param: string[] $allowed_protocols Array of allowed URL protocols. since: 1.0.0 since: 5.9.0 Added support for an array of allowed values for attributes. |
| wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) X-Ref |
| No description |
| wp_kses_hair( $attr, $allowed_protocols ) X-Ref |
| Builds an attribute list from string containing attributes. This function does a lot of work. It parses an attribute list into an array with attribute data, and tries to do the right thing even if it gets weird input. It will add quotes around attribute values that don't have any quotes or apostrophes around them, to make it easier to produce HTML code that will conform to W3C's HTML specification. It will also remove bad URL protocols from attribute values. It also reduces duplicate attributes by using the attribute defined first (`foo='bar' foo='baz'` will result in `foo='bar'`). return: array[] Array of attribute information after parsing. param: string $attr Attribute list from HTML element to closing HTML element tag. param: string[] $allowed_protocols Array of allowed URL protocols. since: 1.0.0 |
| wp_kses_attr_parse( $element ) X-Ref |
| Finds all attributes of an HTML element. Does not modify input. May return "evil" output. Based on `wp_kses_split2()` and `wp_kses_attr()`. return: array|false List of attributes found in the element. Returns false on failure. param: string $element HTML element. since: 4.2.3 |
| wp_kses_hair_parse( $attr ) X-Ref |
| Builds an attribute list from string containing attributes. Does not modify input. May return "evil" output. In case of unexpected input, returns false instead of stripping things. Based on `wp_kses_hair()` but does not return a multi-dimensional array. return: array|false List of attributes found in $attr. Returns false on failure. param: string $attr Attribute list from HTML element to closing HTML element tag. since: 4.2.3 |
| wp_kses_check_attr_val( $value, $vless, $checkname, $checkvalue ) X-Ref |
| Performs different checks for attribute values. The currently implemented checks are "maxlen", "minlen", "maxval", "minval", and "valueless". return: bool Whether check passes. param: string $value Attribute value. param: string $vless Whether the attribute is valueless. Use 'y' or 'n'. param: string $checkname What $checkvalue is checking for. param: mixed $checkvalue What constraint the value should pass. since: 1.0.0 |
| wp_kses_bad_protocol( $string, $allowed_protocols ) X-Ref |
| Sanitizes a string and removed disallowed URL protocols. This function removes all non-allowed protocols from the beginning of the string. It ignores whitespace and the case of the letters, and it does understand HTML entities. It does its work recursively, so it won't be fooled by a string like `javascript:javascript:alert(57)`. return: string Filtered content. param: string $string Content to filter bad protocols from. param: string[] $allowed_protocols Array of allowed URL protocols. since: 1.0.0 |
| wp_kses_no_null( $string, $options = null ) X-Ref |
| Removes any invalid control characters in a text string. Also removes any instance of the `\0` string. return: string Filtered content. param: string $string Content to filter null characters from. param: array $options Set 'slash_zero' => 'keep' when '\0' is allowed. Default is 'remove'. since: 1.0.0 |
| wp_kses_stripslashes( $string ) X-Ref |
| Strips slashes from in front of quotes. This function changes the character sequence `\"` to just `"`. It leaves all other slashes alone. The quoting from `preg_replace(//e)` requires this. return: string Fixed string with quoted slashes. param: string $string String to strip slashes from. since: 1.0.0 |
| wp_kses_array_lc( $inarray ) X-Ref |
| Converts the keys of an array to lowercase. return: array Fixed array with all lowercase keys. param: array $inarray Unfiltered array. since: 1.0.0 |
| wp_kses_html_error( $string ) X-Ref |
| Handles parsing errors in `wp_kses_hair()`. The general plan is to remove everything to and including some whitespace, but it deals with quotes and apostrophes as well. return: string param: string $string since: 1.0.0 |
| wp_kses_bad_protocol_once( $string, $allowed_protocols, $count = 1 ) X-Ref |
