Why escape if the_content isnt?2019 Community Moderator ElectionShould I escape wordpress functions like the_title, the_excerpt, the_contentWhy does WordPress change a file's permissions?Do we need to escape data that we receive from theme options?Why are xmlrpc.php and wp-cron.php being called so often?How to escape custom css?Why should I use the esc_url?Why does WordPress have more than one salt?Do you need to escape hard coded plain text?How to escape multiple attribute at once in WordPress?Do I need to escape get_the_post_thumbnail function?

Why was the small council so happy for Tyrion to become the Master of Coin?

"which" command doesn't work / path of Safari?

Can an x86 CPU running in real mode be considered to be basically an 8086 CPU?

Is there a familial term for apples and pears?

Why can't I see bouncing of a switch on an oscilloscope?

Can I interfere when another PC is about to be attacked?

Why Is Death Allowed In the Matrix?

What are these boxed doors outside store fronts in New York?

Schwarzchild Radius of the Universe

least quadratic residue under GRH: an EXPLICIT bound

How old can references or sources in a thesis be?

Are there any consumables that function as addictive (psychedelic) drugs?

Why is this code 6.5x slower with optimizations enabled?

A Journey Through Space and Time

Why is the design of haulage companies so “special”?

A function which translates a sentence to title-case

I’m planning on buying a laser printer but concerned about the life cycle of toner in the machine

Are tax years 2016 & 2017 back taxes deductible for tax year 2018?

Should I join office cleaning event for free?

Is Social Media Science Fiction?

whey we use polarized capacitor?

XeLaTeX and pdfLaTeX ignore hyphenation

Accidentally leaked the solution to an assignment, what to do now? (I'm the prof)

Download, install and reboot computer at night if needed



Why escape if the_content isnt?



2019 Community Moderator ElectionShould I escape wordpress functions like the_title, the_excerpt, the_contentWhy does WordPress change a file's permissions?Do we need to escape data that we receive from theme options?Why are xmlrpc.php and wp-cron.php being called so often?How to escape custom css?Why should I use the esc_url?Why does WordPress have more than one salt?Do you need to escape hard coded plain text?How to escape multiple attribute at once in WordPress?Do I need to escape get_the_post_thumbnail function?



.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;








5















The built in function the_content runs through several filters, but does not escape output. It would be difficult for it to do so, as HTML and even some scripts must be allowed through.



When outputting, the_content seems to run through these filters (as of 5.0):



add_filter( 'the_content', 'do_blocks', 9 );
add_filter( 'the_content', 'wptexturize' );
add_filter( 'the_content', 'convert_smilies', 20 );
add_filter( 'the_content', 'wpautop' );
add_filter( 'the_content', 'shortcode_unautop' );
add_filter( 'the_content', 'prepend_attachment' );
add_filter( 'the_content', 'wp_make_content_images_responsive' );

(and)

add_filter( 'the_content', 'capital_P_dangit' );
add_filter( 'the_content', 'do_shortcode' );


It also does a simple string replace:



$content = str_replace( ']]>', ']]>', $content );



And then get_the_content does a tiny bit of processing related to the "more" link and a bug with foreign languages.



None of those prevent XSS script injection, right?



When saving, the data is sanitized through wp_kses_post. But as this is an expensive process, I understand why it's not used on output.



The rule of thumb for WordPress escaping is that everything needs to be escaped, regardless of input sanitation, and as lately as possible. I've read several articles saying this, because the database is not to be considered a trusted source.



But for the reasons above, the_content doesn't follow that. Nor do the core themes (i.e. TwentyNineteen) add additional escaping on output.



So...why is it helping anything to escape elsewhere? If I were a hacker with access to the database, wouldn't I just add my code to a post's content?










share|improve this question
























  • You forgot wp_kses_post

    – Tom J Nowell
    Mar 27 at 15:20











  • It runs through wp_kses_post on output? Where?

    – tmdesigned
    Mar 27 at 15:38

















5















The built in function the_content runs through several filters, but does not escape output. It would be difficult for it to do so, as HTML and even some scripts must be allowed through.



When outputting, the_content seems to run through these filters (as of 5.0):



add_filter( 'the_content', 'do_blocks', 9 );
add_filter( 'the_content', 'wptexturize' );
add_filter( 'the_content', 'convert_smilies', 20 );
add_filter( 'the_content', 'wpautop' );
add_filter( 'the_content', 'shortcode_unautop' );
add_filter( 'the_content', 'prepend_attachment' );
add_filter( 'the_content', 'wp_make_content_images_responsive' );

(and)

add_filter( 'the_content', 'capital_P_dangit' );
add_filter( 'the_content', 'do_shortcode' );


It also does a simple string replace:



$content = str_replace( ']]>', ']]>', $content );



And then get_the_content does a tiny bit of processing related to the "more" link and a bug with foreign languages.



None of those prevent XSS script injection, right?



When saving, the data is sanitized through wp_kses_post. But as this is an expensive process, I understand why it's not used on output.



The rule of thumb for WordPress escaping is that everything needs to be escaped, regardless of input sanitation, and as lately as possible. I've read several articles saying this, because the database is not to be considered a trusted source.



But for the reasons above, the_content doesn't follow that. Nor do the core themes (i.e. TwentyNineteen) add additional escaping on output.



So...why is it helping anything to escape elsewhere? If I were a hacker with access to the database, wouldn't I just add my code to a post's content?










share|improve this question
























  • You forgot wp_kses_post

    – Tom J Nowell
    Mar 27 at 15:20











  • It runs through wp_kses_post on output? Where?

    – tmdesigned
    Mar 27 at 15:38













5












5








5


3






The built in function the_content runs through several filters, but does not escape output. It would be difficult for it to do so, as HTML and even some scripts must be allowed through.



