Here is a PHP library that was created for sanitizing SVG files that may be worth looking into. https://github.com/darylldoyle/svg-sanitizer
Here is an example of how this could be used:
// Now do what you want with your clean SVG/XML data
function your_save_meta( $post_id, $post, $update ) {
// - Update the post's metadata.
if ( isset( $_POST['svg_meta'] ) ) {
// Load the sanitizer. (This path will need to be updated)
use enshrined\svgSanitize\Sanitizer;
// Create a new sanitizer instance
$sanitizer = new Sanitizer();
// Pass your meta data to the sanitizer and get it back clean
$cleanSVG = $sanitizer->sanitize($_POST['svg_meta']);
// Update your post meta
update_post_meta( $post_id, 'svg_meta_name', $cleanSVG );
}
}
add_action( 'save_post', 'your_save_meta', 10, 3 );
Related Posts:
- Escape hexadecimals/rgba values
- Must I serialize/sanitize/escape array data before using set_transient?
- How to use wp_filter_oembed_result?
- Escaping data from database (users table) is necessary?
- Should I sanitize an email address before passing it to the is_email() function?
- Should HTML output be passed through esc_html() AND wp_kses()?
- Sanitize and data validation with apply_filters() function
- What is the difference between wp_strip_all_tags and wp_filter_nohtml_kses?
- What’s the difference between esc_* functions?
- Reason for Lowercase usernames
- What is the best way to sanitize data?
- How to escape custom css?
- Escaping WP_Query tax_query when term has special character(s)
- Should nonce be sanitized?
- esc_url removes white space. Can I change that to using ‘-‘?
- WP Coding standards – escaping the inescapable?
- Sanitatizing when using the posts_where hook
- why is esc_html() returning nothing given a string containing a high-bit character?
- Sanitizing comments or escaping comment_text()
- Sanitizing, Validating and Escaping in WordPress (Plugin)
- How Could I sanitize the receive data from this code
- Echo JavaScript Safely
- How to sanitize user input?
- Which escape function to use when escaping an email or plain text?
- WP_Editor – Saving Value into Plugin Option – Stripping HTML
- wp_kses ignore allowed and allow everything
- Sanitize array callback for the WordPress Settings API
- What is the safe way to print tracking code / pixel code before tag or tag
- How to escape $_GET and check if isset?
- How to escape html generate by a loop
- What’s a safe / good way to output HTML safely within WordPress templates?
- Do Not Understand → Rule No. 4: Making Data Safe Is About Context [closed]
- Sanitizing output that contains quotes?
- Do we need to escape data that we receive from theme options?
- WP_Customize_Manager: How to get control ID
- Escaping WP_Query tax_query when term has special character(s)
- Escaping and sanitization
- Escaping WP_Query tax_query when term has special character(s)
- Sanitization html output itself
- Post text sanitization after publishing/editing – changes are not saved
- wp_set_object_terms() without accents
- esc_url, esc_url_raw or sanitize_url?
- Properly sanitize an input field “Name “
- how to sanitizing $_POST with the correct way?
- What is the proper way to sanitize $_POST and $_GET vars?
- WooCommerce custom SVG coloring tool [closed]
- Why is sanitize_text_field() selectively trimming data?
- What are all the escape characters?
- Which characters need to be escaped when using Bash?
- what is a good method to sanitize the whole $_POST array in php?
- How to escape apostrophe (‘) in MySql?
- How to safely sanitize a textarea which takes full HTML input
- Can’t extract and set SVG dimensions
- Escaping quotes from shortcode attributes
- esc_attr / esc_html / esc_url in echos
- Do Cookies Need to be Sanatized Before Being Saved?
- Do you need to escape hard coded plain text?
- What is the difference between strip_tags and wp_filter_nohtml_kses?
- Adding extra SVGs to TwentyNineteen child theme using class TwentyNineteen_SVG_Icons
- Allowing SVG uploads in media uploader without plug-in
- When outputting a static string to the page, is it necessary to escape the output?
- I’m confused about URL sanitization in meta boxes
- Is default functions like update_post_meta safe to use user inputs?
- Who is responsible for data sanitization in WordPress development?
- Escape post image attachments added to template
- How to sanitize my cookie name
- MITM risk of not sanitizing?
- Base64 & JSON Encode array in PHP, use as HTML data attribute, decode and parse in JavaScript …. with proper Escaping
- How to get my post title to work with an apostrophe (‘s)?
- Is wp_kses the right approach in sanitizing this string?
- Seeking clarity on data sanitization fields for settings textarea
- Are all hooks/functions tied to Kses meant for sanitization?
- Why the WP Core team does not allow filter_* functions? [closed]
- data-type=”” … needed post tags stripped of characters
- wordpress is adding a second backslash when I use addslashes
- confused about sanitize_email after is_email [duplicate]
- HTML escaping data with ajax requests
- Invalidate username if it contains @ symbol
- Contact Form Security
- How to safely escape data that contains HTML attributes
- Change user nicename without sanitize
- How to allow single quote with esc_html__() without sprintf()
- HTML in category name
- Wrapping add_query_arg with esc_url not working
- wordpress post not showing my “” text>?
- Do I need to sanitize $_POST[‘keyword’] before send to ‘s’ parameter?
- Whitelist a single SVG for use in post_content
- Completely remove SVG icon load in child theme of Twenty Twenty-one theme
- SVG Upload to WordPress Issue
- import svg-files from wxr – (upload works, import not)
- site_url() returns with additional backslashes
- Trouble creating custom sanitization function when uploading video files
- Sanitize and Save metabox values
- Why are some SVG-images not visible in my footer?
- SVG showing only in square ratio (using elementor) [closed]
- Does it make sense to sanitize the output of an SVG file?
- how to escape alert/window.location.replace with variable
- What is best practice when escaping the_title()?
- If necessary, how should wp_get_attachment_image() and its parameters be escaped?
- Is it necessary to use escape functions on everything or is it only necessary if you’re taking input from a 3rd party? (End Users, APIs, Etc.)