WordPress开发者和主题制作者的搜索引擎



wp_kses_bad_protocol ›

Since1.0.0
已弃用n/a
wp_kses_bad_protocol ( $string, $allowed_protocols )
参数: (2)
  • (string) $string Content to filter bad protocols from.
    Required: Yes
  • (string[]) $allowed_protocols Array of allowed URL protocols.
    Required: Yes
返回:
  • (string) Filtered content.
定义在:
文档:

Sanitizes a string and removed disallowed URL protocols.

This function removes all non-allowed protocols from the beginning of the string. It ignores whitespace and the case of the letters, and it does understand HTML entities. It does its work recursively, so it won't be fooled by a string like javascript:javascript:alert(57).



源码

function wp_kses_bad_protocol( $string, $allowed_protocols ) {
	$string     = wp_kses_no_null( $string );
	$iterations = 0;

	do {
		$original_string = $string;
		$string          = wp_kses_bad_protocol_once( $string, $allowed_protocols );
	} while ( $original_string != $string && ++$iterations < 6 );

	if ( $original_string != $string ) {
		return '';
	}

	return $string;
}