WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have written my first plugin, a shortcode plugin. I have read about wp_specialchars and wp_specialchars_decode but I'm not sure how to use them.

The plugin read a shortcode allowing some parameters and it inserts a script in the page html code. For example, [MYSHORTCODE TITLE="a short title"] yields the following script code lines:

$html ="<script type=\"text/javascript\">\n"
$html.="var text=\"" . $par['title'] . "\";\n"

I'm not sure if here I need to write:

$html.="var text=\"" . wp_specialchars_decode($par['title']) . "\";\n"


$html.="var text=\"" . wp_specialchars($par['title']) . "\";\n"

or neither one nor the other.

share|improve this question

The Codex description of these two functions:

wp_specialchars: Converts a number of special characters into their HTML entities. Specifically deals with: &, <, >, ", and '.

wp_specialchars_decode: Converts a number of HTML entities into their special characters.

According to


This function is deprecated as of WordPress 2.8.0. Please use esc_html instead.

You don't want to have special characters in your html output, so you would rather not use wp_specialchars_decode for that.

There is a special function called esc_js() that you should consider


The source code for this function can be found here:


2641     * Escape single quotes, htmlspecialchar " < > &, and fix line endings.
2642     *
2643     * Escapes text strings for echoing in JS. It is intended to be used for inline JS
2644     * (in a tag attribute, for example onclick="..."). Note that the strings have to
2645     * be in single quotes. The filter 'js_escape' is also applied here.
2646     *
2647     * @since 2.8.0
2648     *
2649     * @param string $text The text to be escaped.
2650     * @return string Escaped text.
2651     */
2652    function esc_js( $text ) {
2653            $safe_text = wp_check_invalid_utf8( $text );
2654            $safe_text = _wp_specialchars( $safe_text, ENT_COMPAT );
2655            $safe_text = preg_replace( '/&#(x)?0*(?(1)27|39);?/i', "'", stripslashes( $safe_text ) );
2656            $safe_text = str_replace( "\r", '', $safe_text );
2657            $safe_text = str_replace( "\n", '\\n', addslashes( $safe_text ) );
2658            return apply_filters( 'js_escape', $safe_text, $text );
2659    }

Here is a good data validation overview:


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.