Timeline for Is Wrapping intval() Around esc_attr() Redundant for Escaping Input?
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 24, 2020 at 5:52 | comment | added | Vitauts Stočka |
@kaiser Sure, and it MUST be escaped or otherwise considered unsafe when you are processing POST request from user. But have you seen OP example? $x value there is not received from user input and could not be changed, no matter what he/she does in dev-tools or other way. Escaping in THIS case is just unnecessary operation.
|
|
| Jan 23, 2020 at 21:43 | comment | added | kaiser |
Open your dev-tools, change the value of an option and you got user generated input.
|
|
| Jan 23, 2020 at 20:29 | comment | added | Vitauts Stočka |
@kaiser What is possible scenario in OP example how $x value may get compromised? It is not user input, it is assigned by loop itself and used only in loop scope. Maybe I am wrong, but I really want to understand how in this case it can be anything else than integer?
|
|
| Jan 23, 2020 at 20:07 | comment | added | kaiser | Why would a loop make it safe? | |
| Jan 23, 2020 at 19:40 | history | answered | Vitauts Stočka | CC BY-SA 4.0 |