AdvancedCustomFields / AdvancedCustomFields/acf

HTML Codes are not getting escaped in text fields

Open
#487 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
945
Forks
197
PR merge metrics
No merged PRs in 30d

Description

Is there a possibility to escape the values of the text fields? Or is there any options to set this?

The problem I encounter is that after setting HTML-Codes like ­ or & in text fields, they are not showing.

When someone is editing the field, he cannot see the specified codes in the field. This can be a problem because the content creators of this backend are not technically affine and can't inspect the elements and look into the values.

The Input before updating and refreshing:
image

After updating and refreshing:
image

The temporary fix I made is directly in the plugin, where the values are set to the field:
wp-content/plugins/advanced-custom-fields/includes/fields/class-acf-field-text.php


// Input.
		$input_attrs = array();
		foreach( array( 'type', 'id', 'class', 'name', 'value', 'placeholder', 'maxlength', 'pattern', 'readonly', 'disabled', 'required' ) 
                as $k ) {
                
                      if( isset($field[ $k ]) ) {
                      /*
                          escaping values
                      */
                          if ($k == 'value') {
                              $input_attrs[$k] = htmlspecialchars($field[$k], ENT_QUOTES);
                          } else {
                              $input_attrs[$k] = $field[$k];
                          }
	              }
		}

Is there any solution to fix this?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in wp-content/plugins/advanced-custom-fields/includes/fields/class-acf-field-text.php, where the text-field input attributes and value are set. Reproduce the issue with values such as ­ and &, then verify that the codes remain visible while editing the field after saving and refreshing.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
frontend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.