When outputting, the_content seems to run through these filters (as of 5.0):



add_filter( 'the_content', 'do_blocks', 9 );
add_filter( 'the_content', 'wptexturize' );
add_filter( 'the_content', 'convert_smilies', 20 );
add_filter( 'the_content', 'wpautop' );
add_filter( 'the_content', 'shortcode_unautop' );
add_filter( 'the_content', 'prepend_attachment' );
add_filter( 'the_content', 'wp_make_content_images_responsive' );

(and)

add_filter( 'the_content', 'capital_P_dangit' );
add_filter( 'the_content', 'do_shortcode' );


It also does a simple string replace:



$content = str_replace( ']]>', ']]>', $content );



And then get_the_content does a tiny bit of processing related to the "more" link and a bug with foreign languages.



None of those prevent XSS script injection, right?



When saving, the data is sanitized through wp_kses_post. But as this is an expensive process, I understand why it's not used on output.



The rule of thumb for WordPress escaping is that everything needs to be escaped, regardless of input sanitation, and as lately as possible. I've read several articles saying this, because the database is not to be considered a trusted source.



But for the reasons above, the_content doesn't follow that. Nor do the core themes (i.e. TwentyNineteen) add additional escaping on output.



So...why is it helping anything to escape elsewhere? If I were a hacker with access to the database, wouldn't I just add my code to a post's content?










share|improve this question
















The built in function the_content runs through several filters, but does not escape output. It would be difficult for it to do so, as HTML and even some scripts must be allowed through.



When outputting, the_content seems to run through these filters (as of 5.0):



add_filter( 'the_content', 'do_blocks', 9 );
add_filter( 'the_content', 'wptexturize' );
add_filter( 'the_content', 'convert_smilies', 20 );
add_filter( 'the_content', 'wpautop' );
add_filter( 'the_content', 'shortcode_unautop' );
add_filter( 'the_content', 'prepend_attachment' );
add_filter( 'the_content', 'wp_make_content_images_responsive' );

(and)

add_filter( 'the_content', 'capital_P_dangit' );
add_filter( 'the_content', 'do_shortcode' );


It also does a simple string replace:



$content = str_replace( ']]>', ']]>', $content );



And then get_the_content does a tiny bit of processing related to the "more" link and a bug with foreign languages.



None of those prevent XSS script injection, right?



When saving, the data is sanitized through wp_kses_post. But as this is an expensive process, I understand why it's not used on output.



The rule of thumb for WordPress escaping is that everything needs to be escaped, regardless of input sanitation, and as lately as possible. I've read several articles saying this, because the database is not to be considered a trusted source.



But for the reasons above, the_content doesn't follow that. Nor do the core themes (i.e. TwentyNineteen) add additional escaping on output.



So...why is it helping anything to escape elsewhere? If I were a hacker with access to the database, wouldn't I just add my code to a post's content?







security






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Mar 27 at 12:50







tmdesigned

















asked Mar 27 at 12:44









tmdesignedtmdesigned

1,2991913




1,2991913












  • You forgot wp_kses_post

    – Tom J Nowell
    Mar 27 at 15:20











  • It runs through wp_kses_post on output? Where?

    – tmdesigned
    Mar 27 at 15:38

















  • You forgot wp_kses_post

    – Tom J Nowell
    Mar 27 at 15:20











  • It runs through wp_kses_post on output? Where?

    – tmdesigned
    Mar 27 at 15:38
















You forgot wp_kses_post

– Tom J Nowell
Mar 27 at 15:20





You forgot wp_kses_post

– Tom J Nowell
Mar 27 at 15:20













It runs through wp_kses_post on output? Where?

– tmdesigned
Mar 27 at 15:38





It runs through wp_kses_post on output? Where?

– tmdesigned
Mar 27 at 15:38










4 Answers
4






active

oldest

votes


















6















If I were a hacker with access to the database, wouldn't I just add my
code to a post's content?




If you've got access to the database, chances are that you've got enough access that escaping isn't going to stop you. Escaping is not going to help you if you've been hacked. It's not supposed to. There's other reasons to escape. The two main ones that I can think of are:



To deal with unsanitized input



WordPress post content is sanitized when it's saved, but not everything else is. Content passed via a query string in the URL isn't sanitized, for example. Neither is content in translation files, necessarily. Both those are sources of content that have nothing to do with the site being compromised. So translatable text and content pulled from the URL need to be escaped.



To prevent users accidentally breaking markup



Escaping isn't just for security. You also need it to prevent users accidentally breaking their site's markup. For example, if the user placing quotes or > symbols in some content in your plugin would break the markup, then you should escape that output. You don't want to be over-aggressive in sanitising on input, because there's perfectly valid reasons a user might want to use those characters.





“Escaping isn’t only about protecting from bad guys. It’s just making
our software durable. Against random bad input, against malicious
input, or against bad weather.”




That's from the WordPress VIP guidelines on escaping. It has a lot more to say on this matter, and you should give it a read.






share|improve this answer























  • Thank you, that is helpful. I had read a post on VIP about escaping and the author specifically mentioned the idea of someone having gained access to the DB but not the server. However I think your reasoning on that point makes more sense. And, I suppose, sometimes you are escaping vulnerable content from the database even without someone having had complete access to the database, i.e. via a plugin or even just a comment.

    – tmdesigned
    Mar 27 at 13:22


















5














I'm actually an engineer at VIP who does a lot of code review :) I flag a lot of missing escaping.




but does not escape output




Not quite, it doesn't escape on output, which is surprising to most people. This is because if you're a super admin you have the unfiltered_html capability, so it can't escape on output. Instead it runs it through wp_kses_post on input. Ideally you would remove that capability though.



