ill get * back '0010'. If you set the threshold to '4' and the number is '5000', then you * will get back '5000'. * * Uses sprintf to append the amount of zeros based on the $threshold parameter * and the size of the number. If the number is large enough, then no zeros will * be appended. * * @since 0.71 * * @param int $number Number to append zeros to if not greater than threshold. * @param int $threshold Digit places number needs to be to not have zeros added. * @return string Adds leading zeros to number if needed. */ function zeroise( $number, $threshold ) { return sprintf( '%0' . $threshold . 's', $number ); } /** * Adds backslashes before letters and before a number at the start of a string. * * @since 0.71 * * @param string $value Value to which backslashes will be added. * @return string String with backslashes inserted. */ function backslashit( $value ) { if ( isset( $value[0] ) && $value[0] >= '0' && $value[0] <= '9' ) { $value = '\\\\' . $value; } return addcslashes( $value, 'A..Za..z' ); } /** * Appends a trailing slash. * * Will remove trailing forward and backslashes if it exists already before adding * a trailing forward slash. This prevents double slashing a string or path. * * The primary use of this is for paths and thus should be used for paths. It is * not restricted to paths and offers no specific path support. * * @since 1.2.0 * * @param string $value Value to which trailing slash will be added. * @return string String with trailing slash added. */ function trailingslashit( $value ) { return untrailingslashit( $value ) . '/'; } /** * Removes trailing forward slashes and backslashes if they exist. * * The primary use of this is for paths and thus should be used for paths. It is * not restricted to paths and offers no specific path support. * * @since 2.2.0 * * @param string $value Value from which trailing slashes will be removed. * @return string String without the trailing slashes. */ function untrailingslashit( $value ) { return rtrim( $value, '/\\' ); } /** * Adds slashes to a string or recursively adds slashes to strings within an array. * * @since 0.71 * * @param string|array $gpc String or array of data to slash. * @return string|array Slashed `$gpc`. */ function addslashes_gpc( $gpc ) { return wp_slash( $gpc ); } /** * Navigates through an array, object, or scalar, and removes slashes from the values. * * @since 2.0.0 * * @param mixed $value The value to be stripped. * @return mixed Stripped value. */ function stripslashes_deep( $value ) { return map_deep( $value, 'stripslashes_from_strings_only' ); } /** * Callback function for `stripslashes_deep()` which strips slashes from strings. * * @since 4.4.0 * * @param mixed $value The array or string to be stripped. * @return mixed The stripped value. */ function stripslashes_from_strings_only( $value ) { return is_string( $value ) ? stripslashes( $value ) : $value; } /** * Navigates through an array, object, or scalar, and encodes the values to be used in a URL. * * @since 2.2.0 * * @param mixed $value The array or string to be encoded. * @return mixed The encoded value. */ function urlencode_deep( $value ) { return map_deep( $value, 'urlencode' ); } /** * Navigates through an array, object, or scalar, and raw-encodes the values to be used in a URL. * * @since 3.4.0 * * @param mixed $value The array or string to be encoded. * @return mixed The encoded value. */ function rawurlencode_deep( $value ) { return map_deep( $value, 'rawurlencode' ); } /** * Navigates through an array, object, or scalar, and decodes URL-encoded values * * @since 4.4.0 * * @param mixed $value The array or string to be decoded. * @return mixed The decoded value. */ function urldecode_deep( $value ) { return map_deep( $value, 'urldecode' ); } /** * Converts email addresses characters to HTML entities to block spam bots. * * @since 0.71 * * @param string $email_address Email address. * @param int $hex_encoding Optional. Set to 1 to enable hex encoding. * @return string Converted email address. */ function antispambot( $email_address, $hex_encoding = 0 ) { $email_no_spam_address = ''; for ( $i = 0, $len = strlen( $email_address ); $i < $len; $i++ ) { $j = rand( 0, 1 + $hex_encoding ); if ( 0 === $j ) { $email_no_spam_address .= '&#' . ord( $email_address[ $i ] ) . ';'; } elseif ( 1 === $j ) { $email_no_spam_address .= $email_address[ $i ]; } elseif ( 2 === $j ) { $email_no_spam_address .= '%' . zeroise( dechex( ord( $email_address[ $i ] ) ), 2 ); } } return str_replace( '@', '@', $email_no_spam_address ); } /** * Callback to convert URI match to HTML A element. * * This function was backported from 2.5.0 to 2.3.2. Regex callback for make_clickable(). * * @since 2.3.2 * @access private * * @param array $matches Single Regex Match. * @return string HTML A element with URI address. */ function _make_url_clickable_cb( $matches ) { $url = $matches[2]; if ( ')' === $matches[3] && strpos( $url, '(' ) ) { /* * If the trailing character is a closing parenthesis, and the URL has an opening parenthesis in it, * add the closing parenthesis to the URL. Then we can let the parenthesis balancer do its thing below. */ $url .= $matches[3]; $suffix = ''; } else { $suffix = $matches[3]; } if ( isset( $matches[4] ) && ! empty( $matches[4] ) ) { $url .= $matches[4]; } // Include parentheses in the URL only if paired. while ( substr_count( $url, '(' ) < substr_count( $url, ')' ) ) { $suffix = strrchr( $url, ')' ) . $suffix; $url = substr( $url, 0, strrpos( $url, ')' ) ); } $url = esc_url( $url ); if ( empty( $url ) ) { return $matches[0]; } $rel_attr = _make_clickable_rel_attr( $url ); return $matches[1] . "{$url}" . $suffix; } /** * Callback to convert URL match to HTML A element. * * This function was backported from 2.5.0 to 2.3.2. Regex callback for make_clickable(). * * @since 2.3.2 * @access private * * @param array $matches Single Regex Match. * @return string HTML A element with URL address. */ function _make_web_ftp_clickable_cb( $matches ) { $ret = ''; $dest = $matches[2]; $dest = 'http://' . $dest; // Removed trailing [.,;:)] from URL. $last_char = substr( $dest, -1 ); if ( in_array( $last_char, array( '.', ',', ';', ':', ')' ), true ) === true ) { $ret = $last_char; $dest = substr( $dest, 0, strlen( $dest ) - 1 ); } $dest = esc_url( $dest ); if ( empty( $dest ) ) { return $matches[0]; } $rel_attr = _make_clickable_rel_attr( $dest ); return $matches[1] . "{$dest}{$ret}"; } /** * Callback to convert email address match to HTML A element. * * This function was backported from 2.5.0 to 2.3.2. Regex callback for make_clickable(). * * @since 2.3.2 * @access private * * @param array $matches Single Regex Match. * @return string HTML A element with email address. */ function _make_email_clickable_cb( $matches ) { $email = $matches[2] . '@' . $matches[3]; return $matches[1] . "{$email}"; } /** * Helper function used to build the "rel" attribute for a URL when creating an anchor using make_clickable(). * * @since 6.2.0 * * @param string $url The URL. * @return string The rel attribute for the anchor or an empty string if no rel attribute should be added. */ function _make_clickable_rel_attr( $url ) { $rel_parts = array(); $scheme = strtolower( wp_parse_url( $url, PHP_URL_SCHEME ) ); $nofollow_schemes = array_intersect( wp_allowed_protocols(), array( 'https', 'http' ) ); // Apply "nofollow" to external links with qualifying URL schemes (mailto:, tel:, etc... shouldn't be followed). if ( ! wp_is_internal_link( $url ) && in_array( $scheme, $nofollow_schemes, true ) ) { $rel_parts[] = 'nofollow'; } // Apply "ugc" when in comment context. if ( 'comment_text' === current_filter() ) { $rel_parts[] = 'ugc'; } $rel = implode( ' ', $rel_parts ); /** * Filters the rel value that is added to URL matches converted to links. * * @since 5.3.0 * * @param string $rel The rel value. * @param string $url The matched URL being converted to a link tag. */ $rel = apply_filters( 'make_clickable_rel', $rel, $url ); $rel_attr = $rel ? ' rel="' . esc_attr( $rel ) . '"' : ''; return $rel_attr; } /** * Converts plaintext URI to HTML links. * * Converts URI, www and ftp, and email addresses. Finishes by fixing links * within links. * * @since 0.71 * * @param string $text Content to convert URIs. * @return string Content with converted URIs. */ function make_clickable( $text ) { $r = ''; $textarr = preg_split( '/(<[^<>]+>)/', $text, -1, PREG_SPLIT_DELIM_CAPTURE ); // Split out HTML tags. $nested_code_pre = 0; // Keep track of how many levels link is nested inside 
 or .
