自定义元框未显示将标记显示为空的值

时间：2020-01-28 作者：Krys

我已经创建了一个自定义元框插件和函数中的一个函数。php文件在页面上输出值。

meta框似乎正在工作，但是输入文本没有显示在图像的左侧，而且当我在浏览器中检查元素时，h3标记为空。

enter image description here这就是功能。php文件：

// Custom banner feature display in home page
function carolinaspa_banner()
{ ?>
<div class="banner">
    <div class="col-4">
        <h3><?php homepage_fields_get_meta(\'homepage_fields_banner_text\');  ?></h3>
    </div>
</div>
 <?php
 }
add_action(\'homepage\', \'carolinaspa_banner\', 80);
这是元框代码插件代码：

function homepage_fields_get_meta($value)
{
global $post;

$field = get_post_meta($post->ID, $value, true);
if (!empty($field)) {
    return is_array($field) ? stripslashes_deep($field) : stripslashes(wp_kses_decode_entities($field));
} else {
    return false;
}
}

function homepage_fields_add_meta_box()
{
add_meta_box(
    \'homepage_fields-homepage-fields\',
    \'homepage_fields\',
    \'homepage_fields_html\',
    \'page\',
    \'normal\',
    \'high\'
);
}
add_action(\'add_meta_boxes\', \'homepage_fields_add_meta_box\');

function homepage_fields_html($post)
{
wp_nonce_field(\'_homepage_fields_nonce\', \'homepage_fields_nonce\'); ?>

<p>
    <label for="homepage_fields_banner_text"><?php _e(\'Banner Text\'); ?></label><br>
    <input type="text" name="homepage_fields_banner_text" id="homepage_fields_banner_text" value="<?php echo homepage_fields_get_meta(\'homepage_fields_banner_text\'); ?>" size="30" />
</p><?php
    }

    function homepage_fields_save($post_id)
    {
        if (defined(\'DOING_AUTOSAVE\') && DOING_AUTOSAVE) return;
        if (!isset($_POST[\'homepage_fields_nonce\']) || !wp_verify_nonce($_POST[\'homepage_fields_nonce\'], \'_homepage_fields_nonce\')) return;
        if (!current_user_can(\'edit_post\', $post_id)) return;

        if (isset($_POST[\'homepage_fields_banner_text\']))
            update_post_meta($post_id, \'homepage_fields_banner_text\', esc_attr($_POST[\'homepage_fields_banner_text\']));
    }
    add_action(\'save_post\', \'homepage_fields_save\');
我觉得我做的每件事都是对的，但我可能遗漏了什么？

我试过解决这个问题，但事实证明很难。任何帮助都将不胜感激。谢谢

1 个回复
SO网友:Fabian Mossberg

I see that you guys might have solved this issue in the comments, but others might end up here, looking for an answer, so let\'s give it to them! :)

As pointed out by Michael, the problem here is that you didn\'t echo out the content. But there are also some other issues that should be fixed.

Whenever you are outputting or saving anything in WordPress, make sure you escape it. This is one of the parts of the WordPress Coding Standards, a set of rules made to keep a level of quality and consistency in your code.

In your functions.php, change this:

<h3><?php homepage_fields_get_meta(\'homepage_fields_banner_text\');  ?></h3>

to this:

<h3><?php echo esc_html(homepage_fields_get_meta(\'homepage_fields_banner_text\')); ?></h3>

The function esc_html escapes a string from any bad characters, so that you can use it in html without anything breaking.

In the metabox plugin code, replace

_e( \'Banner Text\' );

With

esc_html_e( \'Banner Text\' );

The function esc_html_e displays translatable strings, escaped, safe to use in html.

On the row below

<input type="text" name="homepage_fields_banner_text" id="homepage_fields_banner_text" value="<?php echo homepage_fields_get_meta( \'homepage_fields_banner_text\' ); ?>" size="30" />

The function esc_attr escapes strings to be safe to use as attributes.

<input type="text" name="homepage_fields_banner_text" id="homepage_fields_banner_text" value="<?php echo esc_attr(homepage_fields_get_meta( \'homepage_fields_banner_text\' ) ); ?>" size="30" />

Good read:

Check out the guide for data sanitization and escaping on WordPress.org.

标签： php   functions   hooks   小码农  

相关推荐

禁止在wp-login.php上显示密码

在wp登录中。php我想发送密码盐渍SHA256上的密码。所以我可以避免暴露安全数据。查看pwd未加密的屏幕截图，以便如何进行加密，以便即使在inspect中也不应显示密码