5

Title pretty much says it all. I took a look at the source, and I didn't see any escaping being done. But, I can't say for sure.

wp_localize_script( 'script-hook', 'object_name', array(
    'param_1'   => $value_1, // This?
    'param_2'   => esc_js( $value_2 ) // Or, this?
) );
2
  • What happens when you try running text that needs to be escaped through it?
    – Toby Allen
    Commented Feb 24, 2016 at 21:18
  • 1
    What? Experiment myself when I can just ask the internet? :) I'm not an expert on XSS, but when I passed in a string with a script tag, this is what was output: var object_name = {"param_1":"<script>alert(\"xss\");<\/script>"}; no alert was triggered on initial page load. Is that conclusive?
    – Dominic P
    Commented Feb 24, 2016 at 21:40

1 Answer 1

5

As far as I know wp_localize_script doesn't escape data any more than is necessary to produce valid JSON, and everything is sent as a string. The function was originally designed to allow translating the strings used in your JS into other languages (hence the "localize" part of the function name). So if the data you're passing is coming from a user input or is otherwise user-generated then you'll definitely want to escape it.

2
  • 2
    This. It escapes to make valid JavaScript. Nothing more. If you need