	foreach ( $textarr as $piece ) {

		if ( preg_match( '|^]|i', $piece )
			|| preg_match( '|^]|i', $piece )
			|| preg_match( '|^]|i', $piece )
			|| preg_match( '|^]|i', $piece )
		) {
			++$nested_code_pre;
		} elseif ( $nested_code_pre
			&& ( '' === strtolower( $piece )
				|| '
' === strtolower( $piece ) || '' === strtolower( $piece ) || '' === strtolower( $piece ) ) ) { --$nested_code_pre; } if ( $nested_code_pre || empty( $piece ) || ( '<' === $piece[0] && ! preg_match( '|^<\s*[\w]{1,20}+://|', $piece ) ) ) { $r .= $piece; continue; } // Long strings might contain expensive edge cases... if ( 10000 < strlen( $piece ) ) { // ...break it up. foreach ( _split_str_by_whitespace( $piece, 2100 ) as $chunk ) { // 2100: Extra room for scheme and leading and trailing parentheses. if ( 2101 < strlen( $chunk ) ) { $r .= $chunk; // Too big, no whitespace: bail. } else { $r .= make_clickable( $chunk ); } } } else { $ret = " $piece "; // Pad with whitespace to simplify the regexes. $url_clickable = '~ ([\\s(<.,;:!?]) # 1: Leading whitespace, or punctuation. ( # 2: URL. [\\w]{1,20}+:// # Scheme and hier-part prefix. (?=\S{1,2000}\s) # Limit to URLs less than about 2000 characters long. [\\w\\x80-\\xff#%\\~/@\\[\\]*(+=&$-]*+ # Non-punctuation URL character. (?: # Unroll the Loop: Only allow punctuation URL character if followed by a non-punctuation URL character. [\'.,;:!?)] # Punctuation URL character. [\\w\\x80-\\xff#%\\~/@\\[\\]*(+=&$-]++ # Non-punctuation URL character. )* ) (\)?) # 3: Trailing closing parenthesis (for parenthesis balancing post processing). (\\.\\w{2,6})? # 4: Allowing file extensions (e.g., .jpg, .png). ~xS'; /* * The regex is a non-anchored pattern and does not have a single fixed starting character. * Tell PCRE to spend more time optimizing since, when used on a page load, it will probably be used several times. */ $ret = preg_replace_callback( $url_clickable, '_make_url_clickable_cb', $ret ); $ret = preg_replace_callback( '#([\s>])((www|ftp)\.[\w\\x80-\\xff\#$%&~/.\-;:=,?@\[\]+]+)#is', '_make_web_ftp_clickable_cb', $ret ); $ret = preg_replace_callback( '#([\s>])([.0-9a-z_+-]+)@(([0-9a-z-]+\.)+[0-9a-z]{2,})#i', '_make_email_clickable_cb', $ret ); $ret = substr( $ret, 1, -1 ); // Remove our whitespace padding. $r .= $ret; } } // Cleanup of accidental links within links. return preg_replace( '#(]+?>|>))]+?>([^>]+?)#i', '$1$3', $r ); } /** * Breaks a string into chunks by splitting at whitespace characters. * * The length of each returned chunk is as close to the specified length goal as possible, * with the caveat that each chunk includes its trailing delimiter. * Chunks longer than the goal are guaranteed to not have any inner whitespace. * * Joining the returned chunks with empty delimiters reconstructs the input string losslessly. * * Input string must have no null characters (or eventual transformations on output chunks must not care about null characters) * * _split_str_by_whitespace( "1234 67890 1234 67890a cd 1234 890 123456789 1234567890a 45678 1 3 5 7 90 ", 10 ) == * array ( * 0 => '1234 67890 ', // 11 characters: Perfect split. * 1 => '1234 ', // 5 characters: '1234 67890a' was too long. * 2 => '67890a cd ', // 10 characters: '67890a cd 1234' was too long. * 3 => '1234 890 ', // 11 characters: Perfect split. * 4 => '123456789 ', // 10 characters: '123456789 1234567890a' was too long. * 5 => '1234567890a ', // 12 characters: Too long, but no inner whitespace on which to split. * 6 => ' 45678 ', // 11 characters: Perfect split. * 7 => '1 3 5 7 90 ', // 11 characters: End of $text. * ); * * @since 3.4.0 * @access private * * @param string $text The string to split. * @param int $goal The desired chunk length. * @return array Numeric array of chunks. */ function _split_str_by_whitespace( $text, $goal ) { $chunks = array(); $string_nullspace = strtr( $text, "\r\n\t\v\f ", "\000\000\000\000\000\000" ); while ( $goal < strlen( $string_nullspace ) ) { $pos = strrpos( substr( $string_nullspace, 0, $goal + 1 ), "\000" ); if ( false === $pos ) { $pos = strpos( $string_nullspace, "\000", $goal + 1 ); if ( false === $pos ) { break; } } $chunks[] = substr( $text, 0, $pos + 1 ); $text = substr( $text, $pos + 1 ); $string_nullspace = substr( $string_nullspace, $pos + 1 ); } if ( $text ) { $chunks[] = $text; } return $chunks; } /** * Callback to add a rel attribute to HTML A element. * * Will remove already existing string before adding to prevent invalidating (X)HTML. * * @since 5.3.0 * * @param array $matches Single match. * @param string $rel The rel attribute to add. * @return string HTML A element with the added rel attribute. */ function wp_rel_callback( $matches, $rel ) { $text = $matches[1]; $atts = wp_kses_hair( $matches[1], wp_allowed_protocols() ); if ( ! empty( $atts['href'] ) && wp_is_internal_link( $atts['href']['value'] ) ) { $rel = trim( str_replace( 'nofollow', '', $rel ) ); } if ( ! empty( $atts['rel'] ) ) { $parts = array_map( 'trim', explode( ' ', $atts['rel']['value'] ) ); $rel_array = array_map( 'trim', explode( ' ', $rel ) ); $parts = array_unique( array_merge( $parts, $rel_array ) ); $rel = implode( ' ', $parts ); unset( $atts['rel'] ); $html = ''; foreach ( $atts as $name => $value ) { if ( isset( $value['vless'] ) && 'y' === $value['vless'] ) { $html .= $name . ' '; } else { $html .= "{$name}=\"" . esc_attr( $value['value'] ) . '" '; } } $text = trim( $html ); } $rel_attr = $rel ? ' rel="' . esc_attr( $rel ) . '"' : ''; return ""; } /** * Adds `rel="nofollow"` string to all HTML A elements in content. * * @since 1.5.0 * * @param string $text Content that may contain HTML A elements. * @return string Converted content. */ function wp_rel_nofollow( $text ) { // This is a pre-save filter, so text is already escaped. $text = stripslashes( $text ); $text = preg_replace_callback( '||i', static function ( $matches ) { return wp_rel_callback( $matches, 'nofollow' ); }, $text ); return wp_slash( $text ); } /** * Callback to add `rel="nofollow"` string to HTML A element. * * @since 2.3.0 * @deprecated 5.3.0 Use wp_rel_callback() * * @param array $matches Single match. * @return string HTML A Element with `rel="nofollow"`. */ function wp_rel_nofollow_callback( $matches ) { return wp_rel_callback( $matches, 'nofollow' ); } /** * Adds `rel="nofollow ugc"` string to all HTML A elements in content. * * @since 5.3.0 * * @param string $text Content that may contain HTML A elements. * @return string Converted content. */ function wp_rel_ugc( $text ) { // This is a pre-save filter, so text is already escaped. $text = stripslashes( $text ); $text = preg_replace_callback( '||i', static function ( $matches ) { return wp_rel_callback( $matches, 'nofollow ugc' ); }, $text ); return wp_slash( $text ); } /** * Adds `rel="noopener"` to all HTML A elements that have a target. * * @since 5.1.0 * @since 5.6.0 Removed 'noreferrer' relationship. * @deprecated 6.7.0 * * @param string $text Content that may contain HTML A elements. * @return string Converted content. */ function wp_targeted_link_rel( $text ) { _deprecated_function( __FUNCTION__, '6.7.0' ); // Don't run (more expensive) regex if no links with targets. if ( stripos( $text, 'target' ) === false || stripos( $text, ']*target\s*=[^>]*)>|i', 'wp_targeted_link_rel_callback', $part ); } $text = ''; for ( $i = 0; $i < count( $html_parts ); $i++ ) { $text .