Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP which is 200+ options long, but is stored - in its entirety - simply as
$ctry_code_sel. Of course, I get the sentiment that "Everything is Suspect", and I get using wordpress's native
esc_attr_e etc. in response, but it seems that
esc_html_e et.al. are of no use in cases such as this.
When the time comes - on any given page - that I want to output my select field (e.g
echo $ctry_code_sel;) is there something I can/should be doing there to guard against cross-site-scripting attack etc.?