Support Forum
I remember that for security you've disabled storing javascript in a textarea, but you gave me a workaround that I can no longer find. I want to have the user store some html in a custom field in a Post, then use Beaver Themer to connect to that code and insert it into an html module on the Post Singular BB template.
Here's a sample of the code (only the data-id value changes on every Post)
<div class="into-container gn-immune cleanslate">
<a href="https://embed.lookin.to/badge/badge.bundle.js">https://embed.lookin.to/badge/badge.bundle.js</a>
</div>
How can I do that?
I looked at the documentation but I'm still having disabling sanitize for textarea field using the following code, can you point out what I'm doing wrong?
add_filter( 'rwmb_meta_boxes', function( $meta_boxes ) {
$meta_boxes[] = [
'title' => 'Team Field Group',
'fields' => [
[
'type' => 'textarea',
'id' => 'embed_code',
'name' => 'Widget Embed Code',
'sanitize_callback' => 'none',
]
],
];
return $meta_boxes;
} );
another example that doesn't work:
add_filter( 'rwmb_meta_boxes', function( $meta_boxes ) {
$meta_boxes[] = [
'title' => 'Story Field Group',
'fields' => [
[
'type' => 'textarea',
'id' => 'textarea_6dgymvsrfq5',
'name' => 'Full code snippet',
'sanitize_callback' => 'none',
]
],
];
return $meta_boxes;
} );
Hi,
I've tested and seen that the HTML data is stored correctly, and outputted correctly. Please see my video:
https://www.loom.com/share/9a597fe6bee64a6da559123dc84f4993
Maybe what you want is executing the script, not outputting its URL? Is that the script
tag or a
tag?
Wow! That was so simple!!
In reviewing the documentation regarding sanitization it was not clear that you can override the sanitization on any custom field you create by simply adding a "sanitize_callback" Attribute with the value= "none" in the Advanced tab on that field.
No coding necessary, nothing to add to the functions.php file, etc.
Could you somehow make this solution more visible in the documentation?
Thank you very much for staying with me on this and showing me how to solve my problem.
Hope you and everyone close are healthy and continue to stay healthy.
Pieter
Hi Pieter,
Thanks for your suggestion regarding the docs. I've just updated it here.
That’s a little more clear, but what’s missing is the screenshot showing how you can apply the sanitize_callback none so easily in a custom field advanced tab UI.
You say this:
Bypass The Sanitization
If you don’t want to sanitize the input value for a specific field (we don’t encourage this, obviously), then simply set the sanitize_callback to none:
And then you show the resulting code, but you never show where or how you set the sanitize_callback to none!
For me at least, I had no idea you could do that, and nowhere in the docs that I could find was a suggestion to use the advance tab attributes to do this. Maybe this is obvious to you, but I participate in a weekly WordPress support group that has PHP and JavaScript engineers, WordPress experts, and nobody could figure out how to do it. One of the reasons I use metabox and beaver builder and beaver Thiemer is to avoid hand coding. The actual solution is so simple and elegant, but it is not intuitive.
Thanks again for making such a great product.
Thanks a lot! I added a screenshot on that page, and also on field settings page.
That’s perfect +1
I made a blog post about it on my website too
https://wp-website-coach.com/code-snippet/storing-javascript-in-a-metabox-io-custom-field-textarea/
That's awesome! Thanks for sharing with other people!