New answers tagged sanitization
YES. You always escape output that originally comes from user submitted data. To be safe, you always escape variable output, period.
Yes, You should but not always. Like whenever you are not sure that a user might enter some html stuff like a hyperlink and you don't want that, then you should escape it. As codex says : Always use when escaping HTML attributes. Codex: esc_attr Wordpress Codex
Yes you should escape. the DB is supposed to hold the raw value therefor you should assume it needs to be escaped. Do you need to escape every little thing like in your example? I don't, but maybe you should not do as I do ;) Some things are safer to assume that the user will not input some random keystrokes, but there is always that one user that will ...
It seems that esc URL was the culprit. Even though I wanted to hard code the base URL eg. http://facebook.com/ I was esc_url'ing the input field for which to append to the base. I've switched to using a regular text field and am esc_url'ing the entire output string.
Top 50 recent answers are included