Dynamic blocks
PHP block templates
Render attributes safely while keeping markup in your theme.
#Template contract
The template runs inside the render callback and receives $attributes. It must be a PHP file below WP_CONTENT_DIR or another explicitly trusted root.
<?php
$heading = (string) ($attributes['heading'] ?? '');
$image = (array) ($attributes['image'] ?? []);
?>
<section <?= get_block_wrapper_attributes(['class' => 'hero']) ?>>
<h2><?= esc_html($heading) ?></h2>
<?= wp_get_attachment_image((int) ($image['id'] ?? 0), 'full') ?>
</section>#Escape for the output context
| Context | Function |
|---|---|
| Visible text | esc_html() |
| HTML attribute | esc_attr() |
| URL | esc_url() |
| Trusted rich HTML | wp_kses_post() |
| Attachment image | wp_get_attachment_image() |
#Additional trusted roots
add_filter('voxycure_template_roots', function (array $roots): array {
$roots[] = '/srv/shared-wordpress-templates';
return $roots;
});