Minn\Support

The text with its accented characters spelled plainly, as the locale spells them.

The frames' names, after the first $skip.

A directory's entries described one by one, or false when unreadable.

Why an address is invalid, or null when it passes the reference's checks.

An address with the characters the reference strips removed, and what was removed.

The reference's special-characters escaping, with its quote styles and double-encoding rule.

The reverse of specialchars: the five characters back, with the quote pairs the style asks for.

Windows-1252 numeric references rewritten as the Unicode references they meant.

Text for an element's content.

Text for an attribute's value.

The header values of a plugin or theme file, by label.

Every file under a directory, and every directory itself with a trailing slash, to the given depth. Depth 0 means no limit; depth 1 stops at the directory's own entries and names its subdirectories without descending.

Copies a directory's contents into another, creating it if it is not there. Names in $skip are left behind at the top level only, which is how the update unpacker keeps a directory it means to preserve.

drwxr-xr-x (or any rwx string) to its octal digits, the reference's tallying shape.

Delete a directory tree, files first, best effort; true only when everything went. A symlinked directory is unlinked, never followed: the dev sites symlink plugin folders into the tree, and a delete that reached through one would empty the real source.

Apply a mode to every FILE under a directory (the directories themselves keep theirs); always reports true.

The string "false" in any case is no; anything else is PHP's truth.

The node where the slow walker meets the fast one, or null when the chain ends.

Every node either walker stepped on before they met, in the order first reached (the slow walker's node, then the fast one's two steps), or null when the chain ends without a loop.

An address with its last octet, or its tail, zeroed.

Every attribute the reference treats as holding a URI, so its scheme is judged wherever the attribute is allowed.

The URI schemes allowed by default.

Post content as an author without unfiltered_html may store it.

A comment, profile or term description as anyone without unfiltered_html may store it: listed attributes only.

The whole pass wp_kses makes with its default hooks: control characters out, references normalized, a "<" that opens no tag escaped, block attribute values filtered the same way, then the tags.

The control characters kses removes (tab, newline and carriage return stay).

Every "&" made a reference, in one pass: a known name or a code point kses accepts stays one (decimal padded to three digits, hex with a lower-case x), anything else becomes "&".

A "<" that reaches the next "<" or the end without a ">" is text: the run is escaped the way esc_html escapes it (quotes included).

Text escaped for HTML with references kept: invalid UTF-8 gives nothing, quotes become " and '.

Block markup with every attribute key and string value passed through the same filter, and the delimiters written back in their canonical form ("--->" read as "-->"). Markup without a comment is left alone.

The tag pass: each run from "<" to the next ">" (or the end) is a comment, an inert bogus comment ("</" before a non-letter, "<!" before a lower-case letter), or an element judged by the policy; anything else in angle brackets goes. Text between keeps its references, with stray ones escaped. Run alone (wp_kses_split), a last "<" with no ">" still reads as a tag; inside sanitize() the less-than pass has already escaped it.

One run of the tag pass on its own (wp_kses_split2): a comment, a tag, or, for anything not starting with "<", a lone ">".

An element rebuilt with the attributes the policy allows it (wp_kses_attr), its name as written and an XHTML slash kept; an element the policy does not know keeps none.

The attributes written inside a tag, read the way kses reads them: a name, then "=" and a quoted or bare value, or no value at all; junk between (stray quotes, "=", "/") is skipped; the first of two same-named attributes wins. Null when a quoted value never closes, which costs the tag every attribute.

Plain text: tags gone, whitespace collapsed, control characters dropped.

A URL for a stored field: empty when its scheme is not one the reference allows. The scheme is judged as a browser reads it, without the tabs, line breaks and other control characters it drops (java, a tab, then script: is javascript:).

A URL inside markup: whatever stands before the first colon, once every character reference and percent escape is decoded as deep as it goes and the invisible characters are dropped, must be an allowed scheme, or it is cut off and the rest is judged again. The reference cuts "?q=a:b" to "b" and "javascript:alert(1)//http://" to "//" the same way. A value with a good scheme is returned as given.

