I have code like this:
<?php echo '<div class="class-name">' . __( 'Text','text-domain' ) . '</div>'; ?>
in a plugin of mine.
Do i have to escape this? (esc_html or similiar)?
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It only takes a minute to sign up.Sign up to join this community
The answer typically depends on where your translations come from. WordPress core doesn't usually escape strings such as this, but you may wish to do so in your plugin.
In addition, using escaping functions around strings such as this means your code will pass the WordPress Code Standards sniffers.
No. There is no user supplied data in that string. You only have to escape user supplied data. The only why this could be hacked would be if someone managed to push something nasty through the
__() function but that would mean a server level hack, if possible at all, and if that were the case no escaping is going to fix anything. With that kind of hack, the attacker can do virtually anything.
No. The contents of your
echo statement will be output to the browser with no problems.