3

I started playing with the Underscores starter theme and noticed it uses esc_html_e() even on plain text:

<a class="skip-link" href="#content"><?php esc_html_e( 'Skip to content', '_s' ); ?></a>

Is it any security risk not to escape it like so:

<a class="skip-link" href="#content">Skip to content</a>

... or is it there just for the sake of translation?

Thanks.

1 Answer 1

5

The security risk here is not about the plain text but about translation. You should note that esc_html_e is not only a function for escaping HTML but also for localization (l10n). I.e. other people can translate this String but you don't know what the translation would be. It is possible that somebody translates the String and adds a link or some malicious HTML. Therefore it is better so escape HTML in this case.

3
  • Well since you can not translate plain html content i do not see a reason to escape hard coded stuff.
    – nipeco
    Jan 21, 2016 at 11:41
  • I agree with you @leFlake. I just would have used _e to make the string translatable and echo it. So I don't know for sure why _s does this.
    – obstschale
    Jan 22, 2016 at 9:04
  • 1
    Great answer - calling attention to the fact that other people can introduce translations that may need to be escaped is the part I was missing!
    – Terri Ann
    Dec 13, 2017 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.