= $html_parts[ $i ]; if ( isset( $extra_parts[ $i ] ) ) { $text .= $extra_parts[ $i ]; } } return $text; } /** * Callback to add `rel="noopener"` string to HTML A element. * * Will not duplicate an existing 'noopener' value to avoid invalidating the HTML. * * @since 5.1.0 * @since 5.6.0 Removed 'noreferrer' relationship. * @deprecated 6.7.0 * * @param array $matches Single match. * @return string HTML A Element with `rel="noopener"` in addition to any existing values. */ function wp_targeted_link_rel_callback( $matches ) { _deprecated_function( __FUNCTION__, '6.7.0' ); $link_html = $matches[1]; $original_link_html = $link_html; // Consider the HTML escaped if there are no unescaped quotes. $is_escaped = ! preg_match( '/(^|[^\\\\])[\'"]/', $link_html ); if ( $is_escaped ) { // Replace only the quotes so that they are parsable by wp_kses_hair(), leave the rest as is. $link_html = preg_replace( '/\\\\([\'"])/', '$1', $link_html ); } $atts = wp_kses_hair( $link_html, wp_allowed_protocols() ); /** * Filters the rel values that are added to links with `target` attribute. * * @since 5.1.0 * * @param string $rel The rel values. * @param string $link_html The matched content of the link tag including all HTML attributes. */ $rel = apply_filters( 'wp_targeted_link_rel', 'noopener', $link_html ); // Return early if no rel values to be added or if no actual target attribute. if ( ! $rel || ! isset( $atts['target'] ) ) { return ""; } if ( isset( $atts['rel'] ) ) { $all_parts = preg_split( '/\s/', "{$atts['rel']['value']} $rel", -1, PREG_SPLIT_NO_EMPTY ); $rel = implode( ' ', array_unique( $all_parts ) ); } $atts['rel']['whole'] = 'rel="' . esc_attr( $rel ) . '"'; $link_html = implode( ' ', array_column( $atts, 'whole' ) ); if ( $is_escaped ) { $link_html = preg_replace( '/[\'"]/', '\\\\$0', $link_html ); } return ""; } /** * Adds all filters modifying the rel attribute of targeted links. * * @since 5.1.0 * @deprecated 6.7.0 */ function wp_init_targeted_link_rel_filters() { _deprecated_function( __FUNCTION__, '6.7.0' ); } /** * Removes all filters modifying the rel attribute of targeted links. * * @since 5.1.0 * @deprecated 6.7.0 */ function wp_remove_targeted_link_rel_filters() { _deprecated_function( __FUNCTION__, '6.7.0' ); } /** * Converts one smiley code to the icon graphic file equivalent. * * Callback handler for convert_smilies(). * * Looks up one smiley code in the $wpsmiliestrans global array and returns an * `` string for that smiley. * * @since 2.8.0 * * @global array $wpsmiliestrans * * @param array $matches Single match. Smiley code to convert to image. * @return string Image string for smiley. */ function translate_smiley( $matches ) { global $wpsmiliestrans; if ( count( $matches ) === 0 ) { return ''; } $smiley = trim( reset( $matches ) ); $img = $wpsmiliestrans[ $smiley ]; $matches = array(); $ext = preg_match( '/\.([^.]+)$/', $img, $matches ) ? strtolower( $matches[1] ) : false; $image_exts = array( 'jpg', 'jpeg', 'jpe', 'gif', 'png', 'webp', 'avif' ); // Don't convert smilies that aren't images - they're probably emoji. if ( ! in_array( $ext, $image_exts, true ) ) { return $img; } /** * Filters the Smiley image URL before it's used in the image element. * * @since 2.9.0 * * @param string $smiley_url URL for the smiley image. * @param string $img Filename for the smiley image. * @param string $site_url Site URL, as returned by site_url(). */ $src_url = apply_filters( 'smilies_src', includes_url( "images/smilies/$img" ), $img, site_url() ); return sprintf( '%s', esc_url( $src_url ), esc_attr( $smiley ) ); } /** * Converts text equivalent of smilies to images. * * Will only convert smilies if the option 'use_smilies' is true and the global * used in the function isn't empty. * * @since 0.71 * * @global string|array $wp_smiliessearch * * @param string $text Content to convert smilies from text. * @return string Converted content with text smilies replaced with images. */ function convert_smilies( $text ) { global $wp_smiliessearch; if ( ! get_option( 'use_smilies' ) || empty( $wp_smiliessearch ) ) { // Return default text. return $text; } // HTML loop taken from texturize function, could possible be consolidated. $textarr = preg_split( '/(<[^>]*>)/U', $text, -1, PREG_SPLIT_DELIM_CAPTURE ); // Capture the tags as well as in between. if ( false === $textarr ) { // Return default text. return $text; } // Loop stuff. $stop = count( $textarr ); $output = ''; // Ignore processing of specific tags. $tags_to_ignore = 'code|pre|style|script|textarea'; $ignore_block_element = ''; for ( $i = 0; $i < $stop; $i++ ) { $content = $textarr[ $i ]; // If we're in an ignore block, wait until we find its closing tag. if ( '' === $ignore_block_element && preg_match( '/^<(' . $tags_to_ignore . ')[^>]*>/', $content, $matches ) ) { $ignore_block_element = $matches[1]; } // If it's not a tag and not in ignore block. if ( '' === $ignore_block_element && strlen( $content ) > 0 && '<' !== $content[0] ) { $content = preg_replace_callback( $wp_smiliessearch, 'translate_smiley', $content ); } // Did we exit ignore block? if ( '' !== $ignore_block_element && '' === $content ) { $ignore_block_element = ''; } $output .= $content; } return $output; } /** * Verifies that an email is valid. * * Does not grok i18n domains. Not RFC compliant. * * @since 0.71 * * @param string $email Email address to verify. * @param bool $deprecated Deprecated. * @return string|false Valid email address on success, false on failure. */ function is_email( $email, $deprecated = false ) { if ( ! empty( $deprecated ) ) { _deprecated_argument( __FUNCTION__, '3.0.0' ); } // Test for the minimum length the email can be. if ( strlen( $email ) < 6 ) { /** * Filters whether an email address is valid. * * This filter is evaluated under several different contexts, such as 'email_too_short', * 'email_no_at', 'local_invalid_chars', 'domain_period_sequence', 'domain_period_limits', * 'domain_no_periods', 'sub_hyphen_limits', 'sub_invalid_chars', or no specific context. * * @since 2.8.0 * * @param string|false $is_email The email address if successfully passed the is_email() checks, false otherwise. * @param string $email The email address being checked. * @param string $context Context under which the email was tested. */ return apply_filters( 'is_email', false, $email, 'email_too_short' ); } // Test for an @ character after the first position. if ( strpos( $email, '@', 1 ) === false ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'is_email', false, $email, 'email_no_at' ); } // Split out the local and domain parts. list( $local, $domain ) = explode( '@', $email, 2 ); /* * LOCAL PART * Test for invalid characters. */ if ( ! preg_match( '/^[a-zA-Z0-9!