I have a WordPress multisite installation and part of the feature is to load CSS (a one-time copied version from the parent and child CSS file) stored in the database (WordPress options table part of theme options). This feature is available in the theme options panel.
Once this feature is enabled, the parent and child CSS are disabled and the theme will load from custom css file(custom.css). The content of this custom.css is taken from the database (like what I’ve said in the first paragraph). In the theme options panel, users can now edit the entire CSS and then saved it. Once saved, it will write to a custom.css file with the changes.
I need your thoughts if this method is secure. Basically I have sanitized the custom CSS (before it will be saved to the database) using the following PHP lines:
$sanitized_css = esc_html($original_css);
Where esc_html is a WordPress function for escaping HTML blocks: http://codex.wordpress.org/Function_Reference/esc_html
But I am not sure if this is really the best method. I would appreciate your advise and thoughts.
I am thinking to output the CSS to the browser directly (inline) not using any CSS file, does this method also secure? But I know loading from CSS file is always the best practice especially for large CSS files.
I need to make sure that the application is safe from XSS, MySQL injection and other security risk.
Thanks.
A quick google search would bring the related post from this forum:
User-defined CSS: What can go wrong?
Sanitize user defined CSS in PHP