2

In my WordPress workflow I use Gulp and have a task that runs my PHP files through PHPCS using the WordPress coding standards tests (https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards).

While writing my comments.php file, I have run across the following error:

Expected next thing to be an escaping function (see Codex for 'Data Validation'), not '_x'

This is being generateds by the following line of code:

printf( _x( '1 Comment on “%s”', 'Comments Title', 'jldc' ), get_the_title() );

I pretty much reused the same line from the Twenty Sixteen theme that ships with WordPress. Out of curiosity I ran PHPCS against Twenty Sixteen's comments.phpfile and got the same errors.

Now, I can easily use esc_html_x() instead of _x as I presume that is what the guidelines want me to use. But what about this line:

printf(
   _nx(
      '%1$s Comment on “%2$s”',
      '%1$s Comments on “%2$s”',
      $comment_count,
      'Comments Title',
      'theme-text-domain'
      ),
      number_format_i18n( $comment_count ),
      get_the_title()
   );

Or can I simply ignore the error?

Improve this question

2 Answers 2

Reset to default
1

Consider something like the following:

echo esc_html(
      sprintf(
         _nx(
               '%1$s Comment on “%2$s”',
               '%1$s Comments on “%2$s”',
               $comment_count,
               'Comments Title',
               'theme-text-domain'
         ),
         number_format_i18n( $comment_count ),
         get_the_title()
      )
);

Where you build the entire string with sprintf and escape that.

The coding standards are clear that you should always escape output, and do so as late as possible. As you've noticed, however, even the default theme doesn't adhere to them exactly.

Improve this answer
1
  • This was the answer I got from the WordPress core team. The confusion stemmed from the fact that most of these functions now have esc_html functions built in to core, _nx is one of a few that do not.
    – Cedon
    Commented Jun 15, 2016 at 23:28
1

WordPress do not have an enforceable coding standards. There are core coding standards, there are wordpress.com VIP coding standards etc. None of them come directly from god and since they are based on the idea that you are developing for PHP 5.2 they might not even be the best thing to follow if you don't have an explicit requirement to follow them.

Use them as a guidelines, something that people put a lot of time into thinking about should not be ignored, but when it doesn't meet your specific situation don't feel bound by them.

In your specific example it is a bug in the 2016 theme as it is core guideline that translations should not escape, and the escaping should be done after the translation (translation might introduce things like quotes). You should keep this in mind and follow the same route unless you want to make the life of translators harder.

Improve this answer
1
  • They do have coding standards and PHP Code Sniffer can be set up to check your code against them. Core just does not conform to them itself because the code cannot be refactored at the moment and Twenty Sixteen, like the other out-of-the-box themes, are considered core hence why they will also generate errors.
    – Cedon
    Commented Jun 15, 2016 at 23:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.