shortcode API > $content > TINY MCE filters

[Haluk Karamete]

When, we place the following sample text into the text editor ( thru the
text tab right of the tiny MCE );

line1 & < >
line2

line3

and we save the post, we save it as is.

Carriage returns are preserved and the & < > stays as they are.

However, when this section makes it into a shortcode as part of the
$content portion.

the content becomes like this;

<p>line1 &#038; < ><br />

line2</p>
<p>line3</p>
<p>{args}<br />

Mind due the wp_posts.post_content field does not have those <br /> and <p>
add ons.
When my shortcode $content has the above red text, it appears in the DB as
follows;

line1 & < >

line2
line3

I'm wondering what's the best course of action for me to take in my
shortcode so that I can reverse this $content back to how it was stored in
the database?

If you are wondering, why on earth I'd do something ike this; here is the
reasoning;
I'm exploring some new things with the WordPress' shortcode system and I'm
using the content area which makes it into my shortcode function as
$content for storing structured data.

And when I see my structured data has been filtered and changed, I feel
like I have to undo all that changes so that I can get it exactly how it
was authored in Tiny MCE's Text Tab.
But I do not want to get into a bunch of replacestring operations to
achieve that.

What's the best way to address this problem?

I also noticed that when you do a quick click on visual tab and then
another quick click back on the TEXT tab, I end up changing this original
text

line1 & < >
line2

line3

into this;

line1 &amp; &lt; &gt;
line2

line3

Though, this part is not as important as my first question, but I'm very
curious to know thw wisdom to do so. I'm also wondering if there are ways
to prevent that from happening and what would be harms of doing so? Is
that to take care of an XSS issues?

[Xavier Faraudo i Gener]

Hello,

The filters for content are tricky, specially wptexturize and wpautop.
(Which, if I don't remember it wrong, sets single line breaks to br tag,
and doubles to p tag.) Removing them is IMHO a very bad idea, but
setting them to another priority may be useful in some cases. You're
risking conflicts with other author's plugins and shortcodes, though.

I've been toying with shortcode system for a bit now (doing things like
the BBCode syntax of [code=value /] or nesting the very same shortcode,
for instance, which actually are pretty easy things to do once you look
at how shortcode atts are parsed). For your issue with "structured data"
into shortcodes, I'd suggest to structure the params in a semantically
meaningful way, using shortcodes for params in a similar way to object
and param HTML tags, like this:

[complex_shortcode]
[complex_shortcode_param_1]value 1[/complex_shortcode_param_1]
[complex_shortcode_param_2]value 2[/complex_shortcode_param_2]
[/complex_shortcode]

Use then the param shortcodes to parse and *properly sanitize* values,
store them in a global var (prefix it with underscore _ to show it's a
private use var), and retrieve the values from the complex_shortcode
function. Just make sure to do_shortcode *before* trying to access the
global vars (otherwise, they won't be properly populated).

All this, yes, is a bit like saying that if you don't like how WP
filters your values (something totally legit, BTW), filter them yourself
with your favo(u)rite flavo(u)r :). That's what I do and works fine for
me, but "your mileage may vary" :)

Note that using the params-shortcode technique, you are no longer
constrained by order of params, may have empty/null params, &c. Which
works great in combination with options to set defaults.

(snip)
When my shortcode $content has the above red text, it appears in the DB as
follows;
(/snip)

…are of little help when we're reading this list as plain text: we're
effectively HTML color blind.


Best,

Xavier

[Haluk Karamete]

Thanks Xavier, for your detailed response.

I ended up doing the following old-->new replacements and that set seemed
to take care of my structured-data issue. Now I am retriveing it exactly as
how I entered it.

&#038; --> &
<br /> --> "\n"
</p> -->
<p> -->

&#8211; --> -
&#8216; --> '
&#8221; --> "


// incase visual tab to text tab thing took place, the following takes care
of that problem

&amp; --> &
&gt --> >
&lt; --> <





On Wed, May 14, 2014 at 3:43 PM, Xavier Faraudo i Gener <

Post by Xavier Faraudo i Gener
Hello,
The filters for content are tricky, specially wptexturize and wpautop.
(Which, if I don't remember it wrong, sets single line breaks to br tag,
and doubles to p tag.) Removing them is IMHO a very bad idea, but setting
them to another priority may be useful in some cases. You're risking
conflicts with other author's plugins and shortcodes, though.
I've been toying with shortcode system for a bit now (doing things like
the BBCode syntax of [code=value /] or nesting the very same shortcode, for
instance, which actually are pretty easy things to do once you look at how
shortcode atts are parsed). For your issue with "structured data" into
shortcodes, I'd suggest to structure the params in a semantically
meaningful way, using shortcodes for params in a similar way to object and
[complex_shortcode]
[complex_shortcode_param_1]value 1[/complex_shortcode_param_1]
[complex_shortcode_param_2]value 2[/complex_shortcode_param_2]
[/complex_shortcode]
Use then the param shortcodes to parse and *properly sanitize* values,
store them in a global var (prefix it with underscore _ to show it's a
private use var), and retrieve the values from the complex_shortcode
function. Just make sure to do_shortcode *before* trying to access the
global vars (otherwise, they won't be properly populated).
All this, yes, is a bit like saying that if you don't like how WP filters
your values (something totally legit, BTW), filter them yourself with your
favo(u)rite flavo(u)r :). That's what I do and works fine for me, but "your
mileage may vary" :)
Note that using the params-shortcode technique, you are no longer
constrained by order of params, may have empty/null params, &c. Which works
great in combination with options to set defaults.
(snip)

Post by Haluk Karamete
When my shortcode $content has the above red text, it appears in the DB as
follows;
(/snip)

…are of little help when we're reading this list as plain text: we're
effectively HTML color blind.
Best,
Xavier
--
Xavier Faraudo i Gener (the WordPress Web Warlock)
_______________________________________________
wp-hackers mailing list
http://lists.automattic.com/mailman/listinfo/wp-hackers