'ϑ' => 'ϑ',
'ℵ' => 'ℵ',
return str_replace( array_keys( $to_ncr ), array_values( $to_ncr ), $text );
* Formats text for the editor.
* Generally the browsers treat everything inside a textarea as text, but
* it is still a good idea to HTML entity encode `<`, `>` and `&` in the content.
* The filter {@see 'format_for_editor'} is applied here. If `$text` is empty the
* filter will be applied to an empty string.
* @see _WP_Editors::editor()
* @param string $text The text to be formatted.
* @param string $default_editor The default editor for the current user.
* It is usually either 'html' or 'tinymce'.
* @return string The formatted text after filter is applied.
function format_for_editor( $text, $default_editor = null ) {
$text = htmlspecialchars( $text, ENT_NOQUOTES, get_option( 'blog_charset' ) );
* Filters the text after it is formatted for the editor.
* @param string $text The formatted text.
* @param string $default_editor The default editor for the current user.
* It is usually either 'html' or 'tinymce'.
return apply_filters( 'format_for_editor', $text, $default_editor );
* Perform a deep string replace operation to ensure the values in $search are no longer present
* Repeats the replacement operation until it no longer replaces anything so as to remove "nested" values
* e.g. $subject = '%0%0%0DDD', $search ='%0D', $result ='' rather than the '%0%0DD' that
* str_replace would return
* @param string|array $search The value being searched for, otherwise known as the needle.
* An array may be used to designate multiple needles.
* @param string $subject The string being searched and replaced on, otherwise known as the haystack.
* @return string The string with the replaced values.
function _deep_replace( $search, $subject ) {
$subject = (string) $subject;
$subject = str_replace( $search, '', $subject, $count );
* Escapes data for use in a MySQL query.
* Usually you should prepare queries using wpdb::prepare().
* Sometimes, spot-escaping is required or useful. One example
* is preparing an array for use in an IN clause.
* NOTE: Since 4.8.3, '%' characters will be replaced with a placeholder string,
* this prevents certain SQLi attacks from taking place. This change in behaviour
* may cause issues for code that expects the return value of esc_sql() to be useable
* @global wpdb $wpdb WordPress database abstraction object.
* @param string|array $data Unescaped data
* @return string|array Escaped data
function esc_sql( $data ) {
return $wpdb->_escape( $data );
* Checks and cleans a URL.
* A number of characters are removed from the URL. If the URL is for displaying
* (the default behaviour) ampersands are also replaced. The {@see 'clean_url'} filter
* is applied to the returned cleaned URL.
* @param string $url The URL to be cleaned.
* @param string[] $protocols Optional. An array of acceptable protocols.
* Defaults to return value of wp_allowed_protocols().
* @param string $_context Private. Use esc_url_raw() for database usage.
* @return string The cleaned URL after the {@see 'clean_url'} filter is applied.
* An empty string is returned if `$url` specifies a protocol other than
* those in `$protocols`, or if `$url` contains an empty string.
function esc_url( $url, $protocols = null, $_context = 'display' ) {
$url = str_replace( ' ', '%20', ltrim( $url ) );
$url = preg_replace( '|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\\x80-\\xff]|i', '', $url );
if ( 0 !== stripos( $url, 'mailto:' ) ) {
$strip = array( '%0d', '%0a', '%0D', '%0A' );
$url = _deep_replace( $strip, $url );
$url = str_replace( ';//', '://', $url );
* If the URL doesn't appear to contain a scheme, we presume
* it needs http:// prepended (unless it's a relative link
* starting with /, # or ?, or a PHP file).
if ( strpos( $url, ':' ) === false && ! in_array( $url[0], array( '/', '#', '?' ), true ) &&
! preg_match( '/^[a-z0-9-]+?\.php/i', $url ) ) {
// Replace ampersands and single quotes only when displaying.