| Sanitizes content from bad protocols and other characters. This function searches for URL protocols at the beginning of the string, while handling whitespace and HTML entities. return: string Sanitized content. param: string $string Content to check for bad protocols. param: string[] $allowed_protocols Array of allowed URL protocols. param: int $count Depth of call recursion to this function. since: 1.0.0 |
| wp_kses_bad_protocol_once2( $string, $allowed_protocols ) X-Ref |
| Callback for `wp_kses_bad_protocol_once()` regular expression. This function processes URL protocols, checks to see if they're in the list of allowed protocols or not, and returns different data depending on the answer. return: string Sanitized content. param: string $string URI scheme to check against the list of allowed protocols. param: string[] $allowed_protocols Array of allowed URL protocols. since: 1.0.0 |
| wp_kses_normalize_entities( $string, $context = 'html' ) X-Ref |
| Converts and fixes HTML entities. This function normalizes HTML entities. It will convert `AT&T` to the correct `AT&T`, `:` to `:`, `&#XYZZY;` to `&#XYZZY;` and so on. When `$context` is set to 'xml', HTML entities are converted to their code points. For example, `AT&T…&#XYZZY;` is converted to `AT&T…&#XYZZY;`. return: string Content with normalized entities. param: string $string Content to normalize entities. param: string $context Context for normalization. Can be either 'html' or 'xml'. since: 1.0.0 since: 5.5.0 Added `$context` parameter. |
| wp_kses_named_entities( $matches ) X-Ref |
| Callback for `wp_kses_normalize_entities()` regular expression. This function only accepts valid named entity references, which are finite, case-sensitive, and highly scrutinized by HTML and XML validators. return: string Correctly encoded entity. param: array $matches preg_replace_callback() matches array. since: 3.0.0 |
| wp_kses_xml_named_entities( $matches ) X-Ref |
| Callback for `wp_kses_normalize_entities()` regular expression. This function only accepts valid named entity references, which are finite, case-sensitive, and highly scrutinized by XML validators. HTML named entity references are converted to their code points. return: string Correctly encoded entity. param: array $matches preg_replace_callback() matches array. since: 5.5.0 |
| wp_kses_normalize_entities2( $matches ) X-Ref |
| Callback for `wp_kses_normalize_entities()` regular expression. This function helps `wp_kses_normalize_entities()` to only accept 16-bit values and nothing more for `&#number;` entities. return: string Correctly encoded entity. param: array $matches `preg_replace_callback()` matches array. since: 1.0.0 |
| wp_kses_normalize_entities3( $matches ) X-Ref |
| Callback for `wp_kses_normalize_entities()` for regular expression. This function helps `wp_kses_normalize_entities()` to only accept valid Unicode numeric entities in hex form. return: string Correctly encoded entity. param: array $matches `preg_replace_callback()` matches array. since: 2.7.0 |
| valid_unicode( $i ) X-Ref |
| Determines if a Unicode codepoint is valid. return: bool Whether or not the codepoint is a valid Unicode codepoint. param: int $i Unicode codepoint. since: 2.7.0 |
| wp_kses_decode_entities( $string ) X-Ref |
| Converts all numeric HTML entities to their named counterparts. This function decodes numeric HTML entities (`A` and `A`). It doesn't do anything with named entities like `ä`, but we don't need them in the allowed URL protocols system anyway. return: string Content after decoded entities. param: string $string Content to change entities. since: 1.0.0 |
| _wp_kses_decode_entities_chr( $match ) X-Ref |
| Regex callback for `wp_kses_decode_entities()`. return: string param: array $match preg match since: 2.9.0 |
| _wp_kses_decode_entities_chr_hexdec( $match ) X-Ref |
| Regex callback for `wp_kses_decode_entities()`. return: string param: array $match preg match since: 2.9.0 |
| wp_filter_kses( $data ) X-Ref |
| Sanitize content with allowed HTML KSES rules. This function expects slashed data. return: string Filtered content. param: string $data Content to filter, expected to be escaped with slashes. since: 1.0.0 |
| wp_kses_data( $data ) X-Ref |
