XSS prevention in Wordpress - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to safely output a user input in WordPress.

Wordpress

<?php echo [1]($_GET['user_input']); ?>

Drag options to blanks, or click blank then click option'

Aprint_r

Besc_html

Cvar_dump

Dhtmlspecialchars_decode

Attempts:

3 left

💡 Hint

Common Mistakes

Using print_r or var_dump which do not escape output

Using htmlspecialchars_decode which decodes entities

Use esc_html to safely escape HTML characters and prevent XSS.

2fill in blank

medium

Complete the code to sanitize a text input before saving in WordPress.

Wordpress

$safe_text = [1]($_POST['comment']);

Drag options to blanks, or click blank then click option'

Asanitize_email

Bwp_kses_post

Csanitize_text_field

Desc_url

Attempts:

3 left

💡 Hint

Common Mistakes

Using sanitize_email for non-email input

Using esc_url which is for URLs

sanitize_text_field cleans text input by stripping tags and harmful content.

3fill in blank

hard

Fix the error in escaping a URL output in WordPress.

Wordpress

<a href="[1]($url)">Link</a>

Drag options to blanks, or click blank then click option'

Aesc_url

Besc_url_raw

Cesc_html

Dsanitize_text_field

Attempts:

3 left

💡 Hint

Common Mistakes

Using esc_html which is for HTML content, not URLs

Using esc_url_raw which is for saving URLs, not output

esc_url properly escapes URLs for safe output in HTML attributes.

4fill in blank

hard

Fill both blanks to allow safe HTML tags in user input and output it.

Wordpress

<?php $allowed_tags = [1](); echo [2]($user_input, $allowed_tags); ?>

Drag options to blanks, or click blank then click option'

Awp_kses_allowed_html

Besc_html

Cwp_kses

Dsanitize_text_field

Attempts:

3 left

💡 Hint

Common Mistakes

Using esc_html which escapes all HTML

Using sanitize_text_field which strips all tags

wp_kses_allowed_html returns allowed HTML tags, and wp_kses filters input to allow only those tags.

5fill in blank

hard

Fill all three blanks to create a safe attribute output with a default fallback.

Wordpress

<?php $title = isset($data['title']) ? [1]($data['title']) : [2]; echo '<h1 title="' . [3]($title) . '">' . $title . '</h1>'; ?>

Drag options to blanks, or click blank then click option'

Asanitize_text_field

B"Default Title"

Cesc_attr

Desc_html

Attempts:

3 left

💡 Hint

Common Mistakes

Not escaping attribute output

Using esc_html instead of esc_attr for attributes

sanitize_text_field cleans the input, "Default Title" is fallback text, and esc_attr safely escapes the attribute.