---
title: "lzb/allow_unfiltered_html"
description: "PHP filter `lzb/allow_unfiltered_html` of the Lazy Blocks WordPress plugin."
url: "https://www.lazyblocks.com/docs/php-filters/lzb-allow_unfiltered_html/"
source: "php-filters/lzb-allow_unfiltered_html.mdx"
---
# lzb/allow_unfiltered_html

Decides which users may save raw block markup and view scripts, and run PHP in the block builder preview.

On multisite WordPress gives the `unfiltered_html` capability to super admins only, so a site administrator opens the block builder and finds the HTML and Script fields silently refusing to save. This filter is the single switch behind that behaviour.

  A handler that returns a constant truthy value hands arbitrary PHP execution
  and unfiltered meta writes to every logged-in user, subscribers included.
  Always keep a capability or role check in the return value.

## Attributes

| Name                     | Type        | Description                                                  |
| ------------------------ | ----------- | ------------------------------------------------------------ |
| `$allow_unfiltered_html` | **Boolean** | `current_user_can( 'unfiltered_html' )` for the current user |

Four places read the result:

| Where                           | What a `false` result does                                                                                                                                           |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `guard_unfiltered_block_meta()` | blocks direct `add_post_meta()` and `update_post_meta()` writes to the keys from [lzb/unfiltered_block_meta_keys](https://www.lazyblocks.com/docs/php-filters/lzb-unfiltered_block_meta_keys/) |
| `save_meta_boxes()`             | skips saving `lazyblocks_code_editor_html`, `lazyblocks_code_frontend_html` and `lazyblocks_script_view`                                                             |
| `save_meta_boxes()`             | runs every other block field through `wp_kses_post_deep()`                                                                                                           |
| block render                    | returns `WP_Error( 'lazy_block_cannot_execute_php' )` instead of evaluating the PHP output method, in the block builder preview only                                 |

The render gate applies only while the block builder preview endpoint is running. A block already saved renders its PHP for every visitor no matter who is looking at the page.

## Usage

```php title="PHP"
function my_lzb_allow_unfiltered_html( $allowed ) {
  if ( $allowed ) {
    return $allowed;
  }

  // Multisite reserves `unfiltered_html` for super admins. Give block code
  // editing back to the administrators of this one site.
  return is_multisite()
    && current_user_can( 'manage_options' )
    && current_user_can( 'edit_lazyblocks' );
}

add_filter( 'lzb/allow_unfiltered_html', 'my_lzb_allow_unfiltered_html' );
```

The default is `current_user_can( 'unfiltered_html' )`, which is true for administrators on a single site and for super admins on multisite. Returning `false` for everyone leaves the block builder usable, with the HTML, PHP and Script fields dropped on save.

## Documentation Index
> Fetch the complete documentation index at: https://www.lazyblocks.com/llms.txt
> Fetch every page in a single file at: https://www.lazyblocks.com/llms-full.txt