#$%&\'*+\/=?^_`{|}~\.-]+$/', $local ) ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'is_email', false, $email, 'local_invalid_chars' ); } /* * DOMAIN PART * Test for sequences of periods. */ if ( preg_match( '/\.{2,}/', $domain ) ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'is_email', false, $email, 'domain_period_sequence' ); } // Test for leading and trailing periods and whitespace. if ( trim( $domain, " \t\n\r\0\x0B." ) !== $domain ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'is_email', false, $email, 'domain_period_limits' ); } // Split the domain into subs. $subs = explode( '.', $domain ); // Assume the domain will have at least two subs. if ( 2 > count( $subs ) ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'is_email', false, $email, 'domain_no_periods' ); } // Loop through each sub. foreach ( $subs as $sub ) { // Test for leading and trailing hyphens and whitespace. if ( trim( $sub, " \t\n\r\0\x0B-" ) !== $sub ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'is_email', false, $email, 'sub_hyphen_limits' ); } // Test for invalid characters. if ( ! preg_match( '/^[a-z0-9-]+$/i', $sub ) ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'is_email', false, $email, 'sub_invalid_chars' ); } } // Congratulations, your email made it! /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'is_email', $email, $email, null ); } /** * Converts to ASCII from email subjects. * * @since 1.2.0 * * @param string $subject Subject line. * @return string Converted string to ASCII. */ function wp_iso_descrambler( $subject ) { /* this may only work with iso-8859-1, I'm afraid */ if ( ! preg_match( '#\=\?(.+)\?Q\?(.+)\?\=#i', $subject, $matches ) ) { return $subject; } $subject = str_replace( '_', ' ', $matches[2] ); return preg_replace_callback( '#\=([0-9a-f]{2})#i', '_wp_iso_convert', $subject ); } /** * Helper function to convert hex encoded chars to ASCII. * * @since 3.1.0 * @access private * * @param array $matches The preg_replace_callback matches array. * @return string Converted chars. */ function _wp_iso_convert( $matches ) { return chr( hexdec( strtolower( $matches[1] ) ) ); } /** * Given a date in the timezone of the site, returns that date in UTC. * * Requires and returns a date in the Y-m-d H:i:s format. * Return format can be overridden using the $format parameter. * * @since 1.2.0 * * @param string $date_string The date to be converted, in the timezone of the site. * @param string $format The format string for the returned date. Default 'Y-m-d H:i:s'. * @return string Formatted version of the date, in UTC. */ function get_gmt_from_date( $date_string, $format = 'Y-m-d H:i:s' ) { $datetime = date_create( $date_string, wp_timezone() ); if ( false === $datetime ) { return gmdate( $format, 0 ); } return $datetime->setTimezone( new DateTimeZone( 'UTC' ) )->format( $format ); } /** * Given a date in UTC or GMT timezone, returns that date in the timezone of the site. * * Requires a date in the Y-m-d H:i:s format. * Default return format of 'Y-m-d H:i:s' can be overridden using the `$format` parameter. * * @since 1.2.0 * * @param string $date_string The date to be converted, in UTC or GMT timezone. * @param string $format The format string for the returned date. Default 'Y-m-d H:i:s'. * @return string Formatted version of the date, in the site's timezone. */ function get_date_from_gmt( $date_string, $format = 'Y-m-d H:i:s' ) { $datetime = date_create( $date_string, new DateTimeZone( 'UTC' ) ); if ( false === $datetime ) { return gmdate( $format, 0 ); } return $datetime->setTimezone( wp_timezone() )->format( $format ); } /** * Given an ISO 8601 timezone, returns its UTC offset in seconds. * * @since 1.5.0 * * @param string $timezone Either 'Z' for 0 offset or '±hhmm'. * @return int|float The offset in seconds. */ function iso8601_timezone_to_offset( $timezone ) { // $timezone is either 'Z' or '[+|-]hhmm'. if ( 'Z' === $timezone ) { $offset = 0; } else { $sign = ( str_starts_with( $timezone, '+' ) ) ? 1 : -1; $hours = (int) substr( $timezone, 1, 2 ); $minutes = (int) substr( $timezone, 3, 4 ) / 60; $offset = $sign * HOUR_IN_SECONDS * ( $hours + $minutes ); } return $offset; } /** * Given an ISO 8601 (Ymd\TH:i:sO) date, returns a MySQL DateTime (Y-m-d H:i:s) format used by post_date[_gmt]. * * @since 1.5.0 * * @param string $date_string Date and time in ISO 8601 format {@link https://en.wikipedia.org/wiki/ISO_8601}. * @param string $timezone Optional. If set to 'gmt' returns the result in UTC. Default 'user'. * @return string|false The date and time in MySQL DateTime format - Y-m-d H:i:s, or false on failure. */ function iso8601_to_datetime( $date_string, $timezone = 'user' ) { $timezone = strtolower( $timezone ); $wp_timezone = wp_timezone(); $datetime = date_create( $date_string, $wp_timezone ); // Timezone is ignored if input has one. if ( false === $datetime ) { return false; } if ( 'gmt' === $timezone ) { return $datetime->setTimezone( new DateTimeZone( 'UTC' ) )->format( 'Y-m-d H:i:s' ); } if ( 'user' === $timezone ) { return $datetime->setTimezone( $wp_timezone )->format( 'Y-m-d H:i:s' ); } return false; } /** * Strips out all characters that are not allowable in an email. * * @since 1.5.0 * * @param string $email Email address to filter. * @return string Filtered email address. */ function sanitize_email( $email ) { // Test for the minimum length the email can be. if ( strlen( $email ) < 6 ) { /** * Filters a sanitized email address. * * This filter is evaluated under several contexts, including 'email_too_short', * 'email_no_at', 'local_invalid_chars', 'domain_period_sequence', 'domain_period_limits', * 'domain_no_periods', 'domain_no_valid_subs', or no context. * * @since 2.8.0 * * @param string $sanitized_email The sanitized email address. * @param string $email The email address, as provided to sanitize_email(). * @param string|null $message A message to pass to the user. null if email is sanitized. */ return apply_filters( 'sanitize_email', '', $email, 'email_too_short' ); } // Test for an @ character after the first position. if ( strpos( $email, '@', 1 ) === false ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'sanitize_email', '', $email, 'email_no_at' ); } // Split out the local and domain parts. list( $local, $domain ) = explode( '@', $email, 2 ); /* * LOCAL PART * Test for invalid characters. */ $local = preg_replace( '/[^a-zA-Z0-9!