3

Can I simply use htmlspecialchars instead of esc_attr?

  • 1
    And you could also add esc_html – Flimm Aug 8 '17 at 9:06
3

esc_attr() is written specifically for escaping a string that is to be used as an html attribute, which means also escaping single and double-quote characters etc.

In general, it's better to use the data validation API that WP provides rather than the generic PHP functions.

  • And what is the difference between the WordPress function esc_html and the PHP function htmlspecialchars (with ENT_QUOTES flag)? It is also good to note that using an official PHP function instead of a WordPress function has the advantage to have a more portable code, that you can use without CMS or with another CMS. – baptx Jul 19 '19 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.