2

I have been reading that sanitizing data output is important in theme / plugin development for wordpress.

Is it necessary to use functions such as esc_url with template tags like get_permalink, or is the sanitization taken care of by the template tag?

Thanks

  • It is better to be safe, isnt it? :-) – Nilambar Sharma Aug 6 '14 at 3:25
3

sanitizing have nothing to do with escaping, and escaping is not a cure to everything.

The role of escaping is to convert a string to a proper HTML. What is a proper HTML representation of a string might depend upon the context and that is the reason you have several escaping functions esc_html,esc_url and esc_attr.

Unlike escaping which have to preserve the meaning of the string sanitizing might remove/change parts of it. For example a user in an author role can add iframes ia the "test" tab of the editor but they will be removed from the content when it will be saved as part of sanitizing it.

Sanitizing should be done when escaping will not be done. For example think of a widget in which you input the embed code of some youtube video. This code is supposed to get as it is into the HTML generated by the site and escaping it will ruin it, therefor you need to sanitize the content before displaying it to make sure that it indeed contains a valid youtube embed code and nothing more.

9

we have "get_permalink" and "the_permalink" functions in wordpress. "get_permalink" function Returns the permalink to a post or page for use in PHP, and "the_permalink" function Displays the URL for the permalink to the post currently being processed in The Loop! if you look up at the file where these functions are defined you can see that get_permalink function doesn't escape but the_permalink uses esc_url in its body! reference: link-template.php

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.