Title: wp_kses_attr_check
Published: August 3, 2015
Last modified: August 20, 2026

---

# wp_kses_attr_check( string $name, string $value, string $whole, string $vless, string $element, array $allowed_html ): bool

## In this article

 * [Parameters](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#wp--skip-link--target)

Determines whether an attribute is allowed.

## 󠀁[Parameters](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#parameters)󠁿

 `$name`stringrequired

The attribute name. Passed by reference. Returns empty string when not allowed.

`$value`stringrequired

The attribute value. Passed by reference. Returns a filtered value.

`$whole`stringrequired

The `name=value` input. Passed by reference. Returns filtered input.

`$vless`stringrequired

Whether the attribute is valueless. Use `'y'` or `'n'`.

`$element`stringrequired

The name of the element to which this attribute belongs.

`$allowed_html`arrayrequired

The full list of allowed elements and attributes.

## 󠀁[Return](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#return)󠁿

 bool Whether or not the attribute is allowed.

## 󠀁[Source](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#source)󠁿

    ```php
    function wp_kses_attr_check( &$name, &$value, &$whole, $vless, $element, $allowed_html ) {
    	$name_low    = strtolower( $name );
    	$element_low = strtolower( $element );

    	if ( ! isset( $allowed_html[ $element_low ] ) ) {
    		$name  = '';
    		$value = '';
    		$whole = '';
    		return false;
    	}

    	$allowed_attr = $allowed_html[ $element_low ];

    	if ( ! isset( $allowed_attr[ $name_low ] ) || '' === $allowed_attr[ $name_low ] ) {
    		/*
    		 * Allow `data-*` attributes.
    		 *
    		 * When specifying `$allowed_html`, the attribute name should be set as
    		 * `data-*` (not to be mixed with the HTML 4.0 `data` attribute, see
    		 * https://www.w3.org/TR/html40/struct/objects.html#adef-data).
    		 *
    		 * Note: the attribute name should only contain `A-Za-z0-9_-` chars.
    		 */
    		if ( str_starts_with( $name_low, 'data-' ) && ! empty( $allowed_attr['data-*'] )
    			&& preg_match( '/^data-[a-z0-9_-]+$/', $name_low, $match )
    		) {
    			/*
    			 * Add the whole attribute name to the allowed attributes and set any restrictions
    			 * for the `data-*` attribute values for the current element.
    			 */
    			$allowed_attr[ $match[0] ] = $allowed_attr['data-*'];
    		} else {
    			$name  = '';
    			$value = '';
    			$whole = '';
    			return false;
    		}
    	}

    	if ( 'style' === $name_low ) {
    		$decoded_value = WP_HTML_Decoder::decode_attribute( $value );
    		$new_value     = safecss_filter_attr( $decoded_value );

    		if ( empty( $new_value ) ) {
    			$name  = '';
    			$value = '';
    			$whole = '';
    			return false;
    		}

    		if ( $new_value !== $decoded_value ) {
    			$encoded_value = esc_attr( $new_value );
    			$whole         = str_replace( $value, $encoded_value, $whole );
    			$value         = $encoded_value;
    		}
    	}

    	if ( is_array( $allowed_attr[ $name_low ] ) ) {
    		// There are some checks.
    		foreach ( $allowed_attr[ $name_low ] as $currkey => $currval ) {
    			if ( ! wp_kses_check_attr_val( $value, $vless, $currkey, $currval ) ) {
    				$name  = '';
    				$value = '';
    				$whole = '';
    				return false;
    			}
    		}
    	}

    	return true;
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/kses.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/kses.php#L1605)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/kses.php#L1605-L1675)

## 󠀁[Related](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#related)󠁿

| Uses | Description | 
| [WP_HTML_Decoder::decode_attribute()](https://developer.wordpress.org/reference/classes/wp_html_decoder/decode_attribute/)`wp-includes/html-api/class-wp-html-decoder.php` |

Returns a string containing the decoded value of a given HTML attribute.

  | 
| [safecss_filter_attr()](https://developer.wordpress.org/reference/functions/safecss_filter_attr/)`wp-includes/kses.php` |

Filters an inline style attribute and removes disallowed rules.

  | 
| [wp_kses_check_attr_val()](https://developer.wordpress.org/reference/functions/wp_kses_check_attr_val/)`wp-includes/kses.php` |

Performs different checks for attribute values.

  | 
| [esc_attr()](https://developer.wordpress.org/reference/functions/esc_attr/)`wp-includes/formatting.php` |

Escaping for HTML attributes.

  |

[Show 1 more](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#)
[Show less](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#)

| Used by | Description | 
| [wp_kses_one_attr()](https://developer.wordpress.org/reference/functions/wp_kses_one_attr/)`wp-includes/kses.php` |

Filters one HTML attribute and ensures its value is allowed.

  | 
| [wp_kses_attr()](https://developer.wordpress.org/reference/functions/wp_kses_attr/)`wp-includes/kses.php` |

Removes all attributes, if none are allowed for this element.

  |

## 󠀁[Changelog](https://developer.wordpress.org/reference/functions/wp_kses_attr_check/?output_format=md#changelog)󠁿

| Version | Description | 
| [5.0.0](https://developer.wordpress.org/reference/since/5.0.0/) | Added support for `data-*` wildcard attributes. | 
| [4.2.3](https://developer.wordpress.org/reference/since/4.2.3/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_kses_attr_check%2F)
before being able to contribute a note or feedback.