Here is the implementation at the current time:



function the_content( $more_link_text = null, $strip_teaser = false ) 
$content = get_the_content( $more_link_text, $strip_teaser );

/**
* Filters the post content.
*
* @since 0.71
*
* @param string $content Content of the current post.
*/
$content = apply_filters( 'the_content', $content );
$content = str_replace( ']]>', ']]>', $content );
echo $content;



The ideal mechanism for escaping anything that goes through the_content filter on the other hand is:



echo apply_filters( 'the_content', wp_kses_post( $content ) );


This way we make the content safe, then run it through the filter, avoiding the embeds etc being stripped out.



So Why Escape




The point of escaping is to generate valid HTML, the added security it provides is just a nice side effect.



To prevent users accidentally breaking markup




There are many reasons to escape, but fundamentally, you're enforcing expectations. Take the following code:



<a href="<?=$url?>">


We expect $url to contain a URL suitable for a href attribute, but what if it isn't? Well why leave it to chance, lets enforce it:



<a href="<?=esc_url( $url )?>">


It is now always going to be a URL. It doesn't matter if a hacker puts an image in $url, or if a user types in the wrong field, or there's a malicious script. It will always be a valid URL because we said it's going to be a URL. Sure it might be a very strange URL, but it will always meet the expectation that a URL will be there. This is very handy, be it for markup validation, for security, etc



Having said that, escaping is not validation, escaping is not sanitisation. Those are separate steps that happen at different points in the life cycle. Escaping forces things to meet expectations, even if it mangles them to do so.



Sometimes I like to think of escaping as one of those Japanese gameshows with the giant foam wall with the cut out. Contestants have to fit in the dog shape or they get discarded, only for our purposes there are lasers and knives around the hole. Whatever is left at the end will be dog shaped, and it will be unforgiving and strict if you're not already dog shaped.



Remember:



  • sanitise early

  • validate early

  • escape late

  • escape often

Security is a multiple step, multiple layer onion of defences, escaping is one of the outer layers of defence on output. It can mangle attack code on a compromised site rendering it useless, thwart open exploits, and make sure your client doesn't break a site by putting tags in a field they shouldn't. It's not a substitute for the other things, and it's by far and away the most underused security tool in a developers handbook.



As for why to escape if the_content doesn't? If you have a flood coming, and 5 holes in a wall, but only time to fix 3, do you shrug and fix none? Or do you mitigate the risk and reduce the attack area?



Perhaps I can help fix those final 2 holes with this snippet:



add_filter( 'the_content' function( $content ) 
return wp_kses_post( $content );
, PHP_INT_MAX + 1 );


Here we set the priority to the highest possible number in PHP, then add 1 so it overflows to the lowest possible number that can be represented. This way all calls to the_content will escape the value prior to any other filters. This way embeds etc still work, but users can't sneak in dangerous HTML via the database. Additionally, look into removing the unfiltered_html capability from all roles






share|improve this answer


















  • 1





    Thanks for the additional perspective. I had actually read your post on this subject on your site and had been wondering if you'd have anything to add.

    – tmdesigned
    Mar 27 at 16:30



















2















If I were a hacker with access to the database, wouldn't I just add my code to a post's content?




I think your question answers itself. If you were a hacker with access to the db, then you've already gained the access you require. Escaping output doesn't change that at all.



The reason for escaping output is evaluating untrusted data to avoid the hacker gaining that access in the first place.






share|improve this answer























  • Thanks for your answer. I think I became too focused on the idea of preventing a hacker that I missed the forest for the trees.

    – tmdesigned
    Mar 27 at 13:24


















2














The point of escaping is to generate valid HTML, the added security it provides is just a nice side effect.



The filters applied on the content, generate a valid HTML from something that is a mix of HTML and some other text which have some other syntax like shortcodes. The fact that some of the content is already valid HTML prevents applying escaping on all of it.



As for kses related functions, you can not apply them mainly because you do not have enough context to know which one to use. For example, there might be some process which uses the the_content filter to add JS to the post content therefor core can not guess based on things like the post author if the JS is legit or not.




So...why is it helping anything to escape elsewhere? If I were a hacker with access to the database, wouldn't I just add my code to a post's content?




Again, escaping is for generating valid HTML. From a security POV it is not that escaping provides security but that a code which lucks escaping should be suspicious as it might be easier to exploit.
For example, the way core uses _e and '__` for translations means that anyone that can convince you to install a non-official translation might be able to add hard to detect JS in the translation file and hack your site.
This is a good example of "do what I say and not what I do".






share|improve this answer























  • Thanks, Mark, for the additional perspective.

    – tmdesigned
    Mar 27 at 17:13











Your Answer








StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "110"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













draft saved

draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fwordpress.stackexchange.com%2fquestions%2f332740%2fwhy-escape-if-the-content-isnt%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























4 Answers
4






active

oldest

votes








4 Answers
4






active

oldest

votes









active

oldest

votes






active

oldest

votes









6















If I were a hacker with access to the database, wouldn't I just add my
code to a post's content?




If you've got access to the database, chances are that you've got enough access that escaping isn't going to stop you. Escaping is not going to help you if you've been hacked. It's not supposed to. There's other reasons to escape. The two main ones that I can think of are:



To deal with unsanitized input



WordPress post content is sanitized when it's saved, but not everything else is. Content passed via a query string in the URL isn't sanitized, for example. Neither is content in translation files, necessarily. Both those are sources of content that have nothing to do with the site being compromised. So translatable text and content pulled from the URL need to be escaped.



To prevent users accidentally breaking markup



Escaping isn't just for security. You also need it to prevent users accidentally breaking their site's markup. For example, if the user placing quotes or > symbols in some content in your plugin would break the markup, then you should escape that output. You don't want to be over-aggressive in sanitising on input, because there's perfectly valid reasons a user might want to use those characters.





“Escaping isn’t only about protecting from bad guys. It’s just making
our software durable. Against random bad input, against malicious
input, or against bad weather.”




