Support » Plugins » handling HTML code & quotes in a widget control form

  • i have a few widgets in the wild that have a control form to let users configure options and alter output. i got an email from a user last week saying that she tried to put HTML code in the widget and the quotes break the control form.

    to clarify, something like <b> or </div> causes no problems. when quotes are introduced to put an inline style=”background: #ffffff;” the data does not save properly.

    i am saving the options in a typical wordpress option using get_option and update_option.

    i tried throwing an addslashes on the variable output, but it seems like the data is saved in a mangled state.

    if you’d like to look at my code, the widget i am talking about specifically is

    my question is: how can i properly save and load user input that contains HTML code in an option?


Viewing 2 replies - 1 through 2 (of 2 total)
  • option values are saved with escaped quotes. this happens automatically with no addslashes..

    echo implode( ",", get_option('widget_sidebar_stats'));


    Site Stats,<b>,</b>,<div style=\"color: #FF0000;\">,</div>

    but when i go to my widgets page in the dashboard and view source i see this

    <div style=\'color: #FF0000;\'>

    in the prefix text field as…

    function sidebar_stats_control() {
    	$options = get_option("widget_sidebar_stats");
    	if( !$options ){
    		// set defaults
    		$default_options = array( );
    		$default_options['title'] = 'Sidebar Stats Plugin';
    		$default_options['beforeStat'] = '<b>';
    		$default_options['afterStat'] = '</b>';
    		$default_options['prefix'] = '';
    		$default_options['suffix'] = '';
    		$options = $default_options;
    		update_option( "widget_sidebar_stats",$default_options );
    	if ( $_POST['sidebar-stats-submit'] ) {
    		// get posted values from form submission
    		$new_options['title'] = strip_tags(stripslashes($_POST['sidebar-stats-title']));
    		$new_options['beforeStat'] = $_POST['sidebar-stats-beforeStat'];
    		$new_options['afterStat'] = $_POST['sidebar-stats-afterStat'];
    		$new_options['prefix'] = $_POST['sidebar-stats-prefix'];
    		$new_options['suffix'] = $_POST['sidebar-stats-suffix'];
    		// if the posted options are different, save them
    		if ( $options != $new_options ) {
    			$options = $new_options;
    			update_option('widget_sidebar_stats', $options);
    	// format title for html
    	$title = htmlspecialchars($options['title'], ENT_QUOTES);
    	$beforeStat = $options['beforeStat'];
    	$afterStat = $options['afterStat'];
    	$prefix = $options['prefix'];
    	$suffix = $options['suffix'];
    	<label for="sidebar-stats-title" style="line-height:35px;display:block;">Title: <input type="text" id="sidebar-stats-title" name="sidebar-stats-title" value="<?php echo $title; ?>" /></label>
    	<label for="sidebar-stats-beforeStat" style="line-height:35px;display:block;">Before each #: <input type="text" id="sidebar-stats-beforeStat" name="sidebar-stats-beforeStat" value="<?php echo $beforeStat; ?>" /></label>
    	<label for="sidebar-stats-afterStat" style="line-height:35px;display:block;">After each #: <input type="text" id="sidebar-stats-afterStat" name="sidebar-stats-afterStat" value="<?php echo $afterStat; ?>" /></label>
    	<label for="sidebar-stats-prefix" style="line-height:35px;display:block;">Before everything: <input type="text" id="sidebar-stats-prefix" name="sidebar-stats-prefix" value="<?php echo $prefix; ?>" /></label>
    	<label for="sidebar-stats-suffix" style="line-height:35px;display:block;">After everything: <input type="text" id="sidebar-stats-suffix" name="sidebar-stats-suffix" value="<?php echo $suffix; ?>" /></label>
    	<input type="hidden" name="sidebar-stats-submit" id="sidebar-stats-submit" value="1" />
Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘handling HTML code & quotes in a widget control form’ is closed to new replies.