wp-includes/customize/class-wp-customize-custom-css-setting.php:160Validate a received value for being valid CSS.
$valuestringtrue|WP_Error public function validate( $value ) { // Restores the more descriptive, specific name for use within this method. $css = $value; $validity = new WP_Error(); if ( preg_match( '#</?\w+#', $css ) ) { $validity->add( 'illegal_markup', __( 'Markup is not allowed in CSS.' ) ); } if ( ! $validity->has_errors() ) { $validity = parent::validate( $css ); } return $validity; }Introduced in 4.7.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/customize/class-wp-customize-custom-css-setting.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.