wp_kses_attr

函式
wp_kses_attr ( $element, $attr, $allowed_html, $allowed_protocols )
引數
  • (string) $element HTML element/tag.
    Required:
  • (string) $attr HTML attributes from HTML element to closing HTML element tag.
    Required:
  • (array[]|string) $allowed_html An array of allowed HTML elements and attributes, or a context name such as 'post'. See wp_kses_allowed_html() for the list of accepted context names.
    Required:
  • (string[]) $allowed_protocols Array of allowed URL protocols.
    Required:
返回值
  • (string) Sanitized HTML element.
定義位置
相關方法
wp_kses_one_attrwp_kses_datawp_kses_hairwp_kses_attr_parsewp_kses_attr_check
引入
1.0.0
棄用
-

wp_kses_attr: 這個函式用於通過刪除任何潛在的惡意或不允許的內容來對單個HTML屬性進行淨化。

如果該元素不允許有任何屬性,則刪除所有屬性。

如果允許一些屬性,它會呼叫`wp_kses_hair()`來進一步分割它們,然後用`wp_kses_hair()`返回的資料建立新的HTML程式碼。它還會刪除“字元,如果有任何剩餘的話。它還會檢查標籤是否有XHTML斜線結尾,如果有,它也會在返回的程式碼中加入一個。

可以為屬性定義一個允許值陣列。如果屬性值不在列表中,該屬性將被從標籤中刪除。

屬性可以被標記為必填。如果一個必需的屬性不存在,KSES將從標籤中刪除所有屬性。由於KSES不匹配標籤的開頭和結尾,因此不可能安全地刪除標籤本身,最安全的退路是剝離標籤中的所有屬性。

function wp_kses_attr( $element, $attr, $allowed_html, $allowed_protocols ) {
	if ( ! is_array( $allowed_html ) ) {
		$allowed_html = wp_kses_allowed_html( $allowed_html );
	}

	// Is there a closing XHTML slash at the end of the attributes?
	$xhtml_slash = '';
	if ( preg_match( '%s*/s*$%', $attr ) ) {
		$xhtml_slash = ' /';
	}

	// Are any attributes allowed at all for this element?
	$element_low = strtolower( $element );
	if ( empty( $allowed_html[ $element_low ] ) || true === $allowed_html[ $element_low ] ) {
		return "<$element$xhtml_slash>";
	}

	// Split it.
	$attrarr = wp_kses_hair( $attr, $allowed_protocols );

	// Check if there are attributes that are required.
	$required_attrs = array_filter(
		$allowed_html[ $element_low ],
		function( $required_attr_limits ) {
			return isset( $required_attr_limits['required'] ) && true === $required_attr_limits['required'];
		}
	);

	/*
	 * If a required attribute check fails, we can return nothing for a self-closing tag,
	 * but for a non-self-closing tag the best option is to return the element with attributes,
	 * as KSES doesn't handle matching the relevant closing tag.
	 */
	$stripped_tag = '';
	if ( empty( $xhtml_slash ) ) {
		$stripped_tag = "<$element>";
	}

	// Go through $attrarr, and save the allowed attributes for this element in $attr2.
	$attr2 = '';
	foreach ( $attrarr as $arreach ) {
		// Check if this attribute is required.
		$required = isset( $required_attrs[ strtolower( $arreach['name'] ) ] );

		if ( wp_kses_attr_check( $arreach['name'], $arreach['value'], $arreach['whole'], $arreach['vless'], $element, $allowed_html ) ) {
			$attr2 .= ' ' . $arreach['whole'];

			// If this was a required attribute, we can mark it as found.
			if ( $required ) {
				unset( $required_attrs[ strtolower( $arreach['name'] ) ] );
			}
		} elseif ( $required ) {
			// This attribute was required, but didn't pass the check. The entire tag is not allowed.
			return $stripped_tag;
		}
	}

	// If some required attributes weren't set, the entire tag is not allowed.
	if ( ! empty( $required_attrs ) ) {
		return $stripped_tag;
	}

	// Remove any "<" or ">" characters.
	$attr2 = preg_replace( '/[<>]/', '', $attr2 );

	return "<$element$attr2$xhtml_slash>";
}

常見問題

FAQs
檢視更多 >