Sanitize PHP textarea in WP metabox allowing HTML markup

Question

In a Wordpress site I have a custom textarea metabox with text editor.

If I use sanitize_textarea_field() to sanitize the text, the HTML markup manually set in the text editor disappears.

If I use wp_kses_post HTML tags are allowed.

Is this the right solution to keep a good security level?

Thank you.

Answer 1

Yes, wp_kses_post() is a right method as per the WP documentations.

1. Securing (sanitizing) Input
2. Securing (escaping) Output

And when we need control over the allowed HTML tags and attributes, we can use wp_kses() .