I started playing with the Underscores starter theme and noticed it uses esc_html_e() even on plain text:

<a class="skip-link" href="#content"><?php esc_html_e( 'Skip to content', '_s' ); ?></a>

Is it any security risk not to escape it like so:

<a class="skip-link" href="#content">Skip to content</a>

... or is it there just for the sake of translation?



The security risk here is not about the plain text but about translation. You should note that esc_html_e is not only a function for escaping HTML but also for localization (l10n). I.e. other people can translate this String but you don't know what the translation would be. It is possible that somebody translates the String and adds a link or some malicious HTML. Therefore it is better so escape HTML in this case.

  • Well since you can not translate plain html content i do not see a reason to escape hard coded stuff. – nipeco Jan 21 '16 at 11:41
  • I agree with you @leFlake. I just would have used _e to make the string translatable and echo it. So I don't know for sure why _s does this. – obstschale Jan 22 '16 at 9:04
  • 1
    Great answer - calling attention to the fact that other people can introduce translations that may need to be escaped is the part I was missing! – Terri Ann Dec 13 '17 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.