#$%&\'*+\/=?^_`{|}~\.-]/', '', $local ); if ( '' === $local ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'sanitize_email', '', $email, 'local_invalid_chars' ); } /* * DOMAIN PART * Test for sequences of periods. */ $domain = preg_replace( '/\.{2,}/', '', $domain ); if ( '' === $domain ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'sanitize_email', '', $email, 'domain_period_sequence' ); } // Test for leading and trailing periods and whitespace. $domain = trim( $domain, " \t\n\r\0\x0B." ); if ( '' === $domain ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'sanitize_email', '', $email, 'domain_period_limits' ); } // Split the domain into subs. $subs = explode( '.', $domain ); // Assume the domain will have at least two subs. if ( 2 > count( $subs ) ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'sanitize_email', '', $email, 'domain_no_periods' ); } // Create an array that will contain valid subs. $new_subs = array(); // Loop through each sub. foreach ( $subs as $sub ) { // Test for leading and trailing hyphens. $sub = trim( $sub, " \t\n\r\0\x0B-" ); // Test for invalid characters. $sub = preg_replace( '/[^a-z0-9-]+/i', '', $sub ); // If there's anything left, add it to the valid subs. if ( '' !== $sub ) { $new_subs[] = $sub; } } // If there aren't 2 or more valid subs. if ( 2 > count( $new_subs ) ) { /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'sanitize_email', '', $email, 'domain_no_valid_subs' ); } // Join valid subs into the new domain. $domain = implode( '.', $new_subs ); // Put the email back together. $sanitized_email = $local . '@' . $domain; // Congratulations, your email made it! /** This filter is documented in wp-includes/formatting.php */ return apply_filters( 'sanitize_email', $sanitized_email, $email, null ); } /** * Determines the difference between two timestamps. * * The difference is returned in a human-readable format such as "1 hour", * "5 minutes", "2 days". * * @since 1.5.0 * @since 5.3.0 Added support for showing a difference in seconds. * * @param int $from Unix timestamp from which the difference begins. * @param int $to Optional. Unix timestamp to end the time difference. Default becomes time() if not set. * @return string Human-readable time difference. */ function human_time_diff( $from, $to = 0 ) { if ( empty( $to ) ) { $to = time(); } $diff = (int) abs( $to - $from ); if ( $diff < MINUTE_IN_SECONDS ) { $secs = $diff; if ( $secs <= 1 ) { $secs = 1; } /* translators: Time difference between two dates, in seconds. %s: Number of seconds. */ $since = sprintf( _n( '%s second', '%s seconds', $secs ), $secs ); } elseif ( $diff < HOUR_IN_SECONDS && $diff >= MINUTE_IN_SECONDS ) { $mins = round( $diff / MINUTE_IN_SECONDS ); if ( $mins <= 1 ) { $mins = 1; } /* translators: Time difference between two dates, in minutes. %s: Number of minutes. */ $since = sprintf( _n( '%s minute', '%s minutes', $mins ), $mins ); } elseif ( $diff < DAY_IN_SECONDS && $diff >= HOUR_IN_SECONDS ) { $hours = round( $diff / HOUR_IN_SECONDS ); if ( $hours <= 1 ) { $hours = 1; } /* translators: Time difference between two dates, in hours. %s: Number of hours. */ $since = sprintf( _n( '%s hour', '%s hours', $hours ), $hours ); } elseif ( $diff < WEEK_IN_SECONDS && $diff >= DAY_IN_SECONDS ) { $days = round( $diff / DAY_IN_SECONDS ); if ( $days <= 1 ) { $days = 1; } /* translators: Time difference between two dates, in days. %s: Number of days. */ $since = sprintf( _n( '%s day', '%s days', $days ), $days ); } elseif ( $diff < MONTH_IN_SECONDS && $diff >= WEEK_IN_SECONDS ) { $weeks = round( $diff / WEEK_IN_SECONDS ); if ( $weeks <= 1 ) { $weeks = 1; } /* translators: Time difference between two dates, in weeks. %s: Number of weeks. */ $since = sprintf( _n( '%s week', '%s weeks', $weeks ), $weeks ); } elseif ( $diff < YEAR_IN_SECONDS && $diff >= MONTH_IN_SECONDS ) { $months = round( $diff / MONTH_IN_SECONDS ); if ( $months <= 1 ) { $months = 1; } /* translators: Time difference between two dates, in months. %s: Number of months. */ $since = sprintf( _n( '%s month', '%s months', $months ), $months ); } elseif ( $diff >= YEAR_IN_SECONDS ) { $years = round( $diff / YEAR_IN_SECONDS ); if ( $years <= 1 ) { $years = 1; } /* translators: Time difference between two dates, in years. %s: Number of years. */ $since = sprintf( _n( '%s year', '%s years', $years ), $years ); } /** * Filters the human-readable difference between two timestamps. * * @since 4.0.0 * * @param string $since The difference in human-readable text. * @param int $diff The difference in seconds. * @param int $from Unix timestamp from which the difference begins. * @param int $to Unix timestamp to end the time difference. */ return apply_filters( 'human_time_diff', $since, $diff, $from, $to ); } /** * Generates an excerpt from the content, if needed. * * Returns a maximum of 55 words with an ellipsis appended if necessary. * * The 55-word limit can be modified by plugins/themes using the {@see 'excerpt_length'} filter * The ' […]' string can be modified by plugins/themes using the {@see 'excerpt_more'} filter * * @since 1.5.0 * @since 5.2.0 Added the `$post` parameter. * @since 6.3.0 Removes footnotes markup from the excerpt content. * * @param string $text Optional. The excerpt. If set to empty, an excerpt is generated. * @param WP_Post|object|int $post Optional. WP_Post instance or Post ID/object. Default null. * @return string The excerpt. */ function wp_trim_excerpt( $text = '', $post = null ) { $raw_excerpt = $text; if ( '' === trim( $text ) ) { $post = get_post( $post ); $text = get_the_content( '', false, $post ); $text = strip_shortcodes( $text ); $text = excerpt_remove_blocks( $text ); $text = excerpt_remove_footnotes( $text ); /* * Temporarily unhook wp_filter_content_tags() since any tags * within the excerpt are stripped out. Modifying the tags here * is wasteful and can lead to bugs in the image counting logic. */ $filter_image_removed = remove_filter( 'the_content', 'wp_filter_content_tags', 12 ); /* * Temporarily unhook do_blocks() since excerpt_remove_blocks( $text ) * handles block rendering needed for excerpt. */ $filter_block_removed = remove_filter( 'the_content', 'do_blocks', 