: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
! preg_match( '/^[a-z0-9-]+?\.php/i', $url )
// Replace ampersands and single quotes only when displaying.
if ( 'display' === $_context ) {
$url = wp_kses_normalize_entities( $url );
$url = str_replace( '&', '&', $url );
$url = str_replace( "'", ''', $url );
if ( str_contains( $url, '[' ) || str_contains( $url, ']' ) ) {
$parsed = wp_parse_url( $url );
if ( isset( $parsed['scheme'] ) ) {
$front .= $parsed['scheme'] . '://';
} elseif ( '/' === $url[0] ) {
if ( isset( $parsed['user'] ) ) {
$front .= $parsed['user'];
if ( isset( $parsed['pass'] ) ) {
$front .= ':' . $parsed['pass'];
if ( isset( $parsed['user'] ) || isset( $parsed['pass'] ) ) {
if ( isset( $parsed['host'] ) ) {
$front .= $parsed['host'];
if ( isset( $parsed['port'] ) ) {
$front .= ':' . $parsed['port'];
$end_dirty = str_replace( $front, '', $url );
$end_clean = str_replace( array( '[', ']' ), array( '%5B', '%5D' ), $end_dirty );
$url = str_replace( $end_dirty, $end_clean, $url );
$good_protocol_url = $url;
if ( ! is_array( $protocols ) ) {
$protocols = wp_allowed_protocols();
$good_protocol_url = wp_kses_bad_protocol( $url, $protocols );
if ( strtolower( $good_protocol_url ) !== strtolower( $url ) ) {
* Filters a string cleaned and escaped for output as a URL.
* @param string $good_protocol_url The cleaned URL to be returned.
* @param string $original_url The URL prior to cleaning.
* @param string $_context If 'display', replace ampersands and single quotes only.
return apply_filters( 'clean_url', $good_protocol_url, $original_url, $_context );
* Sanitizes a URL for database or redirect usage.
* This function is an alias for sanitize_url().
* @since 6.1.0 Turned into an alias for sanitize_url().
* @param string $url The URL to be cleaned.
* @param string[] $protocols Optional. An array of acceptable protocols.
* Defaults to return value of wp_allowed_protocols().
* @return string The cleaned URL after sanitize_url() is run.
function esc_url_raw( $url, $protocols = null ) {
return sanitize_url( $url, $protocols );
* Sanitizes a URL for database or redirect usage.
* @since 2.8.0 Deprecated in favor of esc_url_raw().
* @since 5.9.0 Restored (un-deprecated).
* @param string $url The URL to be cleaned.
* @param string[] $protocols Optional. An array of acceptable protocols.
* Defaults to return value of wp_allowed_protocols().
* @return string The cleaned URL after esc_url() is run with the 'db' context.
function sanitize_url( $url, $protocols = null ) {
return esc_url( $url, $protocols, 'db' );
* Converts entities, while preserving already-encoded entities.
* @link https://www.php.net/htmlentities Borrowed from the PHP Manual user notes.
* @param string $text The text to be converted.
* @return string Converted text.
function htmlentities2( $text ) {
$translation_table = get_html_translation_table( HTML_ENTITIES, ENT_QUOTES );
$translation_table[ chr( 38 ) ] = '&';
return preg_replace( '/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,3};)/', '&', strtr( $text, $translation_table ) );
* Escapes single quotes, `"`, `<`, `>`, `&`, and fixes line endings.
* Escapes text strings for echoing in JS. It is intended to be used for inline JS
* (in a tag attribute, for example `onclick="..."`). Note that the strings have to
* be in single quotes. The {@see 'js_escape'} filter is also applied here.
* @param string $text The text to be escaped.
* @return string Escaped text.
function esc_js( $text ) {
$safe_text = wp_check_invalid_utf8( $text );
$safe_text = _wp_specialchars( $safe_text, ENT_COMPAT );
$safe_text = preg_replace( '/&#(x)?0*(?(1)27|39);?/i', "'", stripslashes( $safe_text ) );
$safe_text = str_replace( "\r", '', $safe_text );
$safe_text = str_replace( "\n", '\\n', addslashes( $safe_text ) );
* Filters a string cleaned and escaped for output in JavaScript.
* Text passed to esc_js() is stripped of invalid or special characters,
* and properly slashed for output.
* @param string $safe_text The text after it has been escaped.
* @param string $text The text prior to being escaped.
return apply_filters( 'js_escape', $safe_text, $text );
* Escaping for HTML blocks.
function esc_html( $text ) {
$safe_text = wp_check_invalid_utf8( $text );
$safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );
* Filters a string cleaned and escaped for output in HTML.
* Text passed to esc_html() is stripped of invalid or special characters
* @param string $safe_text The text after it has been escaped.
* @param string $text The text prior to being escaped.
return apply_filters( 'esc_html', $safe_text, $text );
* Escaping for HTML attributes.
function esc_attr( $text ) {
$safe_text = wp_check_invalid_utf8( $text );
$safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );
* Filters a string cleaned and escaped for output in an HTML attribute.
* Text passed to esc_attr() is stripped of invalid or special characters
* @param string $safe_text The text after it has been escaped.
* @param string $text The text prior to being escaped.
return apply_filters( 'attribute_escape', $safe_text, $text );
* Escaping for textarea values.
function esc_textarea( $text ) {
$safe_text = htmlspecialchars( $text, ENT_QUOTES, get_option( 'blog_charset' ) );
* Filters a string cleaned and escaped for output in a textarea element.
* @param string $safe_text The text after it has been escaped.
