Simple question,

I see that some themes are using esc_attr or esc_html and url after they define varible with get_post_meta, while others are using it during variable definition. What would be best practice


$portf_icon = get_post_meta($post->ID,'dt_portf_icon',true);    
echo esc_html($portf_icon);


$portf_icon = esc_html(get_post_meta($post->ID,'dt_portf_icon',true));
echo $portf_icon;

Does it have any difference and which one would be best practices?

  • Your question is not specific to WordPress. BTW both of them are right, and there's no good practice in alternative good ways - it's a matter of personal choice. And you can also use: echo esc_html( get_post_meta( $post->ID, 'dt_portf_icon', true ) ); - everything in a single line. :) – Mayeenul Islam Feb 28 '15 at 11:02
  • @GoranJakovljevic Ha! I need more sleep ;) There's no difference between the two. – TheDeadMedic Feb 28 '15 at 15:51

The best practice in the WordPress world is to "escape late" i.e. at the point of output. While the two examples are effectively the same, the first one would be more effective if that code is ever refactored and the value of $portf_icon changes between where it's first assigned & where it's output.

This is especially important on WordPress VIP, and their documented coding standards includes a section on escaping late.

Not the answer you're looking for? Browse other questions tagged or ask your own question.