---
title: "lzb/unfiltered_block_meta_keys"
description: "PHP filter `lzb/unfiltered_block_meta_keys` of the Lazy Blocks WordPress plugin."
url: "https://www.lazyblocks.com/docs/php-filters/lzb-unfiltered_block_meta_keys/"
source: "php-filters/lzb-unfiltered_block_meta_keys.mdx"
---
# lzb/unfiltered_block_meta_keys

Lists the block meta keys only a user with `unfiltered_html` may write.

WordPress lets XML-RPC and the custom fields box write post meta straight past the block builder REST endpoint, where these fields are normally checked. Lazy Blocks closes that path with an `add_post_metadata` and `update_post_metadata` guard, and this filter is the list the guard works from.

## Attributes

| Name                | Type      | Description                                                                                                                 |
| ------------------- | --------- | --------------------------------------------------------------------------------------------------------------------------- |
| `$unsafe_meta_keys` | **Array** | protected meta keys, `lazyblocks_code_editor_html`, `lazyblocks_code_frontend_html` and `lazyblocks_script_view` by default |

The three defaults are the fields that end up on the page as markup or as a script tag. A write to any of them on a `lazyblocks` post returns `false` from the guard, which cancels the meta write, unless [lzb/allow_unfiltered_html](https://www.lazyblocks.com/docs/php-filters/lzb-allow_unfiltered_html/) says the current user may save unfiltered HTML.

Posts of other types never reach the check, so adding a key that a plugin also stores on regular posts costs nothing there.

## Usage

```php title="PHP"
function my_lzb_unfiltered_block_meta_keys( $keys ) {
  // Block CSS is written into a <style> tag, so give it the same guard
  // the HTML and script fields have.
  $keys[] = 'lazyblocks_style_block';
  $keys[] = 'lazyblocks_style_editor';

  return $keys;
}

add_filter( 'lzb/unfiltered_block_meta_keys', 'my_lzb_unfiltered_block_meta_keys' );
```

Adding a key narrows who can write it. Removing one of the three defaults reopens the direct meta path for that field to any user who can edit a block, which is what the guard exists to prevent. The filter runs on every `add_post_meta()` and `update_post_meta()` call on the site, so keep the handler free of database queries.

## Documentation Index
> Fetch the complete documentation index at: https://www.lazyblocks.com/llms.txt
> Fetch every page in a single file at: https://www.lazyblocks.com/llms-full.txt