Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add new block development "Quick Start Guide" and update the
create-block-tutorial-template
#56056Add new block development "Quick Start Guide" and update the
create-block-tutorial-template
#56056Changes from 6 commits
dc77bb9
69b4bed
99f87a3
7cf262e
9c6b7a9
da7e499
8b0700d
91123cf
ec80777
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
This file was deleted.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see that the same
wp_kses_post
is used with many core blocks in certain scenarios. What's the reasoning behind using it at this level? I'm asking because in the case where we render the content as saved to the database then it doesn't differ much from not having therender
at all. In effect, I expect that the similar processing would happen somewhere else.I'm mostly trying to understand how it all really works in WordPress core today so it's clear for me when to use kses.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's always been a best practice to late escape anything that is being output to the browser that could be modified by a hook, filter, etc - https://developer.wordpress.org/apis/security/escaping/#toc_3
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If that would be an issue, then all core blocks would call
wp_kses_post
. However, it isn't the case. If this function is used, it's used to escape the content that comes from the user input when it is expected it might contain HTML. In the case of this block, it should be enough to cast thestartingYear
to the number and the rest should be safe.This file was deleted.