Scripts: Use HTML API to build SCRIPT tags #10639

sirreal · 2025-12-16T18:34:10Z

The HTML API can produce SCRIPT tags that are safe, or reject the script tags if no safe tag can be produced.

SCRIPT tags have complicated and unintuitive parsing rules that make them difficult to author correctly. Currently, authors need to provide safe JavaScript and/or correctly escaped JSON in order to produce safe HTML SCRIPT tags.

[61447] added the ability to automatically escape JSON and JavaScript content when problematic strings are discovered, making the HTML API especially well-suited to producing script tags.

This is similar to change [61418] where the HTML API is used to generate style tags.

This is well documented by issues like #40737, #62797, #63851, and #51159.

This is a follow up to #64419.

✅ ~~Includes #10635~~ (merged in r61477).

Trac ticket: https://core.trac.wordpress.org/ticket/64500

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

…html-api-for-script-tags

tests/phpunit/tests/dependencies/scripts.php

github-actions · 2025-12-16T18:50:54Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

The Plugin and Theme Directories cannot be accessed within Playground.
All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

This reverts commit d78cd35.

src/wp-includes/html-api/class-wp-html-tag-processor.php

Co-authored-by: Weston Ruter <westonruter@gmail.com>

…html-api-for-script-tags

sirreal · 2026-01-13T17:48:19Z

I'd like to land #10728 first so it's clear that the attribute handling is unchanged from trunk in this change.

src/wp-includes/script-loader.php

dmsnell

This is a great end to a long journey. I’m glad to see it come in and I think it will have a major uplift in the reliability of scripts, especially when viewed in the progression of module support, SCRIPT escaping, attribute recognition, etc…

Thanks for another intentional step forward with WordPress’s SCRIPT story.

src/wp-includes/script-loader.php

westonruter

See comments.

src/wp-includes/script-loader.php

…pi-for-script-tags

In some conditions the script tag contents are unsafe and cannot be set. Add a `_doing_it_wrong()` message. Add tests.

src/wp-includes/script-loader.php

Copilot

Pull request overview

This PR refactors wp_get_script_tag() and wp_get_inline_script_tag() to use the HTML API (WP_HTML_Tag_Processor) instead of string concatenation, providing automatic escaping of dangerous JavaScript/JSON content and safer SCRIPT tag generation.

Changes:

Replaced string-based tag generation with WP_HTML_Tag_Processor for safer HTML construction
Added error handling in wp_get_inline_script_tag() to return empty string when content cannot be safely embedded
Added test case for dangerous unescapeable script content

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/wp-includes/script-loader.php	Refactored `wp_get_script_tag()` and `wp_get_inline_script_tag()` to use HTML API with duplicate attribute handling and safe content embedding
tests/phpunit/tests/dependencies/wpInlineScriptTag.php	Added test for failure case when script content cannot be safely escaped

Comments suppressed due to low confidence (1)

src/wp-includes/script-loader.php:1

The documentation states 'an empty script tag with the provided attributes will be returned' but the implementation actually returns an empty string '' (line 2996). The documentation should be corrected to say 'an empty string will be returned' to match the actual behavior.

<?php

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/wp-includes/script-loader.php

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

westonruter

A couple nits, but re-approving

src/wp-includes/script-loader.php

Co-authored-by: Weston Ruter <westonruter@gmail.com>

Script tags have complicated and unintuitive parsing rules that make them difficult to author correctly. The HTML API automatically escapes script tag contents as necessary and will set attributes correctly. Using the HTML API to generate SCRIPT tags improves safety when working with SCRIPT tags, resolving a class of issues that have manifested repeatedly. Changeset [61418] applied the HTML API to generate style tags in a similar way. Developed in #10639. Props jonsurrell, dmsnell, westonruter. Fixes #64500. See #64419, #40737, #62797, #63851, #51159. git-svn-id: https://develop.svn.wordpress.org/trunk@61485 602fd350-edb4-49c9-b593-d223f7449a82

github-actions · 2026-01-15T11:12:14Z

A commit was made that fixes the Trac ticket referenced in the description of this pull request.

SVN changeset: 61485
GitHub commit: 37bee55

This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.

Script tags have complicated and unintuitive parsing rules that make them difficult to author correctly. The HTML API automatically escapes script tag contents as necessary and will set attributes correctly. Using the HTML API to generate SCRIPT tags improves safety when working with SCRIPT tags, resolving a class of issues that have manifested repeatedly. Changeset [61418] applied the HTML API to generate style tags in a similar way. Developed in WordPress/wordpress-develop#10639. Props jonsurrell, dmsnell, westonruter. Fixes #64500. See #64419, #40737, #62797, #63851, #51159. Built from https://develop.svn.wordpress.org/trunk@61485 git-svn-id: http://core.svn.wordpress.org/trunk@60797 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Script tags have complicated and unintuitive parsing rules that make them difficult to author correctly. The HTML API automatically escapes script tag contents as necessary and will set attributes correctly. Using the HTML API to generate SCRIPT tags improves safety when working with SCRIPT tags, resolving a class of issues that have manifested repeatedly. Changeset [61418] applied the HTML API to generate style tags in a similar way. Developed in WordPress/wordpress-develop#10639. Props jonsurrell, dmsnell, westonruter. Fixes #64500. See #64419, #40737, #62797, #63851, #51159. Built from https://develop.svn.wordpress.org/trunk@61485 git-svn-id: https://core.svn.wordpress.org/trunk@60797 1a063a9b-81f0-0310-95a4-ce76da25c4cd

