dongxuan8227 2017-11-23 05:13
浏览 79
已采纳

WordPress中的动态自定义代码转义

I have the following two snippets of code that render the custom code in the header.php and footer.php:

<!-- code before closing head tag -->
<?php echo $x_redux_option['x_code_before_head']; ?>
<!-- code before closing body tag -->
<?php echo $x_code_before_body; ?>

The data is coming from the redux framework dynamically. And the options only accept code wrapped with script tags and HTML markup that is valid inside the <head> tag for header and valid HTML markup for footer.

The fact is that the Mentor Themeforest shows the following errors:

  1. All dynamic data must be correctly escaped for the context where it is rendered. at file header.php, line 39:

  2. All dynamic data must be correctly escaped for the context where it is rendered. at file footer.php, line 44:


How can I escape this data? Will I use the wp_kses() function? But which HTML tags should I allow? How can I know which tags should be allowed?

Please, extend your helping hand as before. :) Thank you so much for taking the trouble to read.

  • 写回答

1条回答 默认 最新

  • dougu5847 2017-11-23 14:25
    关注

    I'd go with esc_html. Since you are going to echo HTML and scripts, wp_kses would need to allow pretty much all the tags. Your code is gonna look like this:

    <!-- code before closing head tag -->
    <?php echo esc_html( $x_redux_option['x_code_before_head'] ); ?>
    <!-- code before closing body tag -->
    <?php echo esc_html( $x_code_before_body ); ?>
    

    I suppose you're familiar with data escaping, however I'll leave a link to official WordPress docs anyway:

    https://developer.wordpress.org/themes/theme-security/data-sanitization-escaping/

    Thanks, Luca

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥20 完全没有学习过GAN,看了CSDN的一篇文章,里面有代码但是完全不知道如何操作
  • ¥15 使用ue5插件narrative时如何切换关卡也保存叙事任务记录
  • ¥20 软件测试决策法疑问求解答
  • ¥15 win11 23H2删除推荐的项目,支持注册表等
  • ¥15 matlab 用yalmip搭建模型,cplex求解,线性化处理的方法
  • ¥15 qt6.6.3 基于百度云的语音识别 不会改
  • ¥15 关于#目标检测#的问题:大概就是类似后台自动检测某下架商品的库存,在他监测到该商品上架并且可以购买的瞬间点击立即购买下单
  • ¥15 神经网络怎么把隐含层变量融合到损失函数中?
  • ¥15 lingo18勾选global solver求解使用的算法
  • ¥15 全部备份安卓app数据包括密码,可以复制到另一手机上运行