When outputting data prior to rendering it, what is best practice in terms of when to use esc_html()? For example, what if my PHP template contains the following code:

<?php $title = "Contact"; ?>
<h1> <?php echo $title; ?> </h1>

Would I need to wrap $title in esc_html()? If the answer is 'no,' can you give me an example of when I would need to wrap $title in esc_html()? Assume there is no user input on the page in-question.

This Codex page seems to say 'yes,' a variable should be escaped with esc_html() anytime it is enclosed in an HTML element. But this page seems to indicate 'no', a variable should be escaped with esc_html() only if there is a chance the variable could text that could be interpreted as harmful/unexpected HTML (i.e. a dynamic variable, or user inputted variable).

Previous Stack Exchange Questions

I've seen the following Stack Exchange questions, which give some insight. But none have an accepted answer, so I was hoping to get one here. The replies in these questions indicate that the answer to my question is 'no,' esc_attr() is not needed in my particular case.

• Question 1 - The reply here simply says one doesn't need to esc_html() on hard coded URLs.
• Question 2 - The reply here indicates I need to esc_html(), "...anytime you are not 100% sure that what you want to output is a valid HTML for that context."
• Question 1 - This says, "don't bother to escape static strings, it's pointless."

When outputting data prior to rendering it, what is best practice in terms of when to use esc_html()? For example, what if my PHP template contains the following code:

<?php $title = "Contact"; ?>
<h1> <?php echo $title; ?> </h1>

Would I need to wrap $title in esc_html()? If the answer is 'no,' can you give me an example of when I would need to wrap $title in esc_html()? Assume there is no user input on the page in-question.

This Codex page seems to say 'yes,' a variable should be escaped with esc_html() anytime it is enclosed in an HTML element. But this page seems to indicate 'no', a variable should be escaped with esc_html() only if there is a chance the variable could text that could be interpreted as harmful/unexpected HTML (i.e. a dynamic variable, or user inputted variable).

Previous Stack Exchange Questions

I've seen the following Stack Exchange questions, which give some insight. But none have an accepted answer, so I was hoping to get one here. The replies in these questions indicate that the answer to my question is 'no,' esc_attr() is not needed in my particular case.

• Question 1 - The reply here simply says one doesn't need to esc_html() on hard coded URLs.
• Question 2 - The reply here indicates I need to esc_html(), "...anytime you are not 100% sure that what you want to output is a valid HTML for that context."
• Question 3 - This says, "don't bother to escape static strings, it's pointless."

When outputting data prior to rendering it, what is best practice in terms of when to use esc_html()? For example, what if my PHP template contains the following code:

<?php $title = "Contact"; ?>
<h1> <?php echo $title; ?> </h1>

Would I need to wrap $title in esc_html()? If the answer is 'no,' can you give me an example of when I would need to wrap $title in esc_html()? Assume there is no user input on the page in-question.

This Codex page seems to say 'yes,' a variable should be escaped with esc_html() anytime it is enclosed in an HTML element. But this page seems to indicate 'no', a variable should be escaped with esc_html() only if there is a chance the variable could text that could be interpreted as harmful/unexpected HTML (i.e. a dynamic variable, or user inputted variable).

Previous Stack Exchange Questions

I've seen the following Stack Exchange questions, which give some insight. But none have an accepted answer, so I was hoping to get one here. The replies in these questions indicate that the answer to my question is 'no,' esc_attr() is not needed in my particular case.

• Question 1 - The reply here simply says one doesn't need to esc_html() on hard coded URLs.
• Question 2 - The reply here indicates I need to esc_html(), "...anytime you are not 100% sure that what you want to output is a valid HTML for that context."
• Question 1 - This says, "don't bother to escape static strings, it's pointless."

When outputting data prior to rendering it, what is best practice in terms of when to use esc_html()? For example, what if my PHP template contains the following code:

<?php $title = "Contact"; ?>
<h1> <?php echo $title; ?> </h1>

Would I need to wrap $title in esc_html()? If the answer is 'no,' can you give me an example of when I would need to wrap $title in esc_html()? Assume there is no user input on the page in-question.

This Codex page seems to say 'yes,' a variable should be escaped with esc_html() anytime it is enclosed in an HTML element. But this page seems to indicate 'no', a variable should be escaped with esc_html() only if there is a chance the variable could text that could be interpreted as harmful/unexpected HTML (i.e. a dynamic variable, or user inputted variable).

Previous Stack Exchange Questions

I've seen the following Stack Exchange questions, which give some insight. But none have an accepted answer, so I was hoping to get one here. The replies in these questions indicate that the answer to my question is 'no,' esc_attr() is not needed in my particular case.

• Question 1 - The reply here simply says one doesn't need to esc_html() on hard coded URLs.
• Question 2 - The reply here indicates I need to esc_html(), "...anytime you are not 100% sure that what you want to output is a valid HTML for that context."
• Question 1 - This says, "don't bother to escape static strings, it's pointless."