Ready to get started?Download WordPress


Attention Interested in functions, hooks, classes, or methods? Check out the new WordPress Code Reference!

Function Reference/wp kses


This function makes sure that only the allowed HTML element names, attribute names and attribute values plus only sane HTML entities will occur in $string. You have to remove any slashes from PHP's magic quotes before you call this function.


 <?php wp_kses($string$allowed_html$allowed_protocols); ?> 


(string) (required) Content to filter through kses
Default: None
(array) (required) List of allowed HTML elements
Default: None
(array) (optional) Allow links in $string to these protocols.
Default: The default allowed protocols are http, https, ftp, mailto, news, irc, gopher, nntp, feed, and telnet. This covers all common link protocols, except for javascript, which should not be allowed for untrusted users.


Filtered string of HTML.


Allowed HTML Tags Array

This is an example of how to format an array of allowed HTML tags and attributes.

    'a' => array(
        'href' => array(),
        'title' => array()
    'br' => array(),
    'em' => array(),
    'strong' => array(),


  • KSES is a recursive acronym which stands for “KSES Strips Evil Scripts".

Change Log

  • Since: 1.0.0

Source File

wp_kses() is located in wp-includes/kses.php.


See: Data Validation article for an in-depth discussion of input and output sanitization.

See also index of Function Reference and index of Template Tags.