Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development like:

esc_html ( the_title () )

Edit: as pointed out in the answers below the above code is wrong regardless - the code should have read esc_html ( get_the_title () )

share|improve this question
    
No, those functions are already sanitized, so its not required to do so. Except in the case of the_content which outputs HTML from the TinyMCE editor, in which you input. This is more so reserved for form inputs or data created on the front end for example by your users. –  userabuser May 18 '12 at 16:40

2 Answers 2

up vote 9 down vote accepted

Escaping depends entirely on the context in which you are using the functions. What is safe for displaying inside <h1> tags, is not necessarily safe to display for the value attribute of an input field, and even that wouldn't necessarily be safe as a href attribute value....

In short - perform the sanitisation yourself as you output it. Though in the case of the_title () or get_the_title (), esc_html is not necessary, since WordPress applies the following functions:

Note: the_title prints the title - so esc_html ( the_title () ) won't work. Similarly, the_content prints the content (in any case, you'd expect the content to display HTML).

share|improve this answer
    
oops silly me ... yes of course esc_html( the_title()) won't work. Thanks for your answer. –  byronyasgur May 18 '12 at 16:40
3  
Related: to output Post Title in an HTML attribute, use the_title_attribute() –  Chip Bennett May 18 '12 at 16:46

Yes and no - depends on whether you want html in those functions to be output or not. If you escape the_content(), for example, and it contains a <div> tag, that tag would actually be output to the page as &lt;div&gt; instead.

By the way, if you do escape the output of those functions, you'll want to use their "get_" equivalents (ex. get_the_content()) as those functions echo their output directly.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.