I am passing a <ul><li></li><ul> to jquery .html() method and it works.

I am assigning the html to a varaible and passing to .html() method .

As some security scans suggest me to use esc_html on that variable.

But if i use it breaks the menu as it is not rendering html , just printing it as text.

So my question is -Do i have to sanitize HTML when i am passing it to Javascript , which is written by me ?? How ?

  • I am using wordpress. If not why should i come here and post it
    – zod
    Jul 24, 2014 at 17:27
  • Look here: codex.wordpress.org/…
    – Wyck
    Jul 24, 2014 at 17:29
  • What is the source of the html?
    – Sisir
    Jul 24, 2014 at 17:30
  • Hardcoded html menu .. makes no sense sanitising that . is it?
    – zod
    Jul 24, 2014 at 17:31
  • nop.. Sanitization is only required when you don't trust the data. For example, user input..
    – Sisir
    Jul 24, 2014 at 17:50

1 Answer 1


No, in fact sanitizing the string you listed would remove the HTML. The sanitizing functions are meant for user inputted data like a form submission. You can't always trust the information they pass through. Sometimes hackers may input malicious code that would be executed on your site after submission if you did not run it through a sanitizing function first.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.