|
/ Documentation /Developer Hooks & Events/ suredonation_allowed_form_html Filter Hook

suredonation_allowed_form_html Filter Hook

The suredonation_allowed_form_html filter allows developers to modify the HTML allowlist used when SureDonation sanitizes donation-form markup.

SureDonation uses a custom allowlist with wp_kses() because the standard wp_kses_post() function removes form-specific elements and data-* attributes that are required for interactive donation forms.

Use this filter when a custom field, block, or extension needs to render an additional HTML tag or attribute that is not included in SureDonation’s default allowlist.

Parameters

ParameterTypeDescription
$allowedarrayThe HTML allowlist. Each tag maps to an array of permitted attributes. The list includes form elements such as form, input, select, option, textarea, button, label, fieldset, and legend, along with common text, structure, link, and SVG elements.

Interactive elements also include selected data-* attributes such as:

  • data-block-id
  • data-form-id
  • data-stripe-key
  • data-required

Return Value

Return the modified allowlist in the following format:

[

    'tag' => [

        'attribute' => true,

    ],

]

The returned allowlist is passed directly to wp_kses() for sanitization.

Filter Source

apply_filters( 'suredonation_allowed_form_html', $allowed );

Filter Usage

add_filter( 'suredonation_allowed_form_html', 'your_custom_function', 10, 1 );

function your_custom_function( $allowed ) {

    // Modify the allowlist here.

    return $allowed;

}

Filter Example

The following example allows a custom data-datepicker attribute on <input> elements:

add_filter( 'suredonation_allowed_form_html', 'mysite_allow_custom_attr', 10, 1 );

function mysite_allow_custom_attr( $allowed ) {

    // Allow a custom field to use the data-datepicker attribute.

    $allowed['input']['data-datepicker'] = true;

    return $allowed;

}
  • The filter is applied in Helper::get_allowed_form_html().
  • The resulting allowlist is consumed by SureDonation components that sanitize form markup, such as Payment_Markup::markup().
  • Only add HTML tags and attributes that your extension fully trusts.
  • This allowlist directly controls which HTML survives wp_kses() sanitization.
  • Adding unnecessary tags or attributes may weaken the security of the rendered form markup.

Related Hooks

  • suredonation_allowed_form_blocks
Was this doc helpful?
What went wrong?

We don't respond to the article feedback, we use it to improve our support content.

Need help? Contact Support
Table of Contents
Scroll to Top