WordPress.org

Ready to get started?Download WordPress

Forums

Google Analytics for WordPress
[resolved] Need to stripslashes for the Custom Code field (4 posts)

  1. Stephen Cronin
    Member
    Posted 3 years ago #

    The plugin allows the user to enter JavaScript code that’s added to the Google Analytics code, via the Custom Code field. However, it doesn’t stripslashes when adding it to the page. As a result the custom code doesn’t work, at least in some cases, because the slashes change the meaning of the JavaScript code.

    For example, if you add the following to the Custom Code field:

    _gaq.push(['_trackPageLoadTime']);

    the following is added to the page:

    _gaq.push([\'_trackPageLoadTime\']);

    Now the JavaScript is escaping the quote marks, which is not what we want. These slashes need to be stripped when adding the contents of this field to the Google Analytics code.

    I understand that we should "never trust the user", and that's fine when they are entering information to display. However, when they are entering code that is going to be executed, they have to be trusted. If you really don’t trust them, then you don’t give them the ability to add code.

    Bear in mind that anyone who has access to enter information in this field probably has access to the Plugin and Theme Editors, where they can certainly enter code that is executed.

    I've written a post (How To Set Up Site Speed For Google Analytics In WordPress), which includes information on how to hack the plugin to stripslashes when this field is added to the code (and when displayed in the Settings page, or it adds slashes upon slashes).

    Joost, is there any chance of getting this added to the plugin? Or is there something that I'm missing? Thanks.

  2. ebiven
    Member
    Posted 3 years ago #

    Just found the same bug.

    Thanks for the write-up on modifying it.

  3. Navjot Singh
    Member
    Posted 3 years ago #

    Was looking for a fix for this just few minutes back. Hoping that this gets fixed in the upcoming version.

  4. Stephen Cronin
    Member
    Posted 3 years ago #

    Not sure if Joost ever saw this, but he has fixed this in the latest version, as announced on the following post:

    http://yoast.com/site-speed-tracking-in-google-analytics/

Topic Closed

This topic has been closed to new replies.

About this Plugin

About this Topic