I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments template and few other places in my theme. What I'm not sure about is whether I'm suppose to use these functions on the data that I get from the database that the user inputs using the theme options or not. As it is still user inputted data, except that it goes through the database, before we echo it out.
I'm using the Redux Framework to create the theme options for my theme, and I have all the settings in a global variable:
And to sum up my confusion, if I want to show the logo image, do I do it like this:
img src="<?php echo $mytheme_options["logo_url"]; ?>" />
Or Like this:
img src="<?php echo esc_url($mytheme_options["logo_url"]); ?>" />
I've search around for this but didn't find any article that discusses about what to do about the user-inputted data that comes from the database. I've also looked into the code of other themes and they don't seem to escape it. But I'm not sure how they insert options in the database, which I think would somehow determine whether to escape that data or not.