New answers tagged escaping
Escaping is used to produce valid HTML or other formats, and it depends on context. Escaping a url in something like <a href="<?php echo $url?>".... is needed in order to replace any "&" characters with & (although browsers will most likely fix it for you if you don't do it). Escaping a url in an input element like <input ...
You should always escape your data, whatever its origin. For your example, the URLs should be escaped using esc_url(). WordPress has many functions which can be used. There's an article on Data validation on the Codex which lists the various functions available.
No other value can be used in place of display and db. WordPress just check for value display and convert & and 'quotes to HTML entities (Including all other characters). If you pass db it is just skip this block of code. However, WordPress recommends to use esc_url_raw() instead of passing third argument. You can use esc_url_raw() when saving ...
The security risk here is not about the plain text but about translation. You should note that esc_html_e is not only a function for escaping HTML but also for localization (l10n). I.e. other people can translate this String but you don't know what the translation would be. It is possible that somebody translates the String and adds a link or some malicious ...
Top 50 recent answers are included