wp_kses_attr()

wp_kses_attr() — Removes all attributes, if none are allowed for this element. If some are allowed it calls wp_kses_hair() to split them further, and then it builds up new HTML code from the data that wp_kses_hair() returns. It also removes < and > characters, if there are any left. One more thing it does is to check if the tag has a closing XHTML slash, and if it does, it puts one in the returned code as well. An array of allowed values can be defined for attributes. If the attribute value doesn’t fall into the list, the attribute will be removed from the tag.

Inputs: $element (string): HTML element/tag. $attr (string): HTML attributes from HTML element to closing HTML element tag. $allowed_html (array[]|string): An array of allowed HTML elements and attributes, or a context name such as ‘post’. See wp_kses_allowed_html() for the list of accepted context names. $allowed_protocols (string[]): Array of allowed URL protocols.

Returns string: Sanitized HTML element.