if ( 'display' === $_context ) {
$url = wp_kses_normalize_entities( $url );
$url = str_replace( '&', '&', $url );
$url = str_replace( "'", ''', $url );
if ( ( false !== strpos( $url, '[' ) ) || ( false !== strpos( $url, ']' ) ) ) {
$parsed = wp_parse_url( $url );
if ( isset( $parsed['scheme'] ) ) {
$front .= $parsed['scheme'] . '://';
} elseif ( '/' === $url[0] ) {
if ( isset( $parsed['user'] ) ) {
$front .= $parsed['user'];
if ( isset( $parsed['pass'] ) ) {
$front .= ':' . $parsed['pass'];
if ( isset( $parsed['user'] ) || isset( $parsed['pass'] ) ) {
if ( isset( $parsed['host'] ) ) {
$front .= $parsed['host'];
if ( isset( $parsed['port'] ) ) {
$front .= ':' . $parsed['port'];
$end_dirty = str_replace( $front, '', $url );
$end_clean = str_replace( array( '[', ']' ), array( '%5B', '%5D' ), $end_dirty );
$url = str_replace( $end_dirty, $end_clean, $url );
$good_protocol_url = $url;
if ( ! is_array( $protocols ) ) {
$protocols = wp_allowed_protocols();
$good_protocol_url = wp_kses_bad_protocol( $url, $protocols );
if ( strtolower( $good_protocol_url ) != strtolower( $url ) ) {
* Filters a string cleaned and escaped for output as a URL.
* @param string $good_protocol_url The cleaned URL to be returned.
* @param string $original_url The URL prior to cleaning.
* @param string $_context If 'display', replace ampersands and single quotes only.
return apply_filters( 'clean_url', $good_protocol_url, $original_url, $_context );
* Performs esc_url() for database usage.
* @param string $url The URL to be cleaned.
* @param string[] $protocols Optional. An array of acceptable protocols.
* Defaults to return value of wp_allowed_protocols().
* @return string The cleaned URL after esc_url() is run with the 'db' context.
function esc_url_raw( $url, $protocols = null ) {
return esc_url( $url, $protocols, 'db' );
* Convert entities, while preserving already-encoded entities.
* @link https://www.php.net/htmlentities Borrowed from the PHP Manual user notes.
* @param string $myHTML The text to be converted.
* @return string Converted text.
function htmlentities2( $myHTML ) {
$translation_table = get_html_translation_table( HTML_ENTITIES, ENT_QUOTES );
$translation_table[ chr( 38 ) ] = '&';
return preg_replace( '/&(?![A-Za-z]{0,4}\w{2,3};|#[0-9]{2,3};)/', '&', strtr( $myHTML, $translation_table ) );
* Escape single quotes, htmlspecialchar " < > &, and fix line endings.
* Escapes text strings for echoing in JS. It is intended to be used for inline JS
* (in a tag attribute, for example onclick="..."). Note that the strings have to
* be in single quotes. The {@see 'js_escape'} filter is also applied here.
* @param string $text The text to be escaped.
* @return string Escaped text.
function esc_js( $text ) {
$safe_text = wp_check_invalid_utf8( $text );
$safe_text = _wp_specialchars( $safe_text, ENT_COMPAT );
$safe_text = preg_replace( '/&#(x)?0*(?(1)27|39);?/i', "'", stripslashes( $safe_text ) );
$safe_text = str_replace( "\r", '', $safe_text );
$safe_text = str_replace( "\n", '\\n', addslashes( $safe_text ) );
* Filters a string cleaned and escaped for output in JavaScript.
* Text passed to esc_js() is stripped of invalid or special characters,
* and properly slashed for output.
* @param string $safe_text The text after it has been escaped.
* @param string $text The text prior to being escaped.
return apply_filters( 'js_escape', $safe_text, $text );
* Escaping for HTML blocks.
It is recommended that you Edit text format, this type of Fix handles quite a lot in one request
