WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So what's the difference between these, and when should we use each one? Is esc_attr() safe enough to escape any type of data you get from the user ?

share|improve this question
This is very close to whats the difference between esc_* functions question. If you add this as comment there I will try to write out my answer to include functions you mention. – Rarst Oct 28 '10 at 16:47
up vote 2 down vote accepted

esc_attr() is, for the most part, an alias for a) kses (strips evil chars to prevent xss) and b) htmlspecialchars(), for use in HTML attributes. It can be used to display sanitized user input that cannot contain HTML.

If you need only to sanitize strings before storing in the db, there are multiple variants of kses available.

Also, don't miss the other esc_*() functions. There are quite a few.

The other two you mention are self-explanatory.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.