9 ); /** This filter is documented in wp-includes/post-template.php */ $text = apply_filters( 'the_content', $text ); $text = str_replace( ']]>', ']]>', $text ); // Restore the original filter if removed. if ( $filter_block_removed ) { add_filter( 'the_content', 'do_blocks', 9 ); } /* * Only restore the filter callback if it was removed above. The logic * to unhook and restore only applies on the default priority of 10, * which is generally used for the filter callback in WordPress core. */ if ( $filter_image_removed ) { add_filter( 'the_content', 'wp_filter_content_tags', 12 ); } /* translators: Maximum number of words used in a post excerpt. */ $excerpt_length = (int) _x( '55', 'excerpt_length' ); /** * Filters the maximum number of words in a post excerpt. * * @since 2.7.0 * * @param int $number The maximum number of words. Default 55. */ $excerpt_length = (int) apply_filters( 'excerpt_length', $excerpt_length ); /** * Filters the string in the "more" link displayed after a trimmed excerpt. * * @since 2.9.0 * * @param string $more_string The string shown within the more link. */ $excerpt_more = apply_filters( 'excerpt_more', ' ' . '[…]' ); $text = wp_trim_words( $text, $excerpt_length, $excerpt_more ); } /** * Filters the trimmed excerpt string. * * @since 2.8.0 * * @param string $text The trimmed text. * @param string $raw_excerpt The text prior to trimming. */ return apply_filters( 'wp_trim_excerpt', $text, $raw_excerpt ); } /** * Trims text to a certain number of words. * * This function is localized. For languages that count 'words' by the individual * character (such as East Asian languages), the $num_words argument will apply * to the number of individual characters. * * @since 3.3.0 * * @param string $text Text to trim. * @param int $num_words Number of words. Default 55. * @param string $more Optional. What to append if $text needs to be trimmed. Default '…'. * @return string Trimmed text. */ function wp_trim_words( $text, $num_words = 55, $more = null ) { if ( null === $more ) { $more = __( '…' ); } $original_text = $text; $text = wp_strip_all_tags( $text ); $num_words = (int) $num_words; if ( str_starts_with( wp_get_word_count_type(), 'characters' ) && preg_match( '/^utf\-?8$/i', get_option( 'blog_charset' ) ) ) { $text = trim( preg_replace( "/[\n\r\t ]+/", ' ', $text ), ' ' ); preg_match_all( '/./u', $text, $words_array ); $words_array = array_slice( $words_array[0], 0, $num_words + 1 ); $sep = ''; } else { $words_array = preg_split( "/[\n\r\t ]+/", $text, $num_words + 1, PREG_SPLIT_NO_EMPTY ); $sep = ' '; } if ( count( $words_array ) > $num_words ) { array_pop( $words_array ); $text = implode( $sep, $words_array ); $text = $text . $more; } else { $text = implode( $sep, $words_array ); } /** * Filters the text content after words have been trimmed. * * @since 3.3.0 * * @param string $text The trimmed text. * @param int $num_words The number of words to trim the text to. Default 55. * @param string $more An optional string to append to the end of the trimmed text, e.g. …. * @param string $original_text The text before it was trimmed. */ return apply_filters( 'wp_trim_words', $text, $num_words, $more, $original_text ); } /** * Converts named entities into numbered entities. * * @since 1.5.1 * * @param string $text The text within which entities will be converted. * @return string Text with converted entities. */ function ent2ncr( $text ) { /** * Filters text before named entities are converted into numbered entities. * * A non-null string must be returned for the filter to be evaluated. * * @since 3.3.0 * * @param string|null $converted_text The text to be converted. Default null. * @param string $text The text prior to entity conversion. */ $filtered = apply_filters( 'pre_ent2ncr', null, $text ); if ( null !== $filtered ) { return $filtered; } $to_ncr = array( '"' => '"', '&' => '&', '<' => '<', '>' => '>', '|' => '|', ' ' => ' ', '¡' => '¡', '¢' => '¢', '£' => '£', '¤' => '¤', '¥' => '¥', '¦' => '¦', '&brkbar;' => '¦', '§' => '§', '¨' => '¨', '¨' => '¨', '©' => '©', 'ª' => 'ª', '«' => '«', '¬' => '¬', '­' => '­', '®' => '®', '¯' => '¯', '&hibar;' => '¯', '°' => '°', '±' => '±', '²' => '²', '³' => '³', '´' => '´', 'µ' => 'µ', '¶' => '¶', '·' => '·', '¸' => '¸', '¹' => '¹', 'º' => 'º', '»' => '»', '¼' => '¼', '½' => '½', '¾' => '¾', '¿' => '¿', 'À' => 'À', 'Á' => 'Á', 'Â' => 'Â', 'Ã' => 'Ã', 'Ä' => 'Ä', 'Å' => 'Å', 'Æ' => 'Æ', 'Ç' => 'Ç', 'È' => 'È', 'É' => 'É', 'Ê' => 'Ê', 'Ë' => 'Ë', 'Ì' => 'Ì', 'Í' => 'Í', 'Î' => 'Î', 'Ï' => 'Ï', 'Ð' => 'Ð', 'Ñ' => 'Ñ', 'Ò' => 'Ò', 'Ó' => 'Ó', 'Ô' => 'Ô', 'Õ' => 'Õ', 'Ö' => 'Ö', '×' => '×', 'Ø' => 'Ø', 'Ù' => 'Ù', 'Ú' => 'Ú', 'Û' => 'Û', 'Ü' => 'Ü', 'Ý' => 'Ý', 'Þ' => 'Þ', 'ß' => 'ß', 'à' => 'à', 'á' => 'á', 'â' => 'â', 'ã' => 'ã', 'ä' => 'ä', 'å' => 'å', 'æ' => 'æ', 'ç' => 'ç', 'è' => 'è', 'é' => 'é', 'ê' => 'ê', 'ë' => 'ë', 'ì' => 'ì', 'í' => 'í', 'î' => 'î', 'ï' => 'ï', 'ð' => 'ð', 'ñ' => 'ñ', 'ò' => 'ò', 'ó' => 'ó', 'ô' => 'ô', 'õ' => 'õ', 'ö' => 'ö', '÷' => '÷', 'ø' => 'ø', 'ù' => 'ù', 'ú' => 'ú', 'û' => 'û', 'ü' => 'ü', 'ý' => 'ý', 'þ' => 'þ', 'ÿ' => 'ÿ', 'Œ' => 'Œ', 'œ' => 'œ', 'Š' => 'Š', 'š' => 'š', 'Ÿ' => 'Ÿ', 'ƒ' => 'ƒ', 'ˆ' => 'ˆ', '˜' => '˜', 'Α' => 'Α', 'Β' => 'Β', 'Γ' => 'Γ', 'Δ' => 'Δ', 'Ε' => 'Ε', 'Ζ' => 'Ζ', 'Η' => 'Η', 'Θ' => 'Θ', 'Ι' => 'Ι', 'Κ' => 'Κ', 'Λ' => 'Λ', 'Μ' => 'Μ', 'Ν' => 'Ν', 'Ξ' => 'Ξ', 'Ο' => 'Ο', 'Π' => 'Π', 'Ρ' => 'Ρ', 'Σ' => 'Σ', 'Τ' => 'Τ', 'Υ' => 'Υ', 'Φ' => 'Φ', 'Χ' => 'Χ', 'Ψ' => 'Ψ', 'Ω' => 'Ω', 'α' => 'α', 'β' => 'β', 'γ' => 'γ', 'δ' => 'δ', 'ε' => 'ε', 'ζ' => 'ζ', 'η' => 'η', 'θ' => 'θ', 'ι' => 'ι', 'κ' => 'κ', 'λ' => 'λ', 'μ' => 'μ', 'ν' => 'ν', 'ξ' => 'ξ', 'ο' => 'ο', 'π' => 'π', 'ρ' => 'ρ', 'ς' => 'ς', 'σ' => 'σ', 'τ' => 'τ', 'υ' => 'υ', 'φ' => 'φ', 'χ' => 'χ', 'ψ' => 'ψ', 'ω' => 'ω', 'ϑ' => 'ϑ', 'ϒ' => 'ϒ', 'ϖ' => 'ϖ', ' ' => ' ', ' ' => ' ', ' ' => ' ', '‌' => '‌', '‍' => '‍', '‎' => '‎', '‏' => '‏', '–' => '–', '—' => '—', '‘' => '‘', '’' => '’', '‚' => '‚', '“' => '“', '”' => '”', '„' => '„', '†' => '†', '‡' => '‡', '•' => '•', '…' => '…', '‰' => '‰', '′' => '′', '″' => '″', '‹' => '‹', '›' => '›', '‾' => '‾', '⁄' => '⁄', '€' => '€', 'ℑ' => 'ℑ', '℘' => '℘', 'ℜ' => 'ℜ', '™' => '™', 'ℵ' => 'ℵ', '↵' => '↵', '⇐' => '⇐', '⇑' => '⇑', '⇒' => '⇒', '⇓' => '⇓', '⇔' => '⇔', '∀' => '∀', '∂' => '∂', '∃' => '∃', '∅' => '∅', '∇' => '∇', '∈' => '∈', '∉' => '∉', '∋' => '∋', '∏' => '∏', '∑' => '∑', '−' => '−', '∗' => '∗', '√' => '√', '∝' => '∝', '∞' => '∞', '∠' => '∠', '∧' => '∧', '∨' => '∨', '∩' => '∩', '∪' => '∪', '∫' => '∫', '∴' => '∴', '∼' => '∼', '≅' => '≅', '≈' => '≈', '≠' => '≠', '≡' => '≡', '≤' => '≤', '≥' => '≥', '⊂' => '⊂', '⊃' => '⊃', '⊄' => '⊄', '⊆' => '⊆', '⊇' => '⊇', '⊕' => '⊕', '⊗' => '⊗', '⊥' => '⊥', '⋅' => '⋅', '⌈' => '⌈', '⌉' => '⌉', '⌊' => '⌊', '⌋' => '⌋', '⟨' => '〈', '⟩' => '〉', '←' => '←', '↑' => '↑', '→' => '→', '↓' => '↓', '↔' => '↔', '◊' => '◊', '♠' => '♠', '♣' => '♣', '♥' => '♥', '♦' => '♦', ); return