As a plugin developer, I have been storing special characters like ampersand as is in MySQL tables, then converting them to html entities after retrieving them for display.

Now I discover that (for example) wp_insert_user() converts them to entities before storing them in the database.

Have I been doing this the wrong way round? Should I convert before storing and then not convert when retrieving?

Has Wordpress Core adopted any convention for this? What do other plugin developers do?

  • sanitise early, escape late, escape often – Tom J Nowell Jul 11 '15 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.