Why should I escape translatable strings? and how shall i do that?

Question

Is it really need to escape translatable strings?

Answer 1

Is it really need to escape translatable strings?

Yes. If a string is translatable then that means its value can be changed from an external source. This means it's not safe.

and how shall i do that?

See the documentation on how to escape with WordPress.

When it comes to translatable strings, there are two main functions to use: esc_html__(), esc_attr__(), esc_html_e(), and esc_attr_e(). These functions are essentially just esc_html() and esc_attr() combined with the __() or _e() translation functions.

The thing you need to be aware of is that escaping should happen as late as possible. Ideally the last thing that happens before output. In your screenshot you appear to be just defining strings for later use. In that case you wouldn't use esc_html__() at this point. Instead you'd just use __() and then use esc_html() whenever you actually output the string.

Here's a couple of good resources on the topic:

• https://tomjn.com/2015/05/07/escaping-the-unsecure/
• https://wpvip.com/documentation/vip-go/validating-sanitizing-and-escaping/