str_replace( array_keys( $to_ncr ), array_values( $to_ncr ), $text ); } /** * Formats text for the editor. * * Generally the browsers treat everything inside a textarea as text, but * it is still a good idea to HTML entity encode `<`, `>` and `&` in the content. * * The filter {@see 'format_for_editor'} is applied here. If `$text` is empty the * filter will be applied to an empty string. * * @since 4.3.0 * * @see _WP_Editors::editor() * * @param string $text The text to be formatted. * @param string $default_editor The default editor for the current user. * It is usually either 'html' or 'tinymce'. * @return string The formatted text after filter is applied. */ function format_for_editor( $text, $default_editor = null ) { if ( $text ) { $text = htmlspecialchars( $text, ENT_NOQUOTES, get_option( 'blog_charset' ) ); } /** * Filters the text after it is formatted for the editor. * * @since 4.3.0 * * @param string $text The formatted text. * @param string $default_editor The default editor for the current user. * It is usually either 'html' or 'tinymce'. */ return apply_filters( 'format_for_editor', $text, $default_editor ); } /** * Performs a deep string replace operation to ensure the values in $search are no longer present. * * Repeats the replacement operation until it no longer replaces anything to remove "nested" values * e.g. $subject = '%0%0%0DDD', $search ='%0D', $result ='' rather than the '%0%0DD' that * str_replace would return * * @since 2.8.1 * @access private * * @param string|array $search The value being searched for, otherwise known as the needle. * An array may be used to designate multiple needles. * @param string $subject The string being searched and replaced on, otherwise known as the haystack. * @return string The string with the replaced values. */ function _deep_replace( $search, $subject ) { $subject = (string) $subject; $count = 1; while ( $count ) { $subject = str_replace( $search, '', $subject, $count ); } return $subject; } /** * Escapes data for use in a MySQL query. * * Usually you should prepare queries using wpdb::prepare(). * Sometimes, spot-escaping is required or useful. One example * is preparing an array for use in an IN clause. * * NOTE: Since 4.8.3, '%' characters will be replaced with a placeholder string, * this prevents certain SQLi attacks from taking place. This change in behavior * may cause issues for code that expects the return value of esc_sql() to be usable * for other purposes. * * @since 2.8.0 * * @global wpdb $wpdb WordPress database abstraction object. * * @param string|array $data Unescaped data. * @return string|array Escaped data, in the same type as supplied. */ function esc_sql( $data ) { global $wpdb; return $wpdb->_escape( $data ); } /** * Checks and cleans a URL. * * A number of characters are removed from the URL. If the URL is for displaying * (the default behavior) ampersands are also replaced. The {@see 'clean_url'} filter * is applied to the returned cleaned URL. * * @since 2.8.0 * * @param string $url The URL to be cleaned. * @param string[] $protocols Optional. An array of acceptable protocols. * Defaults to return value of wp_allowed_protocols(). * @param string $_context Private. Use sanitize_url() for database usage. * @return string The cleaned URL after the {@see 'clean_url'} filter is applied. * An empty string is returned if `$url` specifies a protocol other than * those in `$protocols`, or if `$url` contains an empty string. */ function esc_url( $url, $protocols = null, $_context = 'display' ) { $original_url = $url; if ( '' === $url ) { return $url; } $url = str_replace( ' ', '%20', ltrim( $url ) ); $url = preg_replace( '|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\\x80-\\xff]|i', '', $url ); if ( '' === $url ) { return $url; } if ( 0 !== stripos( $url, 'mailto:' ) ) { $strip = array( '%0d', '%0a', '%0D', '%0A' ); $url = _deep_replace( $strip, $url ); } $url = str_replace( ';//', '://', $url ); /* * If the URL doesn't appear to contain a scheme, we presume * it needs http:// prepended (unless it's a relative link * starting with /, # or ?, or a PHP file). */ if ( ! str_contains( $url, ':' ) && ! in_array( $url[0], array( '/', '#', '?' ), true ) && ! preg_match( '/^[a-z0-9-]+?\.php/i', $url ) ) { $url = 'http://' . $url; } // Replace ampersands and single quotes only when displaying. if ( 'display' === $_context ) { $url = wp_kses_normalize_entities( $url ); $url = str_replace( '&', '&', $url ); $url = str_replace( "'", ''', $url ); } if ( str_contains( $url, '[' ) || str_contains( $url, ']' ) ) { $parsed = wp_parse_url( $url ); $front = ''; if ( isset( $parsed['scheme'] ) ) { $front .= $parsed['scheme'] . '://'; } elseif ( '/' === $url[0] ) { $front .= '//'; } if ( isset( $parsed['user'] ) ) { $front .= $parsed['user']; } if ( isset( $parsed['pass'] ) ) { $front .= ':' . $parsed['pass']; } if ( isset( $parsed['user'] ) || isset( $parsed['pass'] ) ) { $front .= '@'; } if ( isset( $parsed['host'] ) ) { $front .= $parsed['host']; } if ( isset( $parsed['port'] ) ) { $front .= ':' . $parsed['port']; } $end_dirty = str_replace( $front, '', $url ); $end_clean = str_replace( array( '[', ']' ), array( '%5B', '%5D' ), $end_dirty ); $url = str_replace( $end_dirty, $end_clean, $url ); } if ( '/' === $url[0] ) { $good_protocol_url = $url; } else { if ( ! is_array( $protocols ) ) { $protocols = wp_allowed_protocols(); } $good_protocol_url = wp_kses_bad_protocol( $url, $protocols ); if ( strtolower( $good_protocol_url ) !