That's from the WordPress VIP guidelines on escaping. It has a lot more to say on this matter, and you should give it a read.






share|improve this answer























  • Thank you, that is helpful. I had read a post on VIP about escaping and the author specifically mentioned the idea of someone having gained access to the DB but not the server. However I think your reasoning on that point makes more sense. And, I suppose, sometimes you are escaping vulnerable content from the database even without someone having had complete access to the database, i.e. via a plugin or even just a comment.

    – tmdesigned
    Mar 27 at 13:22















6















If I were a hacker with access to the database, wouldn't I just add my
code to a post's content?




If you've got access to the database, chances are that you've got enough access that escaping isn't going to stop you. Escaping is not going to help you if you've been hacked. It's not supposed to. There's other reasons to escape. The two main ones that I can think of are:



To deal with unsanitized input



WordPress post content is sanitized when it's saved, but not everything else is. Content passed via a query string in the URL isn't sanitized, for example. Neither is content in translation files, necessarily. Both those are sources of content that have nothing to do with the site being compromised. So translatable text and content pulled from the URL need to be escaped.



To prevent users accidentally breaking markup



Escaping isn't just for security. You also need it to prevent users accidentally breaking their site's markup. For example, if the user placing quotes or > symbols in some content in your plugin would break the markup, then you should escape that output. You don't want to be over-aggressive in sanitising on input, because there's perfectly valid reasons a user might want to use those characters.





“Escaping isn’t only about protecting from bad guys. It’s just making
our software durable. Against random bad input, against malicious
input, or against bad weather.”




That's from the WordPress VIP guidelines on escaping. It has a lot more to say on this matter, and you should give it a read.






share|improve this answer























  • Thank you, that is helpful. I had read a post on VIP about escaping and the author specifically mentioned the idea of someone having gained access to the DB but not the server. However I think your reasoning on that point makes more sense. And, I suppose, sometimes you are escaping vulnerable content from the database even without someone having had complete access to the database, i.e. via a plugin or even just a comment.

    – tmdesigned
    Mar 27 at 13:22













6












6








6








If I were a hacker with access to the database, wouldn't I just add my
code to a post's content?




If you've got access to the database, chances are that you've got enough access that escaping isn't going to stop you. Escaping is not going to help you if you've been hacked. It's not supposed to. There's other reasons to escape. The two main ones that I can think of are:



To deal with unsanitized input



WordPress post content is sanitized when it's saved, but not everything else is. Content passed via a query string in the URL isn't sanitized, for example. Neither is content in translation files, necessarily. Both those are sources of content that have nothing to do with the site being compromised. So translatable text and content pulled from the URL need to be escaped.



To prevent users accidentally breaking markup



Escaping isn't just for security. You also need it to prevent users accidentally breaking their site's markup. For example, if the user placing quotes or > symbols in some content in your plugin would break the markup, then you should escape that output. You don't want to be over-aggressive in sanitising on input, because there's perfectly valid reasons a user might want to use those characters.





“Escaping isn’t only about protecting from bad guys. It’s just making
our software durable. Against random bad input, against malicious
input, or against bad weather.”




That's from the WordPress VIP guidelines on escaping. It has a lot more to say on this matter, and you should give it a read.






share|improve this answer














If I were a hacker with access to the database, wouldn't I just add my
code to a post's content?




If you've got access to the database, chances are that you've got enough access that escaping isn't going to stop you. Escaping is not going to help you if you've been hacked. It's not supposed to. There's other reasons to escape. The two main ones that I can think of are:



To deal with unsanitized input



WordPress post content is sanitized when it's saved, but not everything else is. Content passed via a query string in the URL isn't sanitized, for example. Neither is content in translation files, necessarily. Both those are sources of content that have nothing to do with the site being compromised. So translatable text and content pulled from the URL need to be escaped.



To prevent users accidentally breaking markup



Escaping isn't just for security. You also need it to prevent users accidentally breaking their site's markup. For example, if the user placing quotes or > symbols in some content in your plugin would break the markup, then you should escape that output. You don't want to be over-aggressive in sanitising on input, because there's perfectly valid reasons a user might want to use those characters.





“Escaping isn’t only about protecting from bad guys. It’s just making
our software durable. Against random bad input, against malicious
input, or against bad weather.”




That's from the WordPress VIP guidelines on escaping. It has a lot more to say on this matter, and you should give it a read.







share|improve this answer












share|improve this answer



share|improve this answer










answered Mar 27 at 13:09









Jacob PeattieJacob Peattie

17.8k42031




17.8k42031












  • Thank you, that is helpful. I had read a post on VIP about escaping and the author specifically mentioned the idea of someone having gained access to the DB but not the server. However I think your reasoning on that point makes more sense. And, I suppose, sometimes you are escaping vulnerable content from the database even without someone having had complete access to the database, i.e. via a plugin or even just a comment.

    – tmdesigned
    Mar 27 at 13:22

















  • Thank you, that is helpful. I had read a post on VIP about escaping and the author specifically mentioned the idea of someone having gained access to the DB but not the server. However I think your reasoning on that point makes more sense. And, I suppose, sometimes you are escaping vulnerable content from the database even without someone having had complete access to the database, i.e. via a plugin or even just a comment.

    – tmdesigned
    Mar 27 at 13:22
















Thank you, that is helpful. I had read a post on VIP about escaping and the author specifically mentioned the idea of someone having gained access to the DB but not the server. However I think your reasoning on that point makes more sense. And, I suppose, sometimes you are escaping vulnerable content from the database even without someone having had complete access to the database, i.e. via a plugin or even just a comment.

