4

Can I simply use htmlspecialchars instead of esc_attr?

Improve this question
1
  • 1
    And you could also add esc_html
    – Flimm
    Commented Aug 8, 2017 at 9:06

1 Answer 1

Reset to default
4

esc_attr() is written specifically for escaping a string that is to be used as an html attribute, which means also escaping single and double-quote characters etc.

In general, it's better to use the data validation API that WP provides rather than the generic PHP functions.

Improve this answer
2
  • And what is the difference between the WordPress function esc_html and the PHP function htmlspecialchars (with ENT_QUOTES flag)? It is also good to note that using an official PHP function instead of a WordPress function has the advantage to have a more portable code, that you can use without CMS or with another CMS.
    – baptx
    Commented Jul 19, 2019 at 15:44
  • The WordPress function can be updated with other sanitization methods as we discover them.
    – Rocky Kev
    Commented Feb 2, 2022 at 1:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.