Whether a code point is one a reference may name (valid_unicode): tab, line feed, carriage return, and the rest of Unicode from space up, except the surrogates and U+FFFE and U+FFFF.

Whether a URL may be an object's data in post content: an http or https URL on the uploads host and port, no credentials, query or fragment, whose path ends in ".pdf".

An opening tag cut as wp_kses_attr_parse cuts it: the start ("<a "), each attribute with the whitespace after it (a shortcode standing as a name counts as one), and the end (">" or "/>"). Null for a closing tag, a comment, CDATA, or anything between the brackets that is not attributes.

An attribute string cut into its attributes, each with the whitespace after it (wp_kses_hair_parse): a name (or a shortcode standing as one), then "=" and a quoted or bare value, or nothing. Null when anything in it is not an attribute: leading whitespace, a stray quote, a quoted value that never closes.

One attribute as written, judged as kses judges it on the element (wp_kses_one_attr): the value escaped for an attribute and kept in its own quotes (a bare one gains double quotes), a URL's bad scheme cut away, style kept to the allowed properties; nothing when the element may not carry it or a quoted value never closes. The whitespace around it stays.

A style attribute's value with only the listed properties kept.

The runtime's say over style attributes: the property list (safe_style_css) and each declaration (safecss_filter_attr_allow_css). The facade sets these as it loads.

Whether "&name;" is a reference kses leaves alone.

An allowlist the reference ships, by context ("post" or "data").

Post content from an author without unfiltered_html: the reference's post allowlist as captured.

Comments, profiles and term descriptions: only the attributes each tag lists, nothing global.

A caller's own allowlist taken literally: a listed attribute is allowed whatever it maps to (false included, as the reference only asks whether the name is there), an array carries value rules, and "data-*" lets the tag take any data- name. Nothing else is implied.

Whether the tag may appear at all.

The rules an attribute carries on a tag: an empty list when it is allowed plainly, null when it is not allowed.

The attributes a tag must keep: lose one and the tag keeps none.

Whether the attribute holds a URI whose scheme must be judged.

Whether a value meets every rule its attribute carries; "required" is the tag's concern, so it is skipped here.

One rule against one value; $valueless is "y" for a bare attribute and "n" for one with a value.

Arguments as WordPress takes them (wp_parse_args): an object's properties, an array, or a query string, over the defaults.

One field of each item (wp_list_pluck), keyed as the list was, or by another field when one is named (items without it are appended); anything not an array or an object is passed over.

The items matching all the fields given (AND), any of them (OR), or none (NOT), compared loosely, keys kept; nothing for another operator.

A list as arguments give one (wp_parse_list): an array's entries trimmed, the empty ones dropped (keys kept); a string split on commas and whitespace.

Ids as arguments give them (wp_parse_id_list): each a whole number made positive, each once, in first-seen order.

Items sorted by several fields, each ascending or descending.

Rows of stdClass shaped for a wpdb output format: keyed by their first column (first row wins a duplicate key), associative, or numeric.

Every descendant of one root in a flat parent-linked list, preorder (a child ahead of its own children), the shape _get_term_children and get_page_children walk. Visited ids guard against a parent cycle.

A weekday's one-letter form.

A weekday's or month's three-letter form; May is already three letters.

Months are keyed by their zero-padded number, both ways round.

Replaces the lines between a marker's begin and end comments in a file.

The lines between a marker's begin and end comments, every block of it in order. A line opens or closes a block when it contains the comment anywhere (case-sensitive); lines that start with "#" are left out, so the preamble and any nested markers are, while indented comments stay. Lines split on "\n" only, and a block left open at the end of the file keeps the empty line after its final newline.

The trailing-slashed directory holding a text domain's {domain}-{locale}.mo: a custom path first, then the language dir's plugins and themes folders, then the dir itself for the default domain; false when none has the file. $listed, when given, lists a folder's files (the textdomain registry's own lister, which plugins may answer for) and is read instead of the disk.

Forward slashes only, runs collapsed, a stream wrapper kept, a Windows drive letter upper-cased.

The `ls -l` spelling of a mode: type letter, then rwx for owner, group and world with the setuid, setgid and sticky bits folded in.

The empty element for a script file.

