WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm very new to WP, and from following books and online examples, I have several different 'esacping' functions in my first plugin. I would like to know if there is one function, or a minimal set of functions, I can use to prevent malicious HTML stored in my DB from doing anything bad. I would, however, always like to store text exactly as it is captured, and only sanitize it when presenting it.

share|improve this question
up vote 2 down vote accepted

Well, I would start with the one called esc_html().


Longer answer:

You should perform sanitization on input, and escaping on output.

To sanitize HTML content on input, I would use one of the kses() family of filters - particularly, wp_kses_post(), which will filter all but the HTML tags allowed via the Post Editor.

To escape HTML content on output, I would use esc_html(), which escapes HTML blocks for output.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.