Kses final class

Every attribute the reference treats as holding a URI, so its scheme is judged wherever the attribute is allowed.

The URI schemes allowed by default.

Post content as an author without unfiltered_html may store it.

A comment, profile or term description as anyone without unfiltered_html may store it: listed attributes only.

The whole pass wp_kses makes with its default hooks: control characters out, references normalized, a "<" that opens no tag escaped, block attribute values filtered the same way, then the tags.

The control characters kses removes (tab, newline and carriage return stay).

Every "&" made a reference, in one pass: a known name or a code point kses accepts stays one (decimal padded to three digits, hex with a lower-case x), anything else becomes "&".

A "<" that reaches the next "<" or the end without a ">" is text: the run is escaped the way esc_html escapes it (quotes included).

Text escaped for HTML with references kept: invalid UTF-8 gives nothing, quotes become " and '.

Block markup with every attribute key and string value passed through the same filter, and the delimiters written back in their canonical form ("--->" read as "-->"). Markup without a comment is left alone.

The tag pass: each run from "<" to the next ">" (or the end) is a comment, an inert bogus comment ("</" before a non-letter, "<!" before a lower-case letter), or an element judged by the policy; anything else in angle brackets goes. Text between keeps its references, with stray ones escaped. Run alone (wp_kses_split), a last "<" with no ">" still reads as a tag; inside sanitize() the less-than pass has already escaped it.

One run of the tag pass on its own (wp_kses_split2): a comment, a tag, or, for anything not starting with "<", a lone ">".

An element rebuilt with the attributes the policy allows it (wp_kses_attr), its name as written and an XHTML slash kept; an element the policy does not know keeps none.

The attributes written inside a tag, read the way kses reads them: a name, then "=" and a quoted or bare value, or no value at all; junk between (stray quotes, "=", "/") is skipped; the first of two same-named attributes wins. Null when a quoted value never closes, which costs the tag every attribute.

Plain text: tags gone, whitespace collapsed, control characters dropped.

A URL for a stored field: empty when its scheme is not one the reference allows. The scheme is judged as a browser reads it, without the tabs, line breaks and other control characters it drops (java, a tab, then script: is javascript:).

A URL inside markup: whatever stands before the first colon, once every character reference and percent escape is decoded as deep as it goes and the invisible characters are dropped, must be an allowed scheme, or it is cut off and the rest is judged again. The reference cuts "?q=a:b" to "b" and "javascript:alert(1)//http://" to "//" the same way. A value with a good scheme is returned as given.

Whether a code point is one a reference may name (valid_unicode): tab, line feed, carriage return, and the rest of Unicode from space up, except the surrogates and U+FFFE and U+FFFF.

Whether a URL may be an object's data in post content: an http or https URL on the uploads host and port, no credentials, query or fragment, whose path ends in ".pdf".