| Sanitize content with allowed HTML KSES rules. This function expects unslashed data. return: string Filtered content. param: string $data Content to filter, expected to not be escaped. since: 2.9.0 |
| wp_filter_post_kses( $data ) X-Ref |
| Sanitizes content for allowed HTML tags for post content. Post content refers to the page contents of the 'post' type and not `$_POST` data from forms. This function expects slashed data. return: string Filtered post content with allowed HTML tags and attributes intact. param: string $data Post content to filter, expected to be escaped with slashes. since: 2.0.0 |
| wp_filter_global_styles_post( $data ) X-Ref |
| Sanitizes global styles user content removing unsafe rules. return: string Filtered post content with unsafe rules removed. param: string $data Post content to filter. since: 5.9.0 |
| wp_kses_post( $data ) X-Ref |
| Sanitizes content for allowed HTML tags for post content. Post content refers to the page contents of the 'post' type and not `$_POST` data from forms. This function expects unslashed data. return: string Filtered post content with allowed HTML tags and attributes intact. param: string $data Post content to filter. since: 2.9.0 |
| wp_kses_post_deep( $data ) X-Ref |
| Navigates through an array, object, or scalar, and sanitizes content for allowed HTML tags for post content. return: mixed The filtered content. param: mixed $data The array, object, or scalar value to inspect. since: 4.4.2 |
| wp_filter_nohtml_kses( $data ) X-Ref |
| Strips all HTML from a text string. This function expects slashed data. return: string Filtered content without any HTML. param: string $data Content to strip all HTML from. since: 2.1.0 |
| kses_init_filters() X-Ref |
| Adds all KSES input form content filters. All hooks have default priority. The `wp_filter_kses()` function is added to the 'pre_comment_content' and 'title_save_pre' hooks. The `wp_filter_post_kses()` function is added to the 'content_save_pre', 'excerpt_save_pre', and 'content_filtered_save_pre' hooks. since: 2.0.0 |
| kses_remove_filters() X-Ref |
| Removes all KSES input form content filters. A quick procedural method to removing all of the filters that KSES uses for content in WordPress Loop. Does not remove the `kses_init()` function from {@see 'init'} hook (priority is default). Also does not remove `kses_init()` function from {@see 'set_current_user'} hook (priority is also default). since: 2.0.6 |
| kses_init() X-Ref |
| Sets up most of the KSES filters for input form content. First removes all of the KSES filters in case the current user does not need to have KSES filter the content. If the user does not have `unfiltered_html` capability, then KSES filters are added. since: 2.0.0 |
| safecss_filter_attr( $css, $deprecated = '' ) X-Ref |
| Filters an inline style attribute and removes disallowed rules. return: string Filtered string of CSS rules. param: string $css A string of CSS rules. param: string $deprecated Not used. since: 2.8.1 since: 4.4.0 Added support for `min-height`, `max-height`, `min-width`, and `max-width`. since: 4.6.0 Added support for `list-style-type`. since: 5.0.0 Added support for `background-image`. since: 5.1.0 Added support for `text-transform`. since: 5.2.0 Added support for `background-position` and `grid-template-columns`. since: 5.3.0 Added support for `grid`, `flex` and `column` layout properties. since: 5.3.1 Added support for gradient backgrounds. since: 5.7.1 Added support for `object-position`. since: 5.8.0 Added support for `calc()` and `var()` values. |
| _wp_add_global_attributes( $value ) X-Ref |
| Helper function to add global attributes to a tag in the allowed HTML list. return: array The array of attributes with global attributes added. param: array $value An array of attributes. since: 3.5.0 since: 5.0.0 Added support for `data-*` wildcard attributes. since: 6.0.0 Added `dir`, `lang`, and `xml:lang` to global attributes. |
| _wp_kses_allow_pdf_objects( $url ) X-Ref |
| Helper function to check if this is a safe PDF URL. return: bool True if the URL is safe, false otherwise. param: string $url The URL to check. since: 5.9.0 |
| Generated: Thu Nov 21 01:00:03 2024 | Cross-referenced by PHPXref 0.7.1 |