WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering if you really need to escape user submitted data (widget option fields) within the widget() and form() functions (from the widget class) ?

I don't see a reason to do this, if the data is already escaped in the update() function. Or am I missing something?

share|improve this question
up vote 1 down vote accepted

Mm, they're not slashed, if that's what your meaning.

However, they're definitely not xss-sanitized. Use kses before saving, or esc_attr() on display, if you're dealing with untrusted data.

share|improve this answer
yes, but I wanted to know if you are required to sanitize them even when you're retrieving these options from the database. It just doesn't seem necessary to do that... – Alex Nov 1 '10 at 19:05
That would depend if you sanitized them before storing them in the database. – Denis de Bernardy Nov 2 '10 at 10:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.