wp_kses_allowed_html() – Function | Developer.WordPress.org

Returns an array of allowed HTML tags and attributes for a given context.

Parameters

$contextstring|arrayoptional: The context for which to retrieve tags. Allowed values are 'post', 'strip', 'data', 'entities', or the name of a field filter such as 'pre_user_description', or an array of allowed HTML elements and attributes.
Default:''

Return

array Array of allowed HTML tags and their allowed attributes.

More Information

The Return value is a multidimensional array with the tag name as the key and an array of attributes as the value.

Source

function wp_kses_allowed_html( $context = '' ) {
	global $allowedposttags, $allowedtags, $allowedentitynames;

	if ( is_array( $context ) ) {
		// When `$context` is an array it's actually an array of allowed HTML elements and attributes.
		$html    = $context;
		$context = 'explicit';

		/**
		 * Filters the HTML tags that are allowed for a given context.
		 *
		 * HTML tags and attribute names are case-insensitive in HTML but must be
		 * added to the KSES allow list in lowercase. An item added to the allow list
		 * in upper or mixed case will not recognized as permitted by KSES.
		 *
		 * @since 3.5.0
		 *
		 * @param array[] $html    Allowed HTML tags.
		 * @param string  $context Context name.
		 */
		return apply_filters( 'wp_kses_allowed_html', $html, $context );
	}

	switch ( $context ) {
		case 'post':
			/** This filter is documented in wp-includes/kses.php */
			$tags = apply_filters( 'wp_kses_allowed_html', $allowedposttags, $context );

			// 5.0.1 removed the `<form>` tag, allow it if a filter is allowing it's sub-elements `<input>` or `<select>`.
			if ( ! CUSTOM_TAGS && ! isset( $tags['form'] ) && ( isset( $tags['input'] ) || isset( $tags['select'] ) ) ) {
				$tags = $allowedposttags;

				$tags['form'] = array(
					'action'         => true,
					'accept'         => true,
					'accept-charset' => true,
					'enctype'        => true,
					'method'         => true,
					'name'           => true,
					'target'         => true,
				);

				/** This filter is documented in wp-includes/kses.php */
				$tags = apply_filters( 'wp_kses_allowed_html', $tags, $context );
			}

			return $tags;

		case 'user_description':
		case 'pre_user_description':
			$tags             = $allowedtags;
			$tags['a']['rel'] = true;
			/** This filter is documented in wp-includes/kses.php */
			return apply_filters( 'wp_kses_allowed_html', $tags, $context );

		case 'strip':
			/** This filter is documented in wp-includes/kses.php */
			return apply_filters( 'wp_kses_allowed_html', array(), $context );

		case 'entities':
			/** This filter is documented in wp-includes/kses.php */
			return apply_filters( 'wp_kses_allowed_html', $allowedentitynames, $context );

		case 'data':
		default:
			/** This filter is documented in wp-includes/kses.php */
			return apply_filters( 'wp_kses_allowed_html', $allowedtags, $context );
	}
}

View all references View on Trac View on GitHub

Hooks

apply_filters( ‘wp_kses_allowed_html’, array[] $html, string $context ): Filters the HTML tags that are allowed for a given context.

Uses	Description
apply_filters()`wp-includes/plugin.php`	Calls the callback functions that have been added to a filter hook.

Used by	Description
filter_block_core_template_part_attributes()`wp-includes/blocks.php`	Sanitizes the value of the Template Part block’s `tagName` attribute.
wp_get_code_editor_settings()`wp-includes/general-template.php`	Generates and returns code editor settings.
WP_Widget_Custom_HTML::render_control_template_scripts()`wp-includes/widgets/class-wp-widget-custom-html.php`	Render form template scripts.
wp_kses_one_attr()`wp-includes/kses.php`	Filters one HTML attribute and ensures its value is allowed.
wp_kses_attr()`wp-includes/kses.php`	Removes all attributes, if none are allowed for this element.

Changelog

Version	Description
5.0.1	`form` removed as allowable HTML tag.
3.5.0	Introduced.

User Contributed Notes

Steven Lin 5 years ago

Example migrated from Codex:

// strips all html (empty array)
$allowed_html = wp_kses_allowed_html( 'strip' );

// allows all most inline elements and strips all block level elements except blockquote
$allowed_html = wp_kses_allowed_html( 'data' );

// very permissive: allows pretty much all HTML to pass - same as what's normally applied to the_content by default
$allowed_html = wp_kses_allowed_html( 'post' );

// allows a list of HTML Entities such as  
$allowed_html = wp_kses_allowed_html( 'entities' );

wp_kses_allowed_html( string|array $context = '' ): array

In this article