Which KSES should be used and when?

From the codex:

wp_filter_kses should generally be
preferred over wp_kses_data because
wp_magic_quotes escapes $_GET, $_POST,
$_COOKIE, $_SERVER, and $_REQUEST
fairly early in the hook system,
shortly after ‘plugins_loaded’ but
earlier then ‘init’ or ‘wp_loaded’.

The first set is then preferred. More of a question of, “is stripping slashes more secure than not?” They both use the same allowed HTML. Well yeah it depends, in absolute cases, but I would assume that it is more secure to than not to.

Basic useage of kses:

$filtered = wp_kses($unfiltered, $allowed_html, $allowed_protocols);

All of the wordpress kses functions then just do

$filtered = wp_kses($unfiltered, $allowedtags);

SO:

$filtered = wp_kses_data($unfiltered);
$filtered = wp_filter_kses($unfiltered); // does the same, but will also slash escape the data

the post variations use a different set of tags; those allowed for use by non-admins.

Leave a Comment