I need some help here.
While developing a theme, I want to make sure there are no security issues. So all dynamic data must be correctly escaped for the context where it is rendered.
I know how to escape the following:
- If 'echo' in the attribute, use
- If 'echo' in class attribute, use
- If 'echo' in plain text, use
- If 'echo' in translation, use
But there're two areas in which I am not sure what to do.
- What escaping should I use if user output may contain some html tags, like 'em' or 'strong'?
<?php $subtitle = get_post_meta($post_id,'subtitle', true); ?> <h3 class="subtitle"><?php echo $subtitle; ?></h3>
Note that "wp_kses is an expensive function, so it should only be run when data is saved, not displayed" Proof here
- What escaping should I use to output CSS styles?
<style type="text/css"><?php echo $css; ?></style>