Escaping shortcode conditionally

[pavelevap]

Using additional brackets is the official way to "escape" a shortcode. e.g. [[escaped]]

Using additional brackets [[shortcode]] in a post works only when the plugin (function) for this shortcode is active. When deactivated, additional brackets are shown in the post. It is annoying for many users, because editors sometimes test a plugin, write about it in a post with shortcode example and after some months this plugin is deactivated. Now there will be additional brackets, breaking their example code.

Input:

[[shortcode_that_does_not_exist]]

Expected output, regardless of whether that plugin is active:

[shortcode_that_does_not_exist]

Actual output, if plugin is not active:

[[shortcode_that_does_not_exist]

[edited by Mark Jaquith]

[kunalb]

I've attached a patch that takes care of any shortcodes of the form [[foobar]] left over after running all registered shortcode functions: I avoided changing the get_shortcode_regex function to allow for general tags because of the way the embed shortcode is handled (calling do_shortcode twice, once with only the embed as the shortcode to handle, and once after that).

Getting [shortcode]Text[/shortcode] to display required an escape of the form [[shortcode]Text[/shortcode]] ; so non-shortcodes of this form are reduced accordingly.

[hakre]

It makes sense to have something to escape shortcodes.

[markjaquith]

Good idea. Let's get some eyes on the patch.

[azram19]

I've attached a patch that adds escape_shortcode() and uses it to escape shortcodes of the form [[foobar]] and [[foo]bar[/foo]].

It also escapes [[embed]foobar[/embed]], which hasn't been escaped by the previous patch.

[jdgrimes]

+1 - This can be very annoying. My temporary solution was to add the shortcode with, e.g., __return_false as the callback and use the built-in escaping.

[SergeyBiryukov]

Related: #25820, #26649.

[jdgrimes]

Related: #28720.

[miqrogroove]

In shortcodes.diff I don't see how arbitrary corruption of HTML would be avoided. Just because someone uses square braces in their CDATA, URI, or other element, doesn't mean it's an unregistered shortcode.

In shortcodes.2.diff I don't see how shortcodes would even work anymore.

I agree the escaping system is somewhat nonsensical, but we need a more foolproof solution.

[aaroncampbell]

Honestly, I think that at this point we have to consider unregistered shortcodes to not be shortcodes at all. If you really need to use double brackets to escape unregistered shortcodes, just register them with add_shortcode( 'shortcode', '__return_empty_string' )

I'm not saying this is "best case scenario", but I do think it's where we are right now for backwards compat, keeping the regexes as sane as possible, etc.

[miqrogroove]

I am working on a roadmap proposal to fix this with better shortcode syntax.

[miqrogroove]

Duplicate of #18558.

Just noticed we have two tickets for this.

[pavelevap]

Yes, probably same ticket. I only emphasized displaying active and inactive shortcodes in posts (for example for tutorials)...