Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I've read Professional WordPress and it says:

esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities

esc_attr function is used for escaping HTML attributes

esc_url. This function should be used to scrub the URL for illegal characters. Even though the href is technically an HTML attribute

What's the difference between these?

If I have

<script>alert('hello world!');</script>this is some content

Would all < > be converted to &lt; &gt;? Will the URL be something like %xxx?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

esc_html and esc_attr are near-identical, the only difference is that output gets passed through differently named filters ( esc_html and attribute_escape respectively).

esc_url is more complex and specific, it deals with characters that can't be in URLs and allowed protocols (list of which can be passed as second argument). It will also prepend input with http:// protocol if it's not present (and link is not relative).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.