– tmdesigned
Mar 27 at 13:22





Thank you, that is helpful. I had read a post on VIP about escaping and the author specifically mentioned the idea of someone having gained access to the DB but not the server. However I think your reasoning on that point makes more sense. And, I suppose, sometimes you are escaping vulnerable content from the database even without someone having had complete access to the database, i.e. via a plugin or even just a comment.

– tmdesigned
Mar 27 at 13:22













5














I'm actually an engineer at VIP who does a lot of code review :) I flag a lot of missing escaping.




but does not escape output




Not quite, it doesn't escape on output, which is surprising to most people. This is because if you're a super admin you have the unfiltered_html capability, so it can't escape on output. Instead it runs it through wp_kses_post on input. Ideally you would remove that capability though.



Here is the implementation at the current time:



function the_content( $more_link_text = null, $strip_teaser = false ) 
$content = get_the_content( $more_link_text, $strip_teaser );

/**
* Filters the post content.
*
* @since 0.71
*
* @param string $content Content of the current post.
*/
$content = apply_filters( 'the_content', $content );
$content = str_replace( ']]>', ']]&gt;', $content );
echo $content;



The ideal mechanism for escaping anything that goes through the_content filter on the other hand is:



echo apply_filters( 'the_content', wp_kses_post( $content ) );


This way we make the content safe, then run it through the filter, avoiding the embeds etc being stripped out.



So Why Escape




The point of escaping is to generate valid HTML, the added security it provides is just a nice side effect.



To prevent users accidentally breaking markup




There are many reasons to escape, but fundamentally, you're enforcing expectations. Take the following code:



<a href="<?=$url?>">


We expect $url to contain a URL suitable for a href attribute, but what if it isn't? Well why leave it to chance, lets enforce it:



<a href="<?=esc_url( $url )?>">


It is now always going to be a URL. It doesn't matter if a hacker puts an image in $url, or if a user types in the wrong field, or there's a malicious script. It will always be a valid URL because we said it's going to be a URL. Sure it might be a very strange URL, but it will always meet the expectation that a URL will be there. This is very handy, be it for markup validation, for security, etc



Having said that, escaping is not validation, escaping is not sanitisation. Those are separate steps that happen at different points in the life cycle. Escaping forces things to meet expectations, even if it mangles them to do so.



Sometimes I like to think of escaping as one of those Japanese gameshows with the giant foam wall with the cut out. Contestants have to fit in the dog shape or they get discarded, only for our purposes there are lasers and knives around the hole. Whatever is left at the end will be dog shaped, and it will be unforgiving and strict if you're not already dog shaped.



Remember:



  • sanitise early

  • validate early

  • escape late

  • escape often

Security is a multiple step, multiple layer onion of defences, escaping is one of the outer layers of defence on output. It can mangle attack code on a compromised site rendering it useless, thwart open exploits, and make sure your client doesn't break a site by putting tags in a field they shouldn't. It's not a substitute for the other things, and it's by far and away the most underused security tool in a developers handbook.



As for why to escape if the_content doesn't? If you have a flood coming, and 5 holes in a wall, but only time to fix 3, do you shrug and fix none? Or do you mitigate the risk and reduce the attack area?



Perhaps I can help fix those final 2 holes with this snippet:



add_filter( 'the_content' function( $content ) 
return wp_kses_post( $content );
, PHP_INT_MAX + 1 );


Here we set the priority to the highest possible number in PHP, then add 1 so it overflows to the lowest possible number that can be represented. This way all calls to the_content will escape the value prior to any other filters. This way embeds etc still work, but users can't sneak in dangerous HTML via the database. Additionally, look into removing the unfiltered_html capability from all roles






share|improve this answer


















  • 1





    Thanks for the additional perspective. I had actually read your post on this subject on your site and had been wondering if you'd have anything to add.

    – tmdesigned
    Mar 27 at 16:30
















5














I'm actually an engineer at VIP who does a lot of code review :) I flag a lot of missing escaping.




but does not escape output




Not quite, it doesn't escape on output, which is surprising to most people. This is because if you're a super admin you have the unfiltered_html capability, so it can't escape on output. Instead it runs it through wp_kses_post on input. Ideally you would remove that capability though.



Here is the implementation at the current time:



function the_content( $more_link_text = null, $strip_teaser = false ) 
$content = get_the_content( $more_link_text, $strip_teaser );

/**
* Filters the post content.
*
* @since 0.71
*
* @param string $content Content of the current post.
*/
$content = apply_filters( 'the_content', $content );
$content = str_replace( ']]>', ']]&gt;', $content );
echo $content;



The ideal mechanism for escaping anything that goes through the_content filter on the other hand is:



echo apply_filters( 'the_content', wp_kses_post( $content ) );


This way we make the content safe, then run it through the filter, avoiding the embeds etc being stripped out.



So Why Escape




The point of escaping is to generate valid HTML, the added security it provides is just a nice side effect.



To prevent users accidentally breaking markup




There are many reasons to escape, but fundamentally, you're enforcing expectations. Take the following code:



<a href="<?=$url?>">


We expect $url to contain a URL suitable for a href attribute, but what if it isn't? Well why leave it to chance, lets enforce it:



<a href="<?=esc_url( $url )?>">


It is now always going to be a URL. It doesn't matter if a hacker puts an image in $url, or if a user types in the wrong field, or there's a malicious script. It will always be a valid URL because we said it's going to be a URL. Sure it might be a very strange URL, but it will always meet the expectation that a URL will be there. This is very handy, be it for markup validation, for security, etc



Having said that, escaping is not validation, escaping is not sanitisation. Those are separate steps that happen at different points in the life cycle. Escaping forces things to meet expectations, even if it mangles them to do so.



Sometimes I like to think of escaping as one of those Japanese gameshows with the giant foam wall with the cut out. Contestants have to fit in the dog shape or they get discarded, only for our purposes there are lasers and knives around the hole. Whatever is left at the end will be dog shaped, and it will be unforgiving and strict if you're not already dog shaped.



