1) For escaping content of textarea you should use esc_textarea and not esc_attr.
2) You should not escape things when storing them in the DB, escaping should be done only at output time. (I assume that you can find an edge case in which it might be needed, but as a general rule, just don’t do it).
3) Asking users to insert JS code is very user hostile. In addition to the obvious security problem that might arise a general type of breakage is almost un avoidable… think someone doing $ = 'dollar';. It doesn’t help that if you go that way you have no way to sanitize anything and have to serve it raw.
Related Posts:
- Trigger Javascript on Gutenberg (Block Editor) Save
- Does javascript have an equivalent to PHP’s preg_replace_callback?
- WordPress problem with htmlentities
- esc_js() breaks unicode sequences by removing the slash ‘\’ character
- How to set javascript options for select2 in PHP array of plugin
- how to prevent added meta box from being injected with style=”position: fixed; top: 56px;” at scroll down
- How are cookie values encoded?
- How to Create a Repeatable Meta Box
- What does “javascript:void(0)” mean?
- For-each over an array in JavaScript
- Cannot read property ‘push’ of undefined when combining arrays
- How can I remove a specific item from an array?
- require is not defined? Node.js
- Getting Error “Form submission canceled because the form is not connected”
- How to implement navbar using react
- function updateMap for Google Maps API
- Loop inside React JSX
- Encode URL in JavaScript?
- JavaScript null check
- JavaScript “Uncaught TypeError: object is not a function” associativity question
- npm – EPERM: operation not permitted on Windows
- Module not found can’t resolve
- How can I get file extensions with JavaScript?
- How to detect Safari, Chrome, IE, Firefox and Opera browser?
- What does on() in JavaScript do?
- AngularJS : Factory and Service?
- Javascript Uncaught TypeError : .split is not a function
- Uncaught TypeError: Cannot read property ‘msie’ of undefined
- How to hide a div with jQuery?v
- How do I pass variables and data from PHP to JavaScript?
- How do I set/unset a cookie with jQuery?
- Calling onclick on a radiobutton list using javascript
- How to properly export an ES6 class in Node 4?
- DOMException: Failed to load because no supported source was found
- Counting the occurrences / frequency of array elements
- how to download file in react js
- TypeError: $(…).DataTable is not a function
- Trying to use fetch and pass in mode: no-cors
- Moment.js transform to date object
- jQuery explode string like PHP
- Call Javascript function from URL/address bar
- Anagrams finder in javascript
- How to validate a credit card number
- TypeError: res.status is not a function
- What is define([ , function ]) in JavaScript?
- Setting and getting localStorage with jQuery
- How to subtract days from a plain Date?
- Stopping a JavaScript function when a certain condition is met
- Showing an image from an array of images – Javascript
- AngularJS errors: Blocked loading resource from url not allowed by $sceDelegate policy
- How to use z-index in svg elements?
- How do you completely remove Ionic and Cordova installation from mac?
- What is the best way to detect a mobile device?
- How to filter JSON Data in JavaScript or jQuery?
- What’s the best way to reload / refresh an iframe?
- How do I check if a cookie exists?
- Get querystring from URL using jQuery [duplicate]
- Check if string contains only digits
- JS: iterating over result of getElementsByClassName using Array.forEach
- jQuery checkbox change and click event
- Error: listen EACCES 0.0.0.0:80 OSx Node.js
- jQuery selectors on custom data attributes using HTML5
- How to check if a value is not null and not empty string in JS
- How do I refresh a DIV content?
- TypeError: abc.getAttribute is not a function
- JavaScript single line ‘if’ statement – best syntax, this alternative?
- jquery to validate phone number
- Closing Bootstrap modal onclick
- window.location() not working, not opening page
- How to clear the canvas for redrawing
- What’s a Good Javascript Time Picker?
- JavaScript event window.onload not triggered
- Default text on input
- Pass custom fields values to Google Maps
- Gutenberg Modify core taxonomy panel element via wp.hooks.addFilter
- What is “open()” in MediaUpload?
- update_option in javascript
- What’s the handle for media.js?
- Script will not print in head if path to file is correct
- How can I add Block Style support to the core HTML block in Gutenberg?
- How to add comment on scripts using function in wordpress?
- Is there a way to check for an attribute of a script when using script_loader_tag?
- Jquery function working in Chrome Console but not in the code [closed]
- Gutenberg: Block validation Failed Richtext undefined
- Multiple media uploader buttons target only one input on the same page
- How to open the add media dialogue it in a certain state / tab?
- Removing auto versioning of JS and loading to header
- How WP does Mortgage affordability calculation
- Putting custom html/js page into Elementor as it’s own block
- Drag-to-Scroll Landingpage
- Easiest way to find JS conflicts
- Update block once an API request returns with a value
- XMLHttpRequest of admin data to public
- How do I add a class to Customizer preview based on class of Customizer control? (Customizer Javascript API)
- WordPress 4.2 mce-views migration guide?
- Loaded JavaScript file not showing [duplicate]
- PHP or JS for header image rotator?
- Passing object to FormTokenField suggestions
- How to Update a variable even if the web page reloads in js
- How do i get an Inline style in Gutenberg Block show up in front end?