bbp_sanitize_displayed_user_field( string $value = '', string $field = '', string $context = 'display' )
Sanitize displayed user data, when viewing and editing any user.
Description
This somewhat monolithic function handles the escaping and sanitization of user data for a Forums profile. There are two reasons this all happers here:
-
Forums took a similar approach to WordPress, and funnels all user profile data through a central helper. This eventually calls sanitize_user_field() which applies a few context based filters, which some third party plugins might be relying on Forums to play nicely with.
-
Early versions of bbPress 2.x templates did not escape this data meaning a backwards compatible approach like this one was necessary to protect existing installations that may have custom template parts.
Parameters
- $value
-
(Optional)
Default value: ''
- $field
-
(Optional)
Default value: ''
- $context
-
(Optional)
Default value: 'display'
Return
(string)
Source
File: bp-forums/users/functions.php
function bbp_sanitize_displayed_user_field( $value = '', $field = '', $context = 'display' ) { // Bail if not editing or displaying (maybe we'll do more here later) if ( ! in_array( $context, array( 'edit', 'display' ) ) ) { return $value; } // By default, no filter set (consider making this an array later) $filter = false; // Big switch statement to decide which user field we're sanitizing and how switch ( $field ) { // Description is a paragraph case 'description' : $filter = ( 'edit' === $context ) ? '' : 'wp_kses_data'; break; // Email addresses are sanitized with a specific function case 'user_email' : $filter = 'sanitize_email'; break; // Name & login fields case 'user_login' : case 'display_name' : case 'first_name' : case 'last_name' : case 'nick_name' : $filter = ( 'edit' === $context ) ? 'esc_attr' : 'esc_html'; break; // wp-includes/default-filters.php escapes this for us via esc_url() case 'user_url' : break; } // Run any applicable filters on the value if ( ! empty( $filter ) ) { $value = call_user_func( $filter, $value ); } return $value; }
Changelog
Version | Description |
---|---|
bbPress (r5368) | Introduced. |
Questions?
We're always happy to help with code or other questions you might have! Search our developer docs, contact support, or connect with our sales team.