The element for inline code (already between its newlines), or '' when its type cannot hold the code safely.

A value with one string replaced, and how many times.

Returned by decode() when the blob is not a serialized value the reader accepts.

The string values of a serialized string list.

A flat string list in the stored form.

The first "field";value pair inside a blob: string, int, or float value as a string.

A serialized scalar or array as PHP data, parsed by this reader: strings, integers, floats, booleans, null, and arrays of those. An object record becomes a stdClass of its properties, or whatever the reviver makes of the class name and those properties; nothing here instantiates anything itself. A blob with trailing bytes or a malformed shape is INVALID.

The class an object was stored as, when it came back as a stdClass of its properties.

Whether a string has the shape of serialized data, as is_serialized() judges it: what maybe_serialize() stores serialized again so it reads back as the string it was.

PHP's serialize() for the values decode() accepts: null, bool, int, float, string, arrays of those, and objects written as their class.

The integer values of a serialized list such as sticky_posts.

Every string in a value with its quotes and backslashes slashed.

Every string in a value with one level of slashes taken off.

The table a statement names (backticks dropped), or null when it names none the reference recognises.

A DB_HOST read as host, port, socket and whether the host is IPv6: a socket after ":/", an IPv6 address in brackets (more than one colon), a port only when it is digits. Null when nothing parses.

A number of seconds as its largest whole unit and count.

The choices as option lines, the chosen zone marked.

The value with one trailing slash, whatever slashes or backslashes it ended in (trailingslashit).

The value with every trailing slash and backslash taken off (untrailingslashit).

Spaces encoded, stray characters dropped, ";//" healed, a bare host given http; '' when nothing survives.

Square brackets after the authority are percent-encoded; the authority itself is left alone. @param array<string, mixed> $parsed

The URI with query arguments merged in (false removes one), the fragment kept, a bare query string treated as such; a URI that is only a query (or nothing) keeps its leading question mark.

The checks wp_http_validate_url makes on a URL whose protocol already passed: an http(s) scheme, a host without credentials or a colon, no private address unless it is this site or allowed, only the safe ports (80, 443 and 8080 unless the caller's list says otherwise; the site's own always). Returns the URL, or null when refused.

A query string in the reference's spelling (probe query-args): keys and values as given, nested keys as `a%5Bb%5D`, null left out, booleans as 0/1.

parse_url that also accepts scheme-relative and path-only URLs; a single component by its PHP_URL_* constant.

The URL under a scheme, or scheme-and-host stripped for 'relative'; a protocol-relative URL is read as http first.

A redirect target the site may send a browser to: http(s) only and a host the caller allows (local paths always pass). Credentials before the host are kept, as the reference keeps them: the host decides.

True for well-formed UTF-8, including the empty string.

The bytes cut into characters, a malformed byte or a broken-off sequence counting as one.

Reads well-formed characters from $at, as the reference's scanner does (probe utf8). It stops $maxBytes past $at (a character begun before that is read whole), after $maxCodePoints, or at a malformed byte. The answer: the characters read, where it stopped, the length of the malformed run there (a broken-off start of a sequence, else one byte, cut at the byte limit; 0 when there is none), and whether a character that could be a noncharacter was one (null when none could be: only EF and four-byte sequences hold them).

Whether a code point is a noncharacter: U+FDD0 to U+FDEF, or the last two of any plane.

Whether any well-formed character is a noncharacter, malformed bytes stepped over.

The bytes with each malformed run (as characters() cuts them) replaced by U+FFFD.

How many bytes from $offset the first $maxCodePoints characters take, and how many there were.

UTF-8 as ISO-8859-1: a character past U+00FF, or a malformed run, becomes "?".

What a column in this charset keeps: utf8mb4 drops each malformed run, utf8 (utf8mb3) every four-byte character too; any other charset keeps the bytes.

ISO-8859-1 as UTF-8: each byte the character of its value.

The UTF-8 bytes for a code point, or null for a negative one, a surrogate, or one past U+10FFFF.

The code point of the first character, or null when the bytes do not start with a whole, well-formed one.

Whether the server speaks Apache's module and .htaccess conventions: Apache itself, or LiteSpeed.