sirreal added 13 commits December 15, 2025 20:03

Auto-escape JavaScript and JSON script tags when necessary

4a8ca98

Update ticket number

4a28ef2

Fix those lints

0bef687

No trailing function commas

cdba027

Remove JSON_THROW_ON_ERROR constant

ba54ae4

fixup! Remove JSON_THROW_ON_ERROR constant

a697e9e

Merge branch 'trunk' into html-api/auto-escape-javascript-json

2b3d0d0

Remove JSON +json subtype handling

8246439

Merge branch 'html-api/auto-escape-javascript-json' into scripts/use-…

1b6b4fd

…html-api-for-script-tags

Add test for scripts containing script tags

b3e88e8

Update wp_add_inline_script to use HTML API

27c6371

Use the tag processor for all the inline script tags

deebd54

Remove assertions

d78cd35

sirreal commented Dec 16, 2025

View reviewed changes

tests/phpunit/tests/dependencies/scripts.php Show resolved Hide resolved

sirreal added 2 commits December 16, 2025 20:25

PICKME: Update Script Modules tests to use assertEqualHTML

c29c3d9

Revert "Remove assertions"

abeebd6

This reverts commit d78cd35.

This was referenced Dec 16, 2025

Add script_data_{$handle} filter for classic scripts sirreal/wordpress-develop#17

Draft

Use assertEqualHTML in Script Modules HTML tests #10642

Closed

dmsnell reviewed Dec 17, 2025

View reviewed changes

src/wp-includes/html-api/class-wp-html-tag-processor.php Outdated Show resolved Hide resolved

sirreal added 2 commits December 19, 2025 10:51

Merge branch 'trunk' into scripts/use-html-api-for-script-tags

aaacd6f

Merge branch 'trunk' into html-api/auto-escape-javascript-json

3f7f227

sirreal mentioned this pull request Dec 19, 2025

Add unit tests for is_javascript_script_tag and is_json_script_tag methods sirreal/wordpress-develop#19

Merged

Copilot AI and others added 7 commits December 19, 2025 13:35

Add JS and JSON script tag tests

1362451

Fix typo in comment

8d30680

Co-authored-by: Weston Ruter <westonruter@gmail.com>

Improve comment

3b5ef4e

Clean up and fix tests

f8cfdf9

Clean up and improve type/language logic

501d201

Merge branch 'html-api/auto-escape-javascript-json' into scripts/use-…

253b971

…html-api-for-script-tags

Fix svg SCRIPT tag tests

bcc02ae

Use the force, Jon??

3858d8e

dmsnell reviewed Jan 13, 2026

View reviewed changes

src/wp-includes/script-loader.php Show resolved Hide resolved

Document suprprising de-duplication

0197abc

dmsnell reviewed Jan 13, 2026

View reviewed changes

src/wp-includes/script-loader.php Show resolved Hide resolved

dmsnell approved these changes Jan 13, 2026

View reviewed changes

westonruter reviewed Jan 13, 2026

View reviewed changes

src/wp-includes/script-loader.php Show resolved Hide resolved

westonruter requested changes Jan 13, 2026

View reviewed changes

src/wp-includes/script-loader.php Show resolved Hide resolved

westonruter approved these changes Jan 14, 2026

View reviewed changes

sirreal added 5 commits January 14, 2026 12:14

Merge branch 'trunk' into script-test-attribute-behavior

8047003

Merge branch 'script-test-attribute-behavior' into scripts/use-html-a…

f2ea738

…pi-for-script-tags

Merge branch 'trunk' into scripts/use-html-api-for-script-tags

1be946e

Add _doing_it_wrong in case script contents are unsafe

cea5f04

In some conditions the script tag contents are unsafe and cannot be set. Add a `_doing_it_wrong()` message. Add tests.

Improve function documentation

67ba19e

sirreal commented Jan 14, 2026

View reviewed changes

src/wp-includes/script-loader.php Show resolved Hide resolved

Return empty string in case the content is unsafe and cannot be escaped

ed73a44

sirreal requested review from Copilot and westonruter January 14, 2026 17:50

Copilot started reviewing on behalf of sirreal January 14, 2026 17:56 View session

Copilot AI reviewed Jan 14, 2026

View reviewed changes

src/wp-includes/script-loader.php Outdated Show resolved Hide resolved

Apply return type description suggestion

faf77e3

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

westonruter approved these changes Jan 14, 2026

View reviewed changes

src/wp-includes/script-loader.php Outdated Show resolved Hide resolved

src/wp-includes/script-loader.php Outdated Show resolved Hide resolved

sirreal and others added 2 commits January 14, 2026 21:50

Fix language in comments

36537d9

Co-authored-by: Weston Ruter <westonruter@gmail.com>

Merge branch 'trunk' into scripts/use-html-api-for-script-tags

049332a

github-actions bot closed this Jan 15, 2026

sirreal deleted the scripts/use-html-api-for-script-tags branch January 15, 2026 11:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Scripts: Use HTML API to build SCRIPT tags #10639

Scripts: Use HTML API to build SCRIPT tags #10639

sirreal commented Dec 16, 2025 •

edited

Loading

Uh oh!

Uh oh!

github-actions bot commented Dec 16, 2025

Uh oh!

Uh oh!

sirreal commented Jan 13, 2026

Uh oh!

Uh oh!

Uh oh!

dmsnell left a comment

Uh oh!

Uh oh!

westonruter left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

westonruter left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jan 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Scripts: Use HTML API to build SCRIPT tags #10639

Scripts: Use HTML API to build SCRIPT tags #10639

Conversation

sirreal commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Dec 16, 2025

Test using WordPress Playground

Some things to be aware of

Uh oh!

Uh oh!

sirreal commented Jan 13, 2026

Uh oh!

Uh oh!

Uh oh!

dmsnell left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

westonruter left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

westonruter left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jan 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sirreal commented Dec 16, 2025 •

edited

Loading

westonruter left a comment •

edited

Loading