WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It only takes a minute to sign up.
Sign up to join this community
I am passing a <ul><li></li><ul> to jquery .html() method and it works.
I am assigning the html to a varaible and passing to .html() method .
As some security scans suggest me to use esc_html on that variable.
But if i use it breaks the menu as it is not rendering html , just printing it as text.
So my question is -Do i have to sanitize HTML when i am passing it to Javascript , which is written by me ?? How ?
No, in fact sanitizing the string you listed would remove the HTML. The sanitizing functions are meant for user inputted data like a form submission. You can't always trust the information they pass through. Sometimes hackers may input malicious code that would be executed on your site after submission if you did not run it through a sanitizing function first.
