What you’re asking for is impossible, there is no such thing as a safe javascript entry box.
Even if we strip out extra script and style tags, it’s pointless, as the javascript code itself is inherently dangerous, and can create any elements it wants using DOM construction, e.g.:
var s = jQuery( 'script', { 'src': 'example.com/dangerous.js' } );
jQuery('body').append( s );
Or
var s = jQuery( 'link', {
'rel': 'stylesheet',
'type': 'text/css',
'href': 'example.com/broken.css'
} );
jQuery('body').append( s );
Nevermind something that steals your login cookies, etc. Javascript is inherently dangerous, and what you’re trying to implement is an attack vector. This isn’t because people might break out of javascript, but because the javascript itself is potentially dangerous
Related Posts:
- Should I sanitize an email address before passing it to the is_email() function?
- Escaping and sanitizing SVGs in metabox textarea
- What is the difference between wp_strip_all_tags and wp_filter_nohtml_kses?
- Reason for Lowercase usernames
- What is the best way to sanitize data?
- Should nonce be sanitized?
- esc_url removes white space. Can I change that to using ‘-‘?
- WP Coding standards – escaping the inescapable?
- Sanitatizing when using the posts_where hook
- Escape hexadecimals/rgba values
- Must I serialize/sanitize/escape array data before using set_transient?
- wp_kses ignore allowed and allow everything
- Sanitize array callback for the WordPress Settings API
- How to escape $_GET and check if isset?
- What’s a safe / good way to output HTML safely within WordPress templates?
- Do Not Understand → Rule No. 4: Making Data Safe Is About Context [closed]
- Sanitizing output that contains quotes?
- WP_Customize_Manager: How to get control ID
- How to use wp_filter_oembed_result?
- Sanitization html output itself
- Post text sanitization after publishing/editing – changes are not saved
- wp_set_object_terms() without accents
- Escaping data from database (users table) is necessary?
- Properly sanitize an input field “Name “
- How safe / sanitized is wp_insert_posts()?
- What’s the difference between esc_* functions?
- Sanitizing integer input for update_post_meta
- Which KSES should be used and when?
- Is sanitize_text_field() is enough to save to DB?
- Escaping quotes from shortcode attributes
- How to sanitize select box values in post meta?
- WP doesn’t show Array Custom Fields?
- Do Cookies Need to be Sanatized Before Being Saved?
- What is the difference between strip_tags and wp_filter_nohtml_kses?
- Sanitizing post content for use in an email
- How to get input_attrs in the sanitize function?
- What is the difference between sanitize_text_field() and wp_filter_nohtml_kses()?
- I’m confused about URL sanitization in meta boxes
- Coding a plugin on WordPress; when should I sanitize? [duplicate]
- where to apply “apply filters” and other Sanitization Functions
- How to save html and text in the database?
- Multiple register settings, with same option name – issue
- Is default functions like update_post_meta safe to use user inputs?
- vs WordPress Security
- Who is responsible for data sanitization in WordPress development?
- How to sanitize user input?
- Change filename during upload
- How to sanitize my cookie name
- Do We Need to Validate, Sanitize, or Filter Simple Numerical Superglobals (Cookies and Post)?
- wpdb get_results() and prepare when to use prepare?
- WordPress Settings API – Sanitize Integer
- Preserve old values on error in setting API
- WP_Editor – Saving Value into Plugin Option – Stripping HTML
- CSS from textarea in options page to frontend what to do
- How to get rid of shortcodes in post content once and for all
- Is it sensible to worry about sanitizing admin input in plugin custom CSS?
- What is the safe way to print tracking code / pixel code before tag or tag
- How to use sanitize_callback?
- Unable to sanitize in customizer and escape in theme without removing ability for user to use “< br >” to insert a line break
- Are all hooks/functions tied to Kses meant for sanitization?
- sanitize_text_field and apostrophe problem
- Getting error to display radio button value in General Settings page
- Escaping date string in url with wordpress
- WordPress messes up with data attributes in shortcode output
- Does meta-data need to be sanitized?
- textarea field is getting escaped for some unknown reason
- Can A Post Meta Field Store multiple values that are not in an array?
- esc_attr on get_post_meta [closed]
- Do we need to escape data that we receive from theme options?
- Input sanitation
- Sanitize user input fields before wp_insert_post
- How WordPress sanitizes post content on save? Or it doesn’t?
- Function sanitize_title() does not appear to be working
- Restrict characters in comment section
- Toggle Shortcode Sanitize Title
- How to use checked() function with multiple check box group? How to properly sanitize that checkbox group?
- Sanitizing URL in a WordPress plugin
- How to allow arbitrary inline CSS in posts?
- how to sanitize customizer checkbox control
- Trouble matching strings (titles) using wp_query
- Sanitize WordPress Array Input?
- How to save Checkbox-Options in Plugin Options Page
- Customizer textarea with script tag won’t work in live preview
- do I need to sanitize a shortcode’s function input?
- Data not displaying in text field
- Array/List Edit in Backend
- Escaping and sanitization
- Escaping WP_Query tax_query when term has special character(s)
- Proper Way to Sanitize Meta Input
- Comparing pre-saved post_title to post-saved post_title
- Save selectlist value (taxonomy) in wp:wp_set_object_terms
- Settings api sanatize callback not being triggered
- Auto post with filling templates from external data and update periodical
- Notice: Undefined index: in options-framework.php
- Sanitizing a custom query’s clauses
- Customizer sanitize_callback for input type number
- How to use esc_attr__() function properly to translate a variable that contains string?
- oneOf two possible objects in WP REST API?
- How can I properly sanitize the update_option in WordPress?
- Extend file format support for post thumbnails