== strtolower( $url ) ) { return ''; } } /** * Filters a string cleaned and escaped for output as a URL. * * @since 2.3.0 * * @param string $good_protocol_url The cleaned URL to be returned. * @param string $original_url The URL prior to cleaning. * @param string $_context If 'display', replace ampersands and single quotes only. */ return apply_filters( 'clean_url', $good_protocol_url, $original_url, $_context ); } /** * Sanitizes a URL for database or redirect usage. * * This function is an alias for sanitize_url(). * * @since 2.8.0 * @since 6.1.0 Turned into an alias for sanitize_url(). * * @see sanitize_url() * * @param string $url The URL to be cleaned. * @param string[] $protocols Optional. An array of acceptable protocols. * Defaults to return value of wp_allowed_protocols(). * @return string The cleaned URL after sanitize_url() is run. */ function esc_url_raw( $url, $protocols = null ) { return sanitize_url( $url, $protocols ); } /** * Sanitizes a URL for database or redirect usage. * * @since 2.3.1 * @since 2.8.0 Deprecated in favor of esc_url_raw(). * @since 5.9.0 Restored (un-deprecated). * * @see esc_url() * * @param string $url The URL to be cleaned. * @param string[] $protocols Optional. An array of acceptable protocols. * Defaults to return value of wp_allowed_protocols(). * @return string The cleaned URL after esc_url() is run with the 'db' context. */ function sanitize_url( $url, $protocols = null ) { return esc_url( $url, $protocols, 'db' ); } /** * Converts entities, while preserving already-encoded entities. * * @link https://www.php.net/htmlentities Borrowed from the PHP Manual user notes. * * @since 1.2.2 * * @param string $text The text to be converted. * @return string Converted text. */ function htmlentities2( $text ) { $translation_table = get_html_translation_table( HTML_ENTITIES, ENT_QUOTES ); $translation_table[ chr( 38 ) ] = '&'; return preg_replace( '/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,3};)/', '&', strtr( $text, $translation_table ) ); } /** * Escapes single quotes, `"`, `<`, `>`, `&`, and fixes line endings. * * Escapes text strings for echoing in JS. It is intended to be used for inline JS * (in a tag attribute, for example `onclick="..."`). Note that the strings have to * be in single quotes. The {@see 'js_escape'} filter is also applied here. * * @since 2.8.0 * * @param string $text The text to be escaped. * @return string Escaped text. */ function esc_js( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $safe_text = _wp_specialchars( $safe_text, ENT_COMPAT ); $safe_text = preg_replace( '/&#(x)?0*(?(1)27|39);?/i', "'", stripslashes( $safe_text ) ); $safe_text = str_replace( "\r", '', $safe_text ); $safe_text = str_replace( "\n", '\\n', addslashes( $safe_text ) ); /** * Filters a string cleaned and escaped for output in JavaScript. * * Text passed to esc_js() is stripped of invalid or special characters, * and properly slashed for output. * * @since 2.0.6 * * @param string $safe_text The text after it has been escaped. * @param string $text The text prior to being escaped. */ return apply_filters( 'js_escape', $safe_text, $text ); } /** * Escaping for HTML blocks. * * @since 2.8.0 * * @param string $text * @return string */ function esc_html( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES ); /** * Filters a string cleaned and escaped for output in HTML. * * Text passed to esc_html() is stripped of invalid or special characters * before output. * * @since 2.8.0 * * @param string $safe_text The text after it has been escaped. * @param string $text The text prior to being escaped. */ return apply_filters( 'esc_html', $safe_text, $text ); } /** * Escaping for HTML attributes. * * @since 2.8.0 * * @param string $text * @return string */ function esc_attr( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES ); /** * Filters a string cleaned and escaped for output in an HTML attribute. * * Text passed to esc_attr() is stripped of invalid or special characters * before output. * * @since 2.0.6 * * @param string $safe_text The text after it has been escaped. * @param string $text The text prior to being escaped. */ return apply_filters( 'attribute_escape', $safe_text, $text ); } /** * Escaping for textarea values. * * @since 3.1.0 * * @param string $text * @return string */ function esc_textarea( $text ) { $safe_text = htmlspecialchars( $text, ENT_QUOTES, get_option( 'blog_charset' ) ); /** * Filters a string cleaned and escaped for output in a textarea element. * * @since 3.1.0 * * @param string $safe_text The text after it has been escaped. * @param string $text The text prior to being escaped. */ return apply_filters( 'esc_textarea', $safe_text, $text ); } /** * Escaping for XML blocks. * * @since 5.5.0 * * @param string $text Text to escape. * @return string Escaped text. */ function esc_xml( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $cdata_regex = '\<\!\[CDATA\[.*?\]\]\>'; $regex = <<(.*?)) # the "anything" matched by the lookahead (?({$cdata_regex})) # the CDATA Section matched by the lookahead | # alternative (?(.*)) # non-CDATA Section /sx EOF; $safe_text = (string) preg_replace_callback( $regex, static function ( $matches ) { if ( ! isset( $matches[0] ) ) { return ''; } if ( isset( $matches['non_cdata'] ) ) { // escape HTML entities in the non-CDATA Section. return _wp_specialchars( $matches['non_cdata'], ENT_XML1 ); } // Return the CDATA Section unchanged, escape HTML entities in the rest. return _wp_specialchars( $matches['non_cdata_followed_by_cdata'], ENT_XML1 ) . $matches['cdata']; }, $safe_text ); /** * Filters a string cleaned and escaped for output in XML. * * Text passed to esc_xml() is stripped of invalid or special characters * before output. HTML named character references are converted to their * equivalent code points. * * @since 5.5.0 * * @param string $safe_text The text after it has been escaped. * @param string $text The text prior to being escaped. */ return apply_filters( 'esc_xml', $safe_text, $text ); } /** * Escapes an HTML tag name. * * @since 2.5.0 * @since 6.5.5 Allow hyphens in tag names (i.e. custom elements). * * @param string $tag_name * @return string */ function tag_escape( $tag_name ) { $safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9-_:]/', '', $tag_name ) ); /** * Filters a string cleaned and escaped for output as an HTML tag. * * @since 2.8.0 * * @param string $safe_tag The tag name after it has been escaped. * @param string $tag_name The text before it was escaped. */ return apply_filters( 'tag_escape', $safe_tag, $tag_name ); } /** * Converts full URL paths to absolute paths. * * Removes the http or https protocols and the domain. Keeps the path '/' at the * beginning, so it isn't a true relative link, but from the web root base. * * @since 2.1.0 * @since 4.1.0 Support was added for relative URLs. * * @param string $link Full URL path. * @return string Absolute path. */ function wp_make_link_relative( $link ) { return preg_replace( '|^(https?:)?//[^/]+(/?.*)|i', '$2', $link ); } /** * Sanitizes various option values based on the nature of the option. * * This is basically a switch statement which will pass $value through a number * of functions depending on the $option. * * @since 2.0.5 * * @global wpdb $wpdb WordPress database abstraction object. * * @param string $option The name of the option. * @param mixed $value The unsanitized value. * @return mixed Sanitized value. */ function sanitize_option( $option, $value ) { global $wpdb; $original_value = $value; $error = null; switch ( $option ) {