Question

wp_kses_one_attr( string $string,  string $element )

Filters one attribute only and ensures its value is allowed.

---

description

This function has the advantage of being more secure than esc_attr() and can escape data in some situations where wp_kses() must strip the whole attribute.

---

参数

$string

(string) (Required) The 'whole' attribute, including name and value.

$element

(string) (Required) The element name to which the attribute belongs.

---

返回值

(string) Filtered attribute.

---

源代码

File: wp-includes/kses.php

function wp_kses_one_attr( $string, $element ) {
	$uris = array('xmlns', 'profile', 'href', 'src', 'code', 'classid', 'codebase', 'data', 'usemap', 'longdesc', 'action');
	$allowed_html = wp_kses_allowed_html( 'post' );
	$allowed_protocols = wp_allowed_protocols();
	$string = wp_kses_no_null( $string, array( 'slash_zero' => 'keep' ) );
	
	// Preserve leading and trailing whitespace.
	$matches = array();
	preg_match('/^\s*/', $string, $matches);
	$lead = $matches[0];
	preg_match('/\s*$/', $string, $matches);
	$trail = $matches[0];
	if ( empty( $trail ) ) {
		$string = substr( $string, strlen( $lead ) );
	} else {
		$string = substr( $string, strlen( $lead ), -strlen( $trail ) );
	}
	
	// Parse attribute name and value from input.
	$split = preg_split( '/\s*=\s*/', $string, 2 );
	$name = $split[0];
	if ( count( $split ) == 2 ) {
		$value = $split[1];

		// Remove quotes surrounding $value.
		// Also guarantee correct quoting in $string for this one attribute.
		if ( '' == $value ) {
			$quote = '';
		} else {
			$quote = $value[0];
		}
		if ( '"' == $quote || "'" == $quote ) {
			if ( substr( $value, -1 ) != $quote ) {
				return '';
			}
			$value = substr( $value, 1, -1 );
		} else {
			$quote = '"';
		}

		// Sanitize quotes, angle braces, and entities.
		$value = esc_attr( $value );

		// Sanitize URI values.
		if ( in_array( strtolower( $name ), $uris ) ) {
			$value = wp_kses_bad_protocol( $value, $allowed_protocols );
		}

		$string = "$name=$quote$value$quote";
		$vless = 'n';
	} else {
		$value = '';
		$vless = 'y';
	}
	
	// Sanitize attribute by name.
	wp_kses_attr_check( $name, $value, $string, $vless, $element, $allowed_html );

	// Restore whitespace.
	return $lead . $string . $trail;
}

---

更新日志

Version	description
4.2.3	Introduced.

---

相关函数

Uses

• wp-includes/kses.php: wp_kses_attr_check()
• wp-includes/formatting.php: esc_attr()
• wp-includes/kses.php: wp_kses_no_null()
• wp-includes/kses.php: wp_kses_bad_protocol()
• wp-includes/kses.php: wp_kses_allowed_html()
• wp-includes/functions.php: wp_allowed_protocols()
Show 1 more use Hide more uses

---

Used By

• wp-includes/shortcodes.php: do_shortcodes_in_html_tags()

---

User Contributed Notes