« first day (2589 days earlier)      last day (2344 days later) » 

Tom J Nowell
Tom J Nowell
12:36 AM
__ doesn't escape
esc_html__ does
esc_html_e does, and echos at it too
I know some in WP Core will say escaping translation strings is being overzealous
but all it takes is one malicious translation file
having said that, review the translation file anyway, the n plurals code has an eval so you can sneak a PHP shell into a site via a translation script
 
 
2 hours later…
Jack Johansson
Jack Johansson
2:45 AM
What?! Eval in WP core? Where is it located? I tracked down the _n() and couldn't find it.
The only returned search result for eval in WP core is wp-admin/includes/class-plczip.php on line 4068 and it's been already commented out.
Btw I'm afraid of customers using malicious translation files, since I will give them the raw .po files to work with.
 
Tom J Nowell
Tom J Nowell
3:08 AM
it's in the translation system, a create_function call
 
Jack Johansson
Jack Johansson
Found it, translation.php I suppose.
 
Mark Kaplun
Mark Kaplun
4:07 AM
people here convinced me to use escaping. Where you need to add links for the translation you can use wp_kses
The problem is not so much with the user itself, but what happens if a third party supplies the translation.
 
 
5 hours later…
R1ddler
R1ddler
8:48 AM
This is my fiddle jsfiddle.net/eb78ct1g @How
@Howdy_McGee
 
 
6 hours later…
R1ddler
R1ddler
3:12 PM
Very quiet today, everyone's away on a Friday I guess :)
 
Howdy_McGee
Howdy_McGee
3:33 PM
@R1ddler With JSFiddle there are a few things you need to do to prepare it. In the Javascript panel you need to click the Gear icon and change the default framework from Vanilla JS to JQuery ( since Select2 needs to work with JQuery ).
Additionally, you need to include the Select2 files as external resources. On their installation page you'll find links to their CSS and JS via cdnjs which you can just copy and paste the URLs ( not the entire script ) into the External Resources box on the left-hand side, clicking the plus sign to add them.
Once all that is in place you'll find it works pretty much as seen in the examples.
 
R1ddler
R1ddler
3:48 PM
This is how the array is inserted in the DB
a:3:{i:0;s:3:"SOR";i:1;s:3:"PFI";i:2;s:7:"INVOICE";}
can I use in_array function on this
to check for example if it contains SOR to render that page
 
Howdy_McGee
Howdy_McGee
Technically, in the database it's a serialized array saved as a string. Once it's out of the database and unserialized you can use in_array(). You can probably use LIKE but may return more resutls than expected.
 
Tom J Nowell
Tom J Nowell
4:27 PM
@R1ddler I'd try to avoid storing serialised PHP as it's a great attack vector
a comma separated list, or json encode decode is a vast security improvement
 
R1ddler
R1ddler
4:47 PM
@TomJNowell would I still be able to use in_array with it?
how do I create a comma separated list
what would it look like as json_encode?
 
Tom J Nowell
Tom J Nowell
$string_containing_comma_list_of_stuff = implode( ',', $array_of_stuff );
$array_of_stuff = explode( ',', $string_of_stuff );
some things just take multiple steps, you don't thrust all the ingredients of a cake into your mouth on your birthday, you mix and cook them first, same here
you want to use in_array but a:3:{i:0;s:3:"SOR";i:1;s:3:"PFI";i:2;s:7:"INVOICE";} isn't an array
so turn it into one 
$string = json_encode( $array );
$array = json_decode( $string );
but this is all generic standard PHP basics
also keep in mind that by asking those kind of questions here, you're depriving yourself of reputation
and getting substandard answers
which were the top 2 results on google for "stack overflow json_encode"
Afterall you have 30 reputation on SO and 7 on our main site
getting past the 100 rep mark gives you 100 rep instantly on all Stack exchange sites, and gets rid of all the adverts
also means your chances of getting flagged by the antispam system are significantly reduced, no more question or answer blocks
ask lots of small, bitesized self contained questions
the sort you can then build up into your actual question
with that in mind, we really shouldn't be helping you with the core PHP library and language here, we're WP people, lets discuss WP
 

« first day (2589 days earlier)      last day (2344 days later) »