: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
if (self::valid_unicode($i)) {
$i = str_pad(ltrim($i, '0'), 3, '0', STR_PAD_LEFT);
* Callback for kses_normalize_entities() for regular expression.
* This function helps kses_normalize_entities() to only accept valid Unicode
* numeric entities in hex form.
* @param array $matches preg_replace_callback() matches array
* @return string Correctly encoded entity
public static function kses_normalize_entities3($matches) {
if (empty($matches[1])) return '';
return (!self::valid_unicode(hexdec($hexchars))) ? "&#x$hexchars;" : '&#x' . ltrim($hexchars, '0') . ';';
* Helper function to determine if a Unicode value is valid.
* @param int $i Unicode value
* @return bool True if the value was a valid Unicode number
private static function valid_unicode($i) {
return ($i == 0x9 || $i == 0xa || $i == 0xd || ($i >= 0x20 && $i <= 0xd7ff) || ($i >= 0xe000 && $i <= 0xfffd) || ($i >= 0x10000 && $i <= 0x10ffff));
* Escape single quotes, htmlspecialchar " < > &, and fix line endings.
* Escapes text strings for echoing in JS. It is intended to be used for inline JS
* (in a tag attribute, for example onclick="..."). Note that the strings have to
* be in single quotes. The {@see 'js_escape'} filter is also applied here.
* @param string $text The text to be escaped.
* @return string Escaped text.
public static function esc_js($text) {
$safe_text = self::check_invalid_utf8($text);
$safe_text = self::_specialchars($safe_text, ENT_COMPAT);
$safe_text = preg_replace('/&#(x)?0*(?(1)27|39);?/i', "'", stripslashes($safe_text));
$safe_text = str_replace("\r", '', $safe_text);
$safe_text = str_replace("\n", '\\n', addslashes($safe_text));
* Escaping for HTML blocks.
public static function esc_html($text) {
$safe_text = self::check_invalid_utf8($text);
$safe_text = self::_specialchars($safe_text, ENT_QUOTES);
* Escaping for HTML attributes.
public static function esc_attr($text) {
$safe_text = self::check_invalid_utf8($text);
$safe_text = self::_specialchars($safe_text, ENT_QUOTES);
* Escaping for textarea values.
public static function esc_textarea($text) {
$safe_text = htmlspecialchars($text, ENT_QUOTES, self::getCharset());
public static function remove_closing_style_tag($text) {
$safe_text = self::check_invalid_utf8($text);
return preg_replace_callback('/<\/style.*?>/i', function () {
public static function esc_css_value($text) {
$safe_text = self::check_invalid_utf8($text);
return preg_replace_callback('/[<>]/', function () {
public static function esc_css_string($cssString) {
$pairs = explode(';', trim($cssString));
foreach ($pairs as $pair) {
$keyValue = explode(':', trim($pair), 2);
if (count($keyValue) != 2) {
if (!preg_match('/^[a-zA-Z\-]+$/', $keyValue[0])) {
$output .= $keyValue[0] . ':' . self::esc_css_value(trim($keyValue[1])) . ';';
public static function filter_allowed_html($input, $extraTags = '') {
return self::filter_attributes_on(strip_tags($input, '<a><span><sub><sup><em><i><var><cite><b><strong><small><bdo><br><img><picture><source><u><del><bdi><ins>' . $extraTags));
public static function remove_all_html($input) {
return strip_tags($input);
public static function filter_attributes_on($input) {
if (class_exists('DOMDocument')) {
if (function_exists('libxml_use_internal_errors')) {
libxml_use_internal_errors(true);
$dom = new DOMDocument();
$dom->loadHTML('<?xml encoding="utf-8" ?><!DOCTYPE html><html lang="en"><body>' . $input . '</body></html>');
if (function_exists('libxml_use_internal_errors')) {
libxml_use_internal_errors(false);
for ($els = $dom->getElementsByTagname('*'), $i = $els->length - 1; $i >= 0; $i--) {
for ($attrs = $els->item($i)->attributes, $ii = $attrs->length - 1; $ii >= 0; $ii--) {
if (substr($attrs->item($ii)->name, 0, 2) === 'on') {
->removeAttribute($attrs->item($ii)->name);
if ($attrs->item($ii)->name === 'href' && strpos($attrs->item($ii)->value, 'javascript:') !== false) {
->removeAttribute($attrs->item($ii)->name);
$body = $dom->getElementsByTagName('body');
if ($body && 0 < $body->length) {
$childNodes = $body->childNodes;
if (!empty($childNodes)) {
foreach ($childNodes as $childNode) {
$output .= $dom->saveHTML($childNode);
} else if (function_exists('wp_kses_post')) {
return wp_kses_post($input);
public static function set_allowed_tags() {
$_allowedposttags = $allowedposttags;
if (N2JOOMLA || CUSTOM_TAGS) {
$_allowedposttags = array();
$wpAllowedposttags = array(
'value_callback' => '_wp_kses_allow_pdf_objects',
'values' => array('application/pdf'),
It is recommended that you Edit text format, this type of Fix handles quite a lot in one request
