AdvancedCustomFields / AdvancedCustomFields/acf
HTML Codes are not getting escaped in text fields
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 945
- Forks
- 197
- PR merge metrics
- No merged PRs in 30d
Description
Is there a possibility to escape the values of the text fields? Or is there any options to set this?
The problem I encounter is that after setting HTML-Codes like ­ or & in text fields, they are not showing.
When someone is editing the field, he cannot see the specified codes in the field. This can be a problem because the content creators of this backend are not technically affine and can't inspect the elements and look into the values.
The Input before updating and refreshing:

After updating and refreshing:

The temporary fix I made is directly in the plugin, where the values are set to the field:
wp-content/plugins/advanced-custom-fields/includes/fields/class-acf-field-text.php
// Input.
$input_attrs = array();
foreach( array( 'type', 'id', 'class', 'name', 'value', 'placeholder', 'maxlength', 'pattern', 'readonly', 'disabled', 'required' )
as $k ) {
if( isset($field[ $k ]) ) {
/*
escaping values
*/
if ($k == 'value') {
$input_attrs[$k] = htmlspecialchars($field[$k], ENT_QUOTES);
} else {
$input_attrs[$k] = $field[$k];
}
}
}
Is there any solution to fix this?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in wp-content/plugins/advanced-custom-fields/includes/fields/class-acf-field-text.php, where the text-field input attributes and value are set. Reproduce the issue with values such as and &, then verify that the codes remain visible while editing the field after saving and refreshing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100