WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

how does esc_html__ (the 2nd one) protect the $message variable from being hacked ? what's the point to use this protection here (the second one with a plain text)?


function unknown(){

    /* If the user input any text, escape it. */
    if ( !empty ( $_POST['unknown'] ) )
        $message = esc_html ( $_POST['unknown'] );

    /* If no text was input, use a default, translated message. */
        $message = esc_html__( 'No message input by the user.', 'unknown' );

    return $message;



share|improve this question
up vote 2 down vote accepted

It really doesn't do much in that scenario. If you're going to leave that message as a string constant instead of something that is system or user generated, you're fine using one of the other translation functions: __() or _x(). esc_html__() is a little overkill for that particular line of code.


The main reason for the esc_ functions is to protect your site against bad input, either intentional or accidental. You're going to want to use the appropriate function whenever you're working with any data that can be manipulated by a user or is not explicitly set by you.

If you have any questions about WP functions in the future my recommendation would be to check the source. Either do a search in a WP install to find the function, or click the link at the bottom of the codex page that links to the source file.

share|improve this answer
thanks, so it is useless here? i found it in a book, but i guess the "esc_" function is to be used when a "user" is writing something, right? or is it because a "hacker" can intercept the communication between the code and the file with all the translations...? i don't really know about this... – Paul Mar 19 '12 at 21:10
Updated my answer to be a bit more helpful. – DM. Mar 20 '12 at 0:59
thanks DM for the edit – Paul Mar 20 '12 at 13:12

One major principle of preventing security holes is "Escape late." That means that, ideally, esc_html() or esc_attr() should be used right when you echo or return the final HTML, not before. So, that's one thing that the example you gave gets wrong.

As for the purpose of esc_html__(), as I understand it, is to prevent weird characters from translated strings (not the original ones you see in the code) from messing up textareas and such.

share|improve this answer
thanks scribu for the answer – Paul Mar 20 '12 at 13:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.