Remember:



  • sanitise early

  • validate early

  • escape late

  • escape often

Security is a multiple step, multiple layer onion of defences, escaping is one of the outer layers of defence on output. It can mangle attack code on a compromised site rendering it useless, thwart open exploits, and make sure your client doesn't break a site by putting tags in a field they shouldn't. It's not a substitute for the other things, and it's by far and away the most underused security tool in a developers handbook.



As for why to escape if the_content doesn't? If you have a flood coming, and 5 holes in a wall, but only time to fix 3, do you shrug and fix none? Or do you mitigate the risk and reduce the attack area?



Perhaps I can help fix those final 2 holes with this snippet:



add_filter( 'the_content' function( $content ) 
return wp_kses_post( $content );
, PHP_INT_MAX + 1 );


Here we set the priority to the highest possible number in PHP, then add 1 so it overflows to the lowest possible number that can be represented. This way all calls to the_content will escape the value prior to any other filters. This way embeds etc still work, but users can't sneak in dangerous HTML via the database. Additionally, look into removing the unfiltered_html capability from all roles






share|improve this answer


















  • 1





    Thanks for the additional perspective. I had actually read your post on this subject on your site and had been wondering if you'd have anything to add.

    – tmdesigned
    Mar 27 at 16:30














5












5








5







I'm actually an engineer at VIP who does a lot of code review :) I flag a lot of missing escaping.




but does not escape output




Not quite, it doesn't escape on output, which is surprising to most people. This is because if you're a super admin you have the unfiltered_html capability, so it can't escape on output. Instead it runs it through wp_kses_post on input. Ideally you would remove that capability though.



Here is the implementation at the current time:



function the_content( $more_link_text = null, $strip_teaser = false ) 
$content = get_the_content( $more_link_text, $strip_teaser );

/**
* Filters the post content.
*
* @since 0.71
*
* @param string $content Content of the current post.
*/
$content = apply_filters( 'the_content', $content );
$content = str_replace( ']]>', ']]&gt;', $content );
echo $content;



The ideal mechanism for escaping anything that goes through the_content filter on the other hand is:



echo apply_filters( 'the_content', wp_kses_post( $content ) );


This way we make the content safe, then run it through the filter, avoiding the embeds etc being stripped out.



So Why Escape




The point of escaping is to generate valid HTML, the added security it provides is just a nice side effect.



To prevent users accidentally breaking markup




There are many reasons to escape, but fundamentally, you're enforcing expectations. Take the following code:



<a href="<?=$url?>">


We expect $url to contain a URL suitable for a href attribute, but what if it isn't? Well why leave it to chance, lets enforce it:



<a href="<?=esc_url( $url )?>">


It is now always going to be a URL. It doesn't matter if a hacker puts an image in $url, or if a user types in the wrong field, or there's a malicious script. It will always be a valid URL because we said it's going to be a URL. Sure it might be a very strange URL, but it will always meet the expectation that a URL will be there. This is very handy, be it for markup validation, for security, etc



Having said that, escaping is not validation, escaping is not sanitisation. Those are separate steps that happen at different points in the life cycle. Escaping forces things to meet expectations, even if it mangles them to do so.



Sometimes I like to think of escaping as one of those Japanese gameshows with the giant foam wall with the cut out. Contestants have to fit in the dog shape or they get discarded, only for our purposes there are lasers and knives around the hole. Whatever is left at the end will be dog shaped, and it will be unforgiving and strict if you're not already dog shaped.



Remember:



  • sanitise early

  • validate early

  • escape late

  • escape often

Security is a multiple step, multiple layer onion of defences, escaping is one of the outer layers of defence on output. It can mangle attack code on a compromised site rendering it useless, thwart open exploits, and make sure your client doesn't break a site by putting tags in a field they shouldn't. It's not a substitute for the other things, and it's by far and away the most underused security tool in a developers handbook.



As for why to escape if the_content doesn't? If you have a flood coming, and 5 holes in a wall, but only time to fix 3, do you shrug and fix none? Or do you mitigate the risk and reduce the attack area?



Perhaps I can help fix those final 2 holes with this snippet:



add_filter( 'the_content' function( $content ) 
return wp_kses_post( $content );
, PHP_INT_MAX + 1 );


Here we set the priority to the highest possible number in PHP, then add 1 so it overflows to the lowest possible number that can be represented. This way all calls to the_content will escape the value prior to any other filters. This way embeds etc still work, but users can't sneak in dangerous HTML via the database. Additionally, look into removing the unfiltered_html capability from all roles






share|improve this answer













I'm actually an engineer at VIP who does a lot of code review :) I flag a lot of missing escaping.




but does not escape output




Not quite, it doesn't escape on output, which is surprising to most people. This is because if you're a super admin you have the unfiltered_html capability, so it can't escape on output. Instead it runs it through wp_kses_post on input. Ideally you would remove that capability though.



Here is the implementation at the current time:



function the_content( $more_link_text = null, $strip_teaser = false ) 
$content = get_the_content( $more_link_text, $strip_teaser );

/**
* Filters the post content.
*
* @since 0.71
*
* @param string $content Content of the current post.
*/
$content = apply_filters( 'the_content', $content );
$content = str_replace( ']]>', ']]&gt;', $content );
echo $content;



The ideal mechanism for escaping anything that goes through the_content filter on the other hand is:



echo apply_filters( 'the_content', wp_kses_post( $content ) );


This way we make the content safe, then run it through the filter, avoiding the embeds etc being stripped out.



So Why Escape




The point of escaping is to generate valid HTML, the added security it provides is just a nice side effect.



