I'm using the Settings API on a custom settings page:

<form action='options.php' method='post'>
    do_settings_sections('myplugin_settingsPage' );

It's a very simple simple settings page, with a few text input fields. The problem is, some of the fields' values contain double quotes (for example, Jhon "cracy" Garcia), and it seems Wordpress doesn't escape this character. The value stored in the database seems ok, I've checked it. But, when you visit the settings page a second time, this is the HTML generated by Wordpress:

<input name='myplugin_settingsPage[name]' value="Jhon "cracy" Garcia" size=40>

As you can see, the quotes aren't being urlencoded so the generated HTML is broken. Am I doing something wrong? Is it a bug in Wordpress?

1 Answer 1


I found the problem. You need to escape the values in the _render functions, using esc_attr, like this:

function my_setting_render() {
    $options = get_option('my_option_name');
    ?><input name='my_option_name[my_setting]' value="<?php echo esc_attr($options['my_setting']);?>">


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.