After thinking about this a little bit, I guess that the proper way to ensure that your comments are properly escaped, is by doing something like this:
$the_comment = get_comment_text();
echo '<p>' . esc_html($the_comment) . '</p>';
Instead of simply using the function like this:
comment_text();
Why even have these handy functions in the first place, if they aren’t properly escaped? The comment_author();
function IS, yet this is not for some reason?
Perhaps I am missing something?
I was missing something: the unfiltered_html
capability given to the admin role, extends to comments. Read more here: https://wordpress.org/support/article/roles-and-capabilities/#unfiltered_html
Related Posts:
- comment_post_ID 0 (cannot remove from dashboard)
- What’s the difference between esc_* functions?
- How to escape custom css?
- Why do I get accidental comments without (the required) email address?
- How to Block Access to Standard Login Flow and Comment Flow
- Strategies for coping with hyperagressive spambots?
- How Could I sanitize the receive data from this code
- wp_insert_comment and security
- Is WordPress vulnerable to “comment posting forgery”?
- What is the safe way to print tracking code / pixel code before tag or tag
- Admin can enter JavaScript – potential security risk?
- Do we need to escape data that we receive from theme options?
- reCaptcha doesnt appear in comment (manual or plugin)
- WordPress scruity issue – Totally disable all comments by CSS — secure enough?
- How are readers authenticated for leaving comments?
- WordPress Commenting System User access and Security
- esc_url, esc_url_raw or sanitize_url?
- how to sanitizing $_POST with the correct way?
- How do I comment out a block of tags in XML?
- What does it mean to escape a string?
- R: Comment out block of code
- Why do I get comment spam even with Akismet and Captcha?
- What tools are available for managing/writing to WordPress? [closed]
- How to rearrange fields in comment_form()
- setting comments off as default for pages and custom post types?
- Should I escape wordpress functions like the_title, the_excerpt, the_content
- In Which Contexts are Plugins Responsible for Data Validation/Sanitization?
- Is it possible to pull comments from facebook into your blog?
- How safe / sanitized is wp_insert_posts()?
- Should HTML output be passed through esc_html() AND wp_kses()?
- When to use esc_html and when to use sanitize_text_field?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- What is the difference between esc_html filter vs attribute_escape filter?
- Filtering the Admin Comments List to Show Only Comments from the Current User?
- Non-threaded comment replies with link to original comment
- Escaping and sanitizing SVGs in metabox textarea
- Sanitize and data validation with apply_filters() function
- Approve comment hook?
- Commenting in user profile page?
- How to change “You must be logged in to post a comment.”
- Disable comments on all posts/pages
- How do I delete all comments from a specific old blog post?
- Which WP functions do you need to use esc_html() or esc_url() on?
- Removing the “Website” Field from Comments and Replies?
- How to properly validate data from $_GET or $_REQUEST using WordPress functions?
- Stop WordPress redirecting comment-page-1 to the post page?
- What to use instead of wp_kses() in user output
- Importing old Disqus comments into WordPress
- How to add a class to the comment submit button?
- How to wrap submit button of comment form with div
- is_email() VS sanitize_email()
- Sanitizing integer input for update_post_meta
- How to enable comments for pending and draft posts?
- Using WordPress’ WYSIWYG for comments
- Enable Submit Comment Without Page Reload (Using Ajax)?
- What for is the table “wp_commentmeta” exactly?
- Which KSES should be used and when?
- Getting Post Comments for post ID using WP_Query() and a Custom Loop?
- Add option to disable comments on a per posts basis?
- Resetting comment count
- When importing – failed to import: Invalid post type feedback
- How to change the email notification recipient (user) for new comments?
- Redirect user to a custom url after submitting the comment
- Paginate result set from $wpdb->get_results()
- Is sanitize_text_field() is enough to save to DB?
- Change Comment Author Display Name
- What is the difference between esc_html and wp_filter_nohtml_kses?
- Would switching to InnoDB from MyISAM improve performance of comments table?
- Custom comment type based on thread level
- How to add internal, revision comments to page updates
- How to load and show comments with AJAX instead of pagination?
- Linking to Page Showing Only Comments Without Parent Post
- Comment Reply javascript
- How do we remove the H3 tag for the reply-title I.D
- Comments not appearing at all
- comments reply script not working
- How to display comment form error messages in the same page
- 3 moderators to approve comment
- How to deal with small scale comment spam on small commercial sites? [closed]
- Escaping WP_Query tax_query when term has special character(s)
- What should I do to make generated avatars different for anonymous comments?
- A plugin where users can comment with Facebook or Twitter or OpenID [closed]
- Check If comment author is registered
- Comments screen in backend, how to disable email address of commenter for non admins
- Add comments from the admin panel?
- How can I limit the number of comments per registered user per day?
- One comment per user per post but be able to reply to existing comments
- How to use a custom comments template
- Comment visibility
- What’s the easiest way to close comments on media/attachments?
- Reverse comment pagination numbers
- Get comments for more than one post
- How can I add comments to a page?
- How to remove comment spam in WordPress
- Post Comments using WP REST API v2 in WordPress
- How to sanitize select box values in post meta?
- show number of open comments on custom dashboard
- Show content only if member left a comment
- Add placeholder attribute to comment form fields
- Does WordPress sanitize arguments to WP_Query?