To prevent users accidentally breaking markup




There are many reasons to escape, but fundamentally, you're enforcing expectations. Take the following code:



<a href="<?=$url?>">


We expect $url to contain a URL suitable for a href attribute, but what if it isn't? Well why leave it to chance, lets enforce it:



<a href="<?=esc_url( $url )?>">


It is now always going to be a URL. It doesn't matter if a hacker puts an image in $url, or if a user types in the wrong field, or there's a malicious script. It will always be a valid URL because we said it's going to be a URL. Sure it might be a very strange URL, but it will always meet the expectation that a URL will be there. This is very handy, be it for markup validation, for security, etc



Having said that, escaping is not validation, escaping is not sanitisation. Those are separate steps that happen at different points in the life cycle. Escaping forces things to meet expectations, even if it mangles them to do so.



Sometimes I like to think of escaping as one of those Japanese gameshows with the giant foam wall with the cut out. Contestants have to fit in the dog shape or they get discarded, only for our purposes there are lasers and knives around the hole. Whatever is left at the end will be dog shaped, and it will be unforgiving and strict if you're not already dog shaped.



Remember:



  • sanitise early

  • validate early

  • escape late

  • escape often

Security is a multiple step, multiple layer onion of defences, escaping is one of the outer layers of defence on output. It can mangle attack code on a compromised site rendering it useless, thwart open exploits, and make sure your client doesn't break a site by putting tags in a field they shouldn't. It's not a substitute for the other things, and it's by far and away the most underused security tool in a developers handbook.



As for why to escape if the_content doesn't? If you have a flood coming, and 5 holes in a wall, but only time to fix 3, do you shrug and fix none? Or do you mitigate the risk and reduce the attack area?



Perhaps I can help fix those final 2 holes with this snippet:



add_filter( 'the_content' function( $content ) 
return wp_kses_post( $content );
, PHP_INT_MAX + 1 );


Here we set the priority to the highest possible number in PHP, then add 1 so it overflows to the lowest possible number that can be represented. This way all calls to the_content will escape the value prior to any other filters. This way embeds etc still work, but users can't sneak in dangerous HTML via the database. Additionally, look into removing the unfiltered_html capability from all roles







share|improve this answer












share|improve this answer



share|improve this answer










answered Mar 27 at 15:46









Tom J NowellTom J Nowell

33.2k44799




33.2k44799







  • 1





    Thanks for the additional perspective. I had actually read your post on this subject on your site and had been wondering if you'd have anything to add.

    – tmdesigned
    Mar 27 at 16:30













  • 1





    Thanks for the additional perspective. I had actually read your post on this subject on your site and had been wondering if you'd have anything to add.

    – tmdesigned
    Mar 27 at 16:30








1




1





Thanks for the additional perspective. I had actually read your post on this subject on your site and had been wondering if you'd have anything to add.

– tmdesigned
Mar 27 at 16:30






Thanks for the additional perspective. I had actually read your post on this subject on your site and had been wondering if you'd have anything to add.

– tmdesigned
Mar 27 at 16:30












2















If I were a hacker with access to the database, wouldn't I just add my code to a post's content?




I think your question answers itself. If you were a hacker with access to the db, then you've already gained the access you require. Escaping output doesn't change that at all.



The reason for escaping output is evaluating untrusted data to avoid the hacker gaining that access in the first place.






share|improve this answer























  • Thanks for your answer. I think I became too focused on the idea of preventing a hacker that I missed the forest for the trees.

    – tmdesigned
    Mar 27 at 13:24















2















If I were a hacker with access to the database, wouldn't I just add my code to a post's content?




I think your question answers itself. If you were a hacker with access to the db, then you've already gained the access you require. Escaping output doesn't change that at all.



The reason for escaping output is evaluating untrusted data to avoid the hacker gaining that access in the first place.






share|improve this answer























  • Thanks for your answer. I think I became too focused on the idea of preventing a hacker that I missed the forest for the trees.

    – tmdesigned
    Mar 27 at 13:24













2












2








2








If I were a hacker with access to the database, wouldn't I just add my code to a post's content?




I think your question answers itself. If you were a hacker with access to the db, then you've already gained the access you require. Escaping output doesn't change that at all.



The reason for escaping output is evaluating untrusted data to avoid the hacker gaining that access in the first place.






share|improve this answer














If I were a hacker with access to the database, wouldn't I just add my code to a post's content?




I think your question answers itself. If you were a hacker with access to the db, then you've already gained the access you require. Escaping output doesn't change that at all.



The reason for escaping output is evaluating untrusted data to avoid the hacker gaining that access in the first place.







share|improve this answer












share|improve this answer



share|improve this answer










answered Mar 27 at 13:06









butlerblogbutlerblog

1,96121226




1,96121226












  • Thanks for your answer. I think I became too focused on the idea of preventing a hacker that I missed the forest for the trees.

    – tmdesigned
    Mar 27 at 13:24

















  • Thanks for your answer. I think I became too focused on the idea of preventing a hacker that I missed the forest for the trees.

    – tmdesigned
    Mar 27 at 13:24
















Thanks for your answer. I think I became too focused on the idea of preventing a hacker that I missed the forest for the trees.

– tmdesigned
Mar 27 at 13:24





Thanks for your answer. I think I became too focused on the idea of preventing a hacker that I missed the forest for the trees.

– tmdesigned
Mar 27 at 13:24











2














The point of escaping is to generate valid HTML, the added security it provides is just a nice side effect.



The filters applied on the content, generate a valid HTML from something that is a mix of HTML and some other text which have some other syntax like shortcodes. The fact that some of the content is already valid HTML prevents applying escaping on all of it.



As for kses related functions, you can not apply them mainly because you do not have enough context to know which one to use. For example, there might be some process which uses the the_content filter to add JS to the post content therefor core can not guess based on things like the post author if the JS is legit or not.




So...why is it helping anything to escape elsewhere? If I were a hacker with access to the database, wouldn't I just add my code to a post's content?




