Where do we use wp_kses? Where should we use it?

[benlk]

From #1168:

I'm not necessarily opposed to using wp_kses here (although I think it's overkill) but if we do it here...why aren't we using it for every text field in the theme options? For category/term descriptions? Everywhere else? It would make a lot more sense to have a globally allowed list of tags for user-entered description text. It's weird to make this the only exception and then it also makes the docs here way too heavy-handed. This should be re-thought.

Questions:

• what text fields do we sanitize with wp_kses or similar functions?
• what text fields do we not sanitize?
• what text fields should we sanitize?
• what level of sanitization should each text field use?

This might require a spreadsheet. 😢

[benlk]

#1196 is a documentation improvement that will hopefully help prevent the necessity of wp_kses.

[rclations]

some useful info on wp_kses() - https://www.tollmanz.com/wp-kses-performance/