I would disagree with the solution posted by @JaredCobb, wp_kses()
is much more flexible than the method he presented. It can strip out unwanted attributes from tags without destroying the tags themselves. For example, if the user put in <strong class="foo">
, wp_kses()
would return <strong>
if you did not allow class, whereas strip_tags()
would remove the <strong>
completely.
@redconservatory: The attributes you’ll want to use are as follows:
$args = array(
//formatting
'strong' => array(),
'em' => array(),
'b' => array(),
'i' => array(),
//links
'a' => array(
'href' => array()
)
);
This will allow bold and italics with no attributes, as well as anchor tags with an href
attributes…and nothing else. It uses the whitelisting principle, which @jaredcobb rightly noted is the better way to go here.