Again, escaping is for generating valid HTML. From a security POV it is not that escaping provides security but that a code which lucks escaping should be suspicious as it might be easier to exploit.
For example, the way core uses _e and '__` for translations means that anyone that can convince you to install a non-official translation might be able to add hard to detect JS in the translation file and hack your site.
This is a good example of "do what I say and not what I do".






share|improve this answer























  • Thanks, Mark, for the additional perspective.

    – tmdesigned
    Mar 27 at 17:13















2














The point of escaping is to generate valid HTML, the added security it provides is just a nice side effect.



The filters applied on the content, generate a valid HTML from something that is a mix of HTML and some other text which have some other syntax like shortcodes. The fact that some of the content is already valid HTML prevents applying escaping on all of it.



As for kses related functions, you can not apply them mainly because you do not have enough context to know which one to use. For example, there might be some process which uses the the_content filter to add JS to the post content therefor core can not guess based on things like the post author if the JS is legit or not.




So...why is it helping anything to escape elsewhere? If I were a hacker with access to the database, wouldn't I just add my code to a post's content?




Again, escaping is for generating valid HTML. From a security POV it is not that escaping provides security but that a code which lucks escaping should be suspicious as it might be easier to exploit.
For example, the way core uses _e and '__` for translations means that anyone that can convince you to install a non-official translation might be able to add hard to detect JS in the translation file and hack your site.
This is a good example of "do what I say and not what I do".






share|improve this answer























  • Thanks, Mark, for the additional perspective.

    – tmdesigned
    Mar 27 at 17:13













2












2








2







The point of escaping is to generate valid HTML, the added security it provides is just a nice side effect.



The filters applied on the content, generate a valid HTML from something that is a mix of HTML and some other text which have some other syntax like shortcodes. The fact that some of the content is already valid HTML prevents applying escaping on all of it.



As for kses related functions, you can not apply them mainly because you do not have enough context to know which one to use. For example, there might be some process which uses the the_content filter to add JS to the post content therefor core can not guess based on things like the post author if the JS is legit or not.




So...why is it helping anything to escape elsewhere? If I were a hacker with access to the database, wouldn't I just add my code to a post's content?




Again, escaping is for generating valid HTML. From a security POV it is not that escaping provides security but that a code which lucks escaping should be suspicious as it might be easier to exploit.
For example, the way core uses _e and '__` for translations means that anyone that can convince you to install a non-official translation might be able to add hard to detect JS in the translation file and hack your site.
This is a good example of "do what I say and not what I do".






share|improve this answer













The point of escaping is to generate valid HTML, the added security it provides is just a nice side effect.



The filters applied on the content, generate a valid HTML from something that is a mix of HTML and some other text which have some other syntax like shortcodes. The fact that some of the content is already valid HTML prevents applying escaping on all of it.



As for kses related functions, you can not apply them mainly because you do not have enough context to know which one to use. For example, there might be some process which uses the the_content filter to add JS to the post content therefor core can not guess based on things like the post author if the JS is legit or not.




So...why is it helping anything to escape elsewhere? If I were a hacker with access to the database, wouldn't I just add my code to a post's content?




Again, escaping is for generating valid HTML. From a security POV it is not that escaping provides security but that a code which lucks escaping should be suspicious as it might be easier to exploit.
For example, the way core uses _e and '__` for translations means that anyone that can convince you to install a non-official translation might be able to add hard to detect JS in the translation file and hack your site.
This is a good example of "do what I say and not what I do".







share|improve this answer












share|improve this answer



share|improve this answer










answered Mar 27 at 13:30









Mark KaplunMark Kaplun

20.5k52757




20.5k52757












  • Thanks, Mark, for the additional perspective.

    – tmdesigned
    Mar 27 at 17:13

















  • Thanks, Mark, for the additional perspective.

    – tmdesigned
    Mar 27 at 17:13
















Thanks, Mark, for the additional perspective.

– tmdesigned
Mar 27 at 17:13





Thanks, Mark, for the additional perspective.

– tmdesigned
Mar 27 at 17:13

















draft saved

draft discarded
















































Thanks for contributing an answer to WordPress Development Stack Exchange!


  • Please be sure to answer the question. Provide details and share your research!

But avoid


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fwordpress.stackexchange.com%2fquestions%2f332740%2fwhy-escape-if-the-content-isnt%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







-security

Popular posts from this blog

Frič See also Navigation menuinternal link

Identify plant with long narrow paired leaves and reddish stems Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) Announcing the arrival of Valued Associate #679: Cesar Manara Unicorn Meta Zoo #1: Why another podcast?What is this plant with long sharp leaves? Is it a weed?What is this 3ft high, stalky plant, with mid sized narrow leaves?What is this young shrub with opposite ovate, crenate leaves and reddish stems?What is this plant with large broad serrated leaves?Identify this upright branching weed with long leaves and reddish stemsPlease help me identify this bulbous plant with long, broad leaves and white flowersWhat is this small annual with narrow gray/green leaves and rust colored daisy-type flowers?What is this chilli plant?Does anyone know what type of chilli plant this is?Help identify this plant

fontconfig warning: “/etc/fonts/fonts.conf”, line 100: unknown “element blank” The 2019 Stack Overflow Developer Survey Results Are In“tar: unrecognized option --warning” during 'apt-get install'How to fix Fontconfig errorHow do I figure out which font file is chosen for a system generic font alias?Why are some apt-get-installed fonts being ignored by fc-list, xfontsel, etc?Reload settings in /etc/fonts/conf.dTaking 30 seconds longer to boot after upgrade from jessie to stretchHow to match multiple font names with a single <match> element?Adding a custom font to fontconfigRemoving fonts from fontconfig <match> resultsBroken fonts after upgrading Firefox ESR to latest Firefox