wp_kses_bad_protocol ( $string, $allowed_protocols )

  • (string) $string Content to filter bad protocols from.
  • (string[]) $allowed_protocols Array of allowed URL protocols.
  • (string) Filtered content.
Defined at:


Sanitizes a string and removed disallowed URL protocols.

This function removes all non-allowed protocols from the beginning of the string. It ignores whitespace and the case of the letters, and it does understand HTML entities. It does its work recursively, so it won't be fooled by a string like javascript:javascript:alert(57).

Related Functions

wp_kses_bad_protocol_once, wp_kses_bad_protocol_once2, wp_allowed_protocols, wp_kses_post, wp_get_server_protocol

Top Google Results

User discussions

wpseek mobile