wp_kses_hair( string $attr, string[] $allowed_protocols ): array[]

Description

Parameters

$attrstring

Attribute list from HTML element to closing HTML element tag.

$allowed_protocolsstring[]

Array of allowed URL protocols.

Return

array[]

Array of attribute information after parsing.

Uses · 3

• wp_kses_uri_attributes()Returns an array of HTML attribute names whose value contains a URL.
• wp_kses_bad_protocol()Sanitizes a string and removed disallowed URL protocols.
• wp_kses_html_error()Handles parsing errors in `wp_kses_hair()`.

Used by · 4

• wp_filter_oembed_iframe_title_attribute()Filters the given oEmbed HTML to make sure iframes have a title attribute.
• wp_kses_attr()Removes all attributes, if none are allowed for this element.
• wp_rel_callback()Callback to add a rel attribute to HTML A element.
• wp_targeted_link_rel_callback()Callback to add `rel="noopener"` string to HTML A element.

Source

View on Trac ↗View on GitHub ↗

1393function wp_kses_hair( $attr, $allowed_protocols ) {1394	$attrarr  = array();1395	$mode     = 0;1396	$attrname = '';1397	$uris     = wp_kses_uri_attributes();1398 1399	// Loop through the whole attribute list.1400 1401	while ( strlen( $attr ) !== 0 ) {1402		$working = 0; // Was the last operation successful?1403 1404		switch ( $mode ) {1405			case 0:1406				if ( preg_match( '/^([_a-zA-Z][-_a-zA-Z0-9:.]*)/', $attr, $match ) ) {1407					$attrname = $match[1];1408					$working  = 1;1409					$mode     = 1;1410					$attr     = preg_replace( '/^[_a-zA-Z][-_a-zA-Z0-9:.]*/', '', $attr );1411				}1412 1413				break;1414 1415			case 1:1416				if ( preg_match( '/^\s*=\s*/', $attr ) ) { // Equals sign.1417					$working = 1;1418					$mode    = 2;1419					$attr    = preg_replace( '/^\s*=\s*/', '', $attr );1420					break;1421				}1422 1423				if ( preg_match( '/^\s+/', $attr ) ) { // Valueless.1424					$working = 1;1425					$mode    = 0;1426 1427					if ( false === array_key_exists( $attrname, $attrarr ) ) {1428						$attrarr[ $attrname ] = array(1429							'name'  => $attrname,1430							'value' => '',1431							'whole' => $attrname,1432							'vless' => 'y',1433						);1434					}1435 1436					$attr = preg_replace( '/^\s+/', '', $attr );1437				}1438 1439				break;1440 1441			case 2:1442				if ( preg_match( '%^"([^"]*)"(\s+|/?$)%', $attr, $match ) ) {1443					// "value"1444					$thisval = $match[1];1445					if ( in_array( strtolower( $attrname ), $uris, true ) ) {1446						$thisval = wp_kses_bad_protocol( $thisval, $allowed_protocols );1447					}1448 1449					if ( false === array_key_exists( $attrname, $attrarr ) ) {1450						$attrarr[ $attrname ] = array(1451							'name'  => $attrname,1452							'value' => $thisval,1453							'whole' => "$attrname=\"$thisval\"",1454							'vless' => 'n',1455						);1456					}1457 1458					$working = 1;1459					$mode    = 0;1460					$attr    = preg_replace( '/^"[^"]*"(\s+|$)/', '', $attr );1461					break;1462				}1463 1464				if ( preg_match( "%^'([^']*)'(\s+|/?$)%", $attr, $match ) ) {1465					// 'value'1466					$thisval = $match[1];1467					if ( in_array( strtolower( $attrname ), $uris, true ) ) {1468						$thisval = wp_kses_bad_protocol( $thisval, $allowed_protocols );1469					}1470 1471					if ( false === array_key_exists( $attrname, $attrarr ) ) {1472						$attrarr[ $attrname ] = array(

History

Introduced in 1.0.0. One change between 6.7.7 and 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 6.8.8 tag, from src/wp-includes/kses.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.