@lkraav had I been known to make things that don't?.. :)

yes u php beginner u

Help flag this spam! wordpress.stackexchange.com/q/184666/59485

Is there any way to escape a string if it may contain HTML, CSS and JS?

escaping is purposeful and context sensitive. can't just escape whatever

Yeah, the problem is, that the API returns the complete styled HTML form code (including JS and CSS) as one big string.

@Sven strip_tags() has a second parameter.

strip_tags is meh and very basic, need to use real sanitizer if want to operate on html

Yea, but I cannot say what tags may be in the string. There is a drag and drop form builder on the other side; no idea what I will get back from there...

wp_kses_post()?

@lkraav I don't think I can filter anything; the string actually contains things like <script> and <style> tags...

I've wrapped it all in a filter, so users can opt-out and use their own form instead.

It's like embedding an iframe; fast to implement but not helpful at all.