New answers tagged escaping
I think I have figured out the problem, though I have yet to solve it. I am running the shortcode in a WP Types custom WYSIWYG field. The shortcode works perfectly everywhere else, including directly in my theme files and in the native WordPress content WYSIWYG, so it seems it is a bug in WP Types. I'm submitting a bug report, but hopefully my findings will ...
YES. You always escape output that originally comes from user submitted data. To be safe, you always escape variable output, period.
Yes, You should but not always. Like whenever you are not sure that a user might enter some html stuff like a hyperlink and you don't want that, then you should escape it. As codex says : Always use when escaping HTML attributes. Codex: esc_attr Wordpress Codex
Yes you should escape. the DB is supposed to hold the raw value therefor you should assume it needs to be escaped. Do you need to escape every little thing like in your example? I don't, but maybe you should not do as I do ;) Some things are safer to assume that the user will not input some random keystrokes, but there is always that one user that will ...
Top 50 recent answers are included