I uploaded a Theme at THE marketplace and got soft rejected because I should "always escape late"

I am not sure how to solve this other than I did. I have multiple if statements where HTML is saved in a variable. I escaped the user values there and later output the variable without escaping it again, because it contains static HTML code.

if(get_post_meta( get_the_ID(), "portfolio-lightbox", true ) == '1') {
    $portfoliolink = '<a href="'. esc_url(wp_get_attachment_url( get_post_thumbnail_id() )) .'" class="prettyPhoto" rel="prettyPhoto[portfolio]" title="'.esc_attr(get_the_title()).'">';
} else {
    $portfoliolink = '<a href="'. esc_url(get_permalink()) .'" title="'.esc_attr(get_the_title()).'">';

echo $portfoliolink;

They don't like the echo $portfoliolink; because it is not escaped. There are multiple if statements like this that contain variables with HTML code.

I don't like using wp_kses because of the performance. And esc_html() would mess up the html code.

Maybe I am just missing something obvious here. Can you guys help?

  • 1
    I'm not familiar with Theme review rules of WordPress.org and I think is off-topic here (not sure). Anyway, I don't see where you have the problem; just do things in a different order to fit the rules they gave you. First, you could create variables with attribute's values (href, title, and so on) and second you could echo the link scaping the attributes at that point. – cybmeta May 7 '15 at 14:02
  • I suggest you go with cybmeta, create variables inside the algorithm ( if .. else .. ) like $link, $title, $class, $rel and call everything in the return or echo line. e.g pastebin.com/Eu9ccrXV – Samuel Elh May 7 '15 at 15:40

I share your frustration. Not because I believe they are wrong (per se), but because late escaping makes for a really awful developer experience and hard to read code.

There is currently a shared agreement among most professional-level WordPress developers that late escaping is the gold standard for output security:

As to how to solve your particular problem, I'm not 100% sure what THE marketplace will say but one approach they might accept would be to write your own template tags for each of the places where you are outputting HTML you don't want to run through wp_kses_post() and store them in template-tags.php in your theme and point them to that file during code review your template tags.

Here is what one function might look like ti all the correct output escaping required:

function the_portfolio_link( $post_id ) {
   return '<a href="' . esc_url( get_post_permalink( $post_id ) ) . "'>" . 
      esc_html( get_the_title( $post_id ) ) . '</a>';

Another approach might be to write all the HTML you want to use repeatedly as partial templates. What follows is a function called the_partial() to load your partial templates that you could include in your theme's functions.php file:

function the_partial( $template_file, $_partial_file, $args = array() ) {
    $_partial_file = dirname( $template_file ) . "/partials/{$_partial_file}.php";
    extract( $args, EXTR_SKIP );
    unset( $args );
    require ( $_partial_file );


And then this is how you might call your partial template from within your theme template file:

<?php the_partial( __FILE__, 'portfolio-link', array( 'post_id' => $post->ID ) ); ?>

That said I have always hated late-escaping because it puts the burden on the programmer and not on the computer; wasn’t the latter supposed to make us more productive? :-) Plus late-escaping if very anti-D.R.Y.

Because late escaping bothered me so much I worked on a better solution, and have been using in client apps for a couple years now. The solution is to use objects for post types, taxonomy terms, user roles with Module and View objects where the View objects automatically escape Module methods based on naming conventions. I’ve recently released an open-source library WPLib that packages this better solution for others to use.

We are still in beta pending 1.0 release but the library is successfully in-use at numerous client sites; would love to get your take on the concept.

Here is a guide we have written for code-reviewing a WPLib-based sites as well as a guide for understanding a WPLib-based apps; that should give you enough to hopefully understand it without requiring you to try to grok the library from scratch.

BTW, the template suggestion I gave is pretty much baked into WPLib and is a best practice because we never want site-specific HTML to be buried into a function or class method where the themer has to know PHP to find and understand it.

Hope this helps?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.