<?xml version="1.0" encoding="UTF-8"?>
<!-- generator="bbPress/1.0.1" -->
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom">
	<channel>
		<title>Gravity Support Forums Topic: Filtering HTML, Questions, and Descriptions</title>
		<link>https://legacy.forums.gravityhelp.com/topic/filtering-html-questions-and-descriptions</link>
		<description>Gravity Support Forums Topic: Filtering HTML, Questions, and Descriptions</description>
		<language>en-US</language>
		<pubDate>Fri, 17 Apr 2026 05:30:12 +0000</pubDate>
		<generator>http://bbpress.org/?v=1.0.1</generator>
		<textInput>
			<title><![CDATA[Search]]></title>
			<description><![CDATA[Search all topics from these forums.]]></description>
			<name>q</name>
			<link>https://legacy.forums.gravityhelp.com/search.php</link>
		</textInput>
		<atom:link href="https://legacy.forums.gravityhelp.com/rss/topic/filtering-html-questions-and-descriptions" rel="self" type="application/rss+xml" />

		<item>
			<title>Alex Cancado on "Filtering HTML, Questions, and Descriptions"</title>
			<link>https://legacy.forums.gravityhelp.com/topic/filtering-html-questions-and-descriptions#post-12533</link>
			<pubDate>Thu, 11 Nov 2010 17:05:22 +0000</pubDate>
			<dc:creator>Alex Cancado</dc:creator>
			<guid isPermaLink="false">12533@https://legacy.forums.gravityhelp.com/</guid>
			<description>&#60;p&#62;You could use the gform_pre_render filter to escape those fields, but that hook only runs on the front end. So they would be still be executed in the form editor.&#60;br /&#62;
I am not sure we will have a completely secure solution for this problem.&#60;/p&#62;
&#60;pre&#62;&#60;code&#62;add_filter(&#38;quot;gform_pre_render&#38;quot;, test_render);
function test_render($form){
    $form[&#38;quot;description&#38;quot;] = esc_html($form[&#38;quot;description&#38;quot;]);
    foreach($form[&#38;quot;fields&#38;quot;] as &#38;amp;$field){
        $field[&#38;quot;description&#38;quot;] = esc_html($field[&#38;quot;description&#38;quot;]);
    }
    return $form;
}&#60;/code&#62;&#60;/pre&#62;</description>
		</item>
		<item>
			<title>UWEX on "Filtering HTML, Questions, and Descriptions"</title>
			<link>https://legacy.forums.gravityhelp.com/topic/filtering-html-questions-and-descriptions#post-12526</link>
			<pubDate>Thu, 11 Nov 2010 16:15:11 +0000</pubDate>
			<dc:creator>UWEX</dc:creator>
			<guid isPermaLink="false">12526@https://legacy.forums.gravityhelp.com/</guid>
			<description>&#60;p&#62;We run a MultiSite network and our users lack the ability to use code such as iframe, embed, and &#38;lt;script&#38;gt; in their pages/posts.&#60;/p&#62;
&#60;p&#62;Unfortunately, via either the HTML &#34;question&#34; type, the form's Description, or even any question's description, it appears that people can do this stuff. :(&#60;/p&#62;
&#60;p&#62;Is there an easy way to strip out the same potentially dangerous content from all these sections that WordPress strips out by default for non-super-admins?
&#60;/p&#62;</description>
		</item>

	</channel>
</rss>
