Dynamic Custom Code Escaping in WordPress

Question

I have the following two snippets of code that render the custom code in the header.php and footer.php:

<!-- code before closing head tag -->
<?php echo $x_redux_option['x_code_before_head']; ?>
<!-- code before closing body tag -->
<?php echo $x_code_before_body; ?>

The data is coming from the redux framework dynamically. And the options only accept code wrapped with script tags and HTML markup that is valid inside the <head> tag for header and valid HTML markup for footer.

The fact is that the Mentor Themeforest shows the following errors:

All dynamic data must be correctly escaped for the context where it is rendered. at file header.php, line 39:
All dynamic data must be correctly escaped for the context where it is rendered. at file footer.php, line 44:

How can I escape this data? Will I use the wp_kses() function? But which HTML tags should I allow? How can I know which tags should be allowed?

Please, extend your helping hand as before. :) Thank you so much for taking the trouble to read.

Lukasz Formela · Accepted Answer · 2017-11-23 14:25:03Z

1

I'd go with esc_html. Since you are going to echo HTML and scripts, wp_kses would need to allow pretty much all the tags. Your code is gonna look like this:

<!-- code before closing head tag -->
<?php echo esc_html( $x_redux_option['x_code_before_head'] ); ?>
<!-- code before closing body tag -->
<?php echo esc_html( $x_code_before_body ); ?>

I suppose you're familiar with data escaping, however I'll leave a link to official WordPress docs anyway:

https://developer.wordpress.org/themes/theme-security/data-sanitization-escaping/

Thanks, Luca

answered Nov 23, 2017 at 14:25

Lukasz Formela

4475 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Mohammad Shohel Rana Over a year ago

Thank you so much, Luca :) . Yes, I am familiar with data escaping. My concern is that if esc_html() is the best practice for this purpose. Have you ever used this on any themeforest submission? Thanks again for your kind help. (Y)

Lukasz Formela Over a year ago

Yes, I'm using all kinds of escape functions in my themes, depends on the data. For me the esc_html would be the best in this case. FYI - I've dropped support of Redux Framework in favour of standard WordPress tools. As far as I'm concerned, theme submission requirements on official WordPress.org site already require using nothing but pure WordPress. I suppose that in a year or two ThemeForest will have to do the same.

Lukasz Formela Over a year ago

I can't edit my previous comment, sorry. If you find my answer useful, kindly mark it as correct, I would be very greatful :)

Mohammad Shohel Rana Over a year ago

Oh! Yes, of course. :) I did decide to mark it as my answer when I found the solution.

Collectives™ on Stack Overflow

Dynamic Custom Code Escaping in WordPress

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related