wp_get_inline_script_tag() – Function

wp_get_inline_script_tag( string $data, $attributes = array() ): string

Constructs an inline script tag.

Description

It is possible to inject attributes in the <script> tag via the ‘wp_inline_script_attributes’ filter.

If the $data is unsafe to embed in a <script> tag, an empty script tag with the provided attributes will be returned. JavaScript and JSON contents can be escaped, so this is only likely to be a problem with unusual content types.

Example:

// The dangerous JavaScript in this example will be safely escaped.
// A string with the script tag and the desired contents will be returned.
wp_get_inline_script_tag( 'console.log( "</script>" );' );

// This data is unsafe and `text/plain` cannot be escaped.
// The following will return `""` to indicate failure:
wp_get_inline_script_tag( '</script>', array( 'type' => 'text/plain' ) );

Parameters

$datastringrequired: Data for script tag: JavaScript, importmap, speculationrules, etc.; string|bool> $attributes Optional. Key-value pairs representing <script> tag attributes.

Return

string HTML script tag containing the provided $data or the empty string "" if the data cannot be safely embedded in a script tag.

Source

function wp_get_inline_script_tag( $data, $attributes = array() ) {
	$data = "\n" . trim( $data, "\n\r " ) . "\n";

	/**
	 * Filters attributes to be added to a script tag.
	 *
	 * @since 5.7.0
	 *
	 * @param array<string, string|bool> $attributes Key-value pairs representing `<script>` tag attributes.
	 *                                               Only the attribute name is added to the `<script>` tag for
	 *                                               entries with a boolean value, and that are true.
	 * @param string                     $data       Inline data.
	 */
	$attributes = apply_filters( 'wp_inline_script_attributes', $attributes, $data );

	$processor = new WP_HTML_Tag_Processor( '<script></script>' );
	$processor->next_tag();
	foreach ( $attributes as $name => $value ) {
		/*
		 * Lexical variations of an attribute name may represent the
		 * same attribute in HTML, therefore it’s possible that the
		 * input array might contain duplicate attributes even though
		 * it’s keyed on their name. Calling code should rewrite an
		 * attribute’s value rather than sending a duplicate attribute.
		 *
		 * Example:
		 *
		 *     array( 'id' => 'main', 'ID' => 'nav' )
		 *
		 * In this example, there are two keys both describing the `id`
		 * attribute. PHP array iteration is in key-insertion order so
		 * the 'id' value will be set in the SCRIPT tag.
		 */
		if ( null !== $processor->get_attribute( $name ) ) {
			continue;
		}

		$processor->set_attribute( $name, $value ?? true );
	}

	if ( ! $processor->set_modifiable_text( $data ) ) {
		_doing_it_wrong(
			__FUNCTION__,
			__( 'Unable to set inline script data.' ),
			'7.0.0'
		);
		return '';
	}

	return "{$processor->get_updated_html()}\n";
}

View all references View on Trac View on GitHub

Hooks

apply_filters( ‘wp_inline_script_attributes’, array<string, , string $data ): Filters attributes to be added to a script tag.

Uses	Description
WP_HTML_Tag_Processor::__construct()`wp-includes/html-api/class-wp-html-tag-processor.php`	Constructor.
__()`wp-includes/l10n.php`	Retrieves the translation of $text.
_doing_it_wrong()`wp-includes/functions.php`	Marks something as being incorrectly called.
apply_filters()`wp-includes/plugin.php`	Calls the callback functions that have been added to a filter hook.

Show 2 more Show less

Used by	Description
wp_admin_bar_command_palette_menu()`wp-includes/admin-bar.php`	Adds the command palette trigger button.
WP_Scripts::get_inline_script_tag()`wp-includes/class-wp-scripts.php`	Gets tags for inline scripts registered for a specific handle.
wp_print_inline_script_tag()`wp-includes/script-loader.php`	Prints an inline script tag.
get_post_embed_html()`wp-includes/embed.php`	Retrieves the embed code for a specific post.
WP_Customize_Manager::wp_die()`wp-includes/class-wp-customize-manager.php`	Custom wp_die wrapper. Returns either the standard message for UI or the Ajax message.
WP_Scripts::do_item()`wp-includes/class-wp-scripts.php`	Processes a script dependency.

Show 1 more Show less

Changelog

Version	Description
7.0.0	Returns an empty string if the data cannot be safely embedded in a script tag.
5.7.0	Introduced.

User Contributed Notes

Skip to note 3 content

albertomake 5 years ago

You must log in to vote on the helpfulness of this noteVote results for this note: 1You must log in to vote on the helpfulness of this note
A nice way to include Google Analytics and other scripts in the <head> of the document:
```
function wpdocs_add_scripts_head() {
		// Google Analytics
		$ga_script = "window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date;ga('create', 'UA-XXXXX-Y', 'auto');ga('send', 'pageview');";
		echo wp_get_inline_script_tag( $ga_script );
		echo wp_get_script_tag( array(
			'async' => true,
			'src' => 'https://www.google-analytics.com/analytics.js'
		) );
	}
	add_action( 'wp_head', 'wpdocs_add_scripts_head', 1 );
```
Will output:
<script>
window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date;ga(‘create’, ‘UA-XXXXX-Y’, ‘auto’);ga(‘send’, ‘pageview’);
</script>
<script async src="https://www.google-analytics.com/analytics.js"></script>%5B/php%5D

This article has good examples https://make.wordpress.org/core/2021/02/23/introducing-script-attributes-related-functions-in-wordpress-5-7/
Log in to add feedback
Skip to note 4 content

Anonymous User 3 years ago

You must log in to vote on the helpfulness of this noteVote results for this note: 0You must log in to vote on the helpfulness of this note
This has to be used to make WP a CSP compliant system (at least, in the front end. Remains to be tested in the admin area)
```
function wpdocs_add_nonce_to_scripts( $attr ) {
	if ( 'text/javascript' !== $attr['type'] ) {
		return $attr;
	}

	return array(
		'type' => 'text/javascript',
		'nonce' => '123',// Your Nonce. Obviously more featured than this example.
	);
}
add_filter( 'wp_inline_script_attributes', 'wpdocs_add_nonce_to_scripts' );
```
Then, you can use 'nonce-123' in your CSP Policy, example:
"script-src 'self' 'noncoe-123';"
- Note that this will override other attributes on the script tag. Would be better to set $attr['nonce'] on the existing array rather than return a new array.
  
  crstauf 3 years ago
Log in to add feedback

You must log in before being able to contribute a note or feedback.

wp_get_inline_script_tag( string $data, $attributes = array() ): string

In this article