Topic: Slashes get sanitized from custom hook names

Dominic_
January 5, 2026 at 8:42 am
While working on a site I noticed that when creating a block element on a custom hook, slashes in the hook name get removed during sanitization. This breaks compatibility with commonly used hook namings.

Example:
- Input: my_plugin/group/stuff
- After sanitization: my_plugingroupstuff
Problem:
The sanitize_custom_hook() function uses sanitize_key(), which strips slashes.

Is there any particular reason for such a strict sanitation?

Also: Is it save for us to manually update the post-meta _generate_custom_hook to the correct hook-name, or is it stored somewhere else too?

Thanks!
Best
Dominic
David
January 6, 2026 at 4:14 am
Hi there,

it’s a legacy thing and not something we have had any call to change. I will raise an issue to see if we can fix this.

Updating the post meta; “should” work although I have not tested.

Alternatively the sanitize_key has a filter. And you could do something like this to bypass the filter just for you “prefixed” hook:
```
add_filter( 'sanitize_key', function( $key, $raw_key ) {

    // Only target GeneratePress custom hook identifiers
    if ( strpos( $raw_key, 'my_prefix/' ) === 0 ) {
        return $raw_key; // preserve slashes
    }

    return $key;

}, 10, 2 );
```
Dominic_
January 7, 2026 at 12:56 am

Hi David,

thanks for the fast clarification!
Updating the value in the DB worked for now and it doesn’t seems to be referenced somewhere else.

Best
Dominic
David
January 7, 2026 at 2:08 am

Glad to hear that!

Viewing 4 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.

Are you a GenerateCustomer?

Just browsing?

Slashes get sanitized from custom hook names