* @param string $text The text prior to being escaped.
return apply_filters( 'esc_textarea', $safe_text, $text );
* Escaping for XML blocks.
* @param string $text Text to escape.
* @return string Escaped text.
function esc_xml( $text ) {
$safe_text = wp_check_invalid_utf8( $text );
$cdata_regex = '\<\!\[CDATA\[.*?\]\]\>';
(?=.*?{$cdata_regex}) # lookahead that will match anything followed by a CDATA Section
(?<non_cdata_followed_by_cdata>(.*?)) # the "anything" matched by the lookahead
(?<cdata>({$cdata_regex})) # the CDATA Section matched by the lookahead
(?<non_cdata>(.*)) # non-CDATA Section
$safe_text = (string) preg_replace_callback(
static function ( $matches ) {
if ( ! isset( $matches[0] ) ) {
if ( isset( $matches['non_cdata'] ) ) {
// escape HTML entities in the non-CDATA Section.
return _wp_specialchars( $matches['non_cdata'], ENT_XML1 );
// Return the CDATA Section unchanged, escape HTML entities in the rest.
return _wp_specialchars( $matches['non_cdata_followed_by_cdata'], ENT_XML1 ) . $matches['cdata'];
* Filters a string cleaned and escaped for output in XML.
* Text passed to esc_xml() is stripped of invalid or special characters
* before output. HTML named character references are converted to their
* equivalent code points.
* @param string $safe_text The text after it has been escaped.
* @param string $text The text prior to being escaped.
return apply_filters( 'esc_xml', $safe_text, $text );
* Escapes an HTML tag name.
* @since 6.5.5 Allow hyphens in tag names (i.e. custom elements).
* @param string $tag_name
function tag_escape( $tag_name ) {
$safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9-_:]/', '', $tag_name ) );
* Filters a string cleaned and escaped for output as an HTML tag.
* @param string $safe_tag The tag name after it has been escaped.
* @param string $tag_name The text before it was escaped.
return apply_filters( 'tag_escape', $safe_tag, $tag_name );
* Converts full URL paths to absolute paths.
* Removes the http or https protocols and the domain. Keeps the path '/' at the
* beginning, so it isn't a true relative link, but from the web root base.
* @since 4.1.0 Support was added for relative URLs.
* @param string $link Full URL path.
* @return string Absolute path.
function wp_make_link_relative( $link ) {
return preg_replace( '|^(https?:)?//[^/]+(/?.*)|i', '$2', $link );
* Sanitizes various option values based on the nature of the option.
* This is basically a switch statement which will pass $value through a number
* of functions depending on the $option.
* @global wpdb $wpdb WordPress database abstraction object.
* @param string $option The name of the option.
* @param mixed $value The unsanitized value.
* @return mixed Sanitized value.
function sanitize_option( $option, $value ) {
$original_value = $value;
$value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value );
if ( is_wp_error( $value ) ) {
$error = $value->get_error_message();
$value = sanitize_email( $value );
if ( ! is_email( $value ) ) {
$error = __( 'The email address entered did not appear to be a valid email address. Please enter a valid email address.' );
case 'medium_large_size_w':
case 'medium_large_size_h':
case 'comment_max_links':
case 'rss_excerpt_length':
case 'default_email_category':
case 'default_link_category':
case 'close_comments_days_old':
case 'comments_per_page':
case 'thread_comments_depth':
case 'users_can_register':
$value = absint( $value );
case 'default_ping_status':
case 'default_comment_status':
// Options that if not there have 0 value but need to be something like "closed".
if ( '0' === (string) $value || '' === $value ) {
$value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value );
if ( $value !== $original_value ) {
$value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', wp_encode_emoji( $original_value ) );
if ( is_wp_error( $value ) ) {
$error = $value->get_error_message();
$value = esc_html( $value );
if ( is_string( $value ) ) {
$value = preg_replace( '/[^a-zA-Z0-9_-]/', '', $value ); // Strips slashes.
// This is the value if the settings checkbox is not checked on POST. Don't rely on this.
$value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value );
if ( is_wp_error( $value ) ) {
$error = $value->get_error_message();
$value = strip_tags( $value );
$value = wp_kses_data( $value );
$value = explode( "\n", $value );
$value = array_filter( array_map( 'trim', $value ) );
$value = array_filter( array_map( 'sanitize_url', $value ) );
$value = implode( "\n", $value );
if ( is_numeric( $value ) ) {
$value = preg_replace( '/[^0-9:.-]/', '', $value ); // Strips slashes.
$value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value );
if ( is_wp_error( $value ) ) {
$error = $value->get_error_message();
if ( preg_match( '#http(s?)://(.+)#i', $value ) ) {
$value = sanitize_url( $value );
$error = __( 'The WordPress address you entered did not appear to be a valid URL. Please enter a valid URL.' );
$value = $wpdb->strip_invalid_text_for_column( $wpdb->options, 'option_value', $value );
if ( is_wp_error( $value ) ) {
$error = $value->get_error_message();
if ( preg_match( '#http(s?)://(.+)#i', $value ) ) {
$value = sanitize_url( $value );
$error = __( 'The Site address you entered did not appear to be a valid URL. Please enter a valid URL.' );
$allowed = get_available_languages();
if ( ! is_multisite() && defined( 'WPLANG' ) && '' !== WPLANG && 'en_US' !== WPLANG ) {
if ( ! in_array( $value, $allowed, true ) && ! empty( $value ) ) {
$value = get_option( $option );
It is recommended that you Edit text format, this type of Fix handles quite a lot in one request
