Handle UTF-8 and text encoding safely in WordPress plugins, especially on WP 6.9+ where wp_is_valid_utf8(), wp_scrub_utf8(), and noncharacter helpers replace older seems_utf8-style checks. Covers when to validate, scrub, reject, or preserve invalid bytes; wp_check_invalid_utf8 behavior; XML/JSON/feed/export boundaries; and avoiding data loss from premature replacement. Use when processing imported text, CSV, XML, feeds, email, REST payloads, AI prompts, logs, filenames, or external API data.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
WordPress 6.9 modernized UTF-8 handling. New code should prefer the explicit UTF-8 helpers instead of older heuristics and hand-written byte regexes.
This skill is for server-side plugin text processing. It is not about block editor text controls.
Trigger when ANY of the following is true:
seems_utf8(), mb_check_encoding(), iconv(), utf8_encode(), utf8_decode(), or byte-level regexes.�, XML generation, REST encoding errors, or noncharacters.| Need | Use |
|---|---|
| Check whether bytes are valid UTF-8 | wp_is_valid_utf8( $bytes ) |
| Replace invalid UTF-8 spans with U+FFFD | wp_scrub_utf8( $text ) |
| Detect Unicode noncharacters | wp_has_noncharacters( $text ) |
| Legacy display/database helper | wp_check_invalid_utf8( $text, $strip ) |
seems_utf8() is deprecated in WP 6.9. Use wp_is_valid_utf8() for validation.
Pick behavior based on the boundary:
| Boundary | Preferred behavior |
|---|---|
| Admin text field save | Usually reject invalid UTF-8 with a validation error. |
| Frontend display of legacy stored text | Scrub for display if rejection is no longer possible. |
| XML, JSON, feed, sitemap, external API | Scrub or reject before serialization; invalid bytes can break the whole document. |
| Security-sensitive identifiers, slugs, tokens | Reject, do not scrub into a different value. |
| Logs/debug dumps | Preserve raw bytes if forensic fidelity matters; scrub only for display. |
| AI/LLM prompt payloads | Scrub before sending unless invalid bytes are semantically important. |
Replacing invalid bytes is lossy. Once U+FFFD is inserted, you cannot know what the original byte sequence was.
Reject invalid imported text:
$name = (string) ( $row['name'] ?? '' );
if ( ! wp_is_valid_utf8( $name ) ) {
return new WP_Error(
'myplugin_invalid_utf8',
__( 'The imported name contains invalid UTF-8 bytes.', 'myplugin' )
);
}
Scrub before XML output:
$title = wp_scrub_utf8( (string) $title );
$xml .= '<title>' . esc_xml( $title ) . '</title>';
Preserve raw bytes in storage, scrub for display:
update_post_meta( $post_id, '_myplugin_raw_payload', $payload );
$safe_for_screen = wp_scrub_utf8( $payload );
echo esc_html( $safe_for_screen );
wp_check_invalid_utf8()wp_check_invalid_utf8( $text, false ) returns an empty string for invalid UTF-8 on UTF-8 sites. Since WP 6.9, wp_check_invalid_utf8( $text, true ) replaces invalid byte sequences with U+FFFD instead of silently removing them.
Use it when you are already in a WordPress escaping/sanitizing path that expects this helper. For new explicit validation logic, prefer wp_is_valid_utf8() and wp_scrub_utf8() because the intent is clearer.
Unicode noncharacters can be valid UTF-8 while still being inappropriate for interchange formats. Use wp_has_noncharacters() when producing XML, strict external API payloads, or data that will be consumed outside WordPress.
if ( wp_has_noncharacters( $text ) ) {
return new WP_Error(
'myplugin_noncharacter_text',
__( 'The text contains Unicode noncharacters that cannot be exported.', 'myplugin' )
);
}
seems_utf8() in new code. It is deprecated as of WP 6.9.// WRONG - deprecated and less explicit.
if ( ! seems_utf8( $value ) ) {
$value = '';
}
// RIGHT - clear validation.
if ( ! wp_is_valid_utf8( $value ) ) {
return new WP_Error( 'invalid_utf8', __( 'Invalid text encoding.', 'myplugin' ) );
}
// WRONG - silently changes an identifier.
$slug = sanitize_key( wp_scrub_utf8( $raw_slug ) );
// RIGHT - reject bad bytes before deriving identifiers.
if ( ! wp_is_valid_utf8( $raw_slug ) ) {
return new WP_Error( 'invalid_slug_encoding', __( 'Invalid slug encoding.', 'myplugin' ) );
}
$slug = sanitize_key( $raw_slug );
wp-security-audit when invalid text comes from uploads, REST, AJAX, or third-party APIs.wp-rest-api when text is accepted or returned through REST schemas.wp-html-api when text is being inserted into HTML fragments.wp_check_invalid_utf8() / seems_utf8(): wp-includes/formatting.phpまだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.
日本語の概要は準備中です。原文の説明を表示しています。
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.
日本語の概要は準備中です。原文の説明を表示しています。
Control a headless browser to navigate URLs, click elements, fill forms, extract content from JavaScript-rendered pages, take screenshots, and automate end-to-end web workflows.
日本語の概要は準備中です。原文の説明を表示しています。
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.
日本語の概要は準備中です。原文の説明を表示しています。
Review code for quality, simplicity, and maintainability. Identifies unnecessary abstractions, duplicated logic, oversized functions, missing error handling, and naming issues — then fixes them automatically before presenting the result.
日本語の概要は準備中です。原文の説明を表示しています。
WooCommerce store operations through NV oOS Pro — product research, catalog cross-referencing, inventory lookups, and Shopify or Flowhub comparisons where integrations are configured.
日本語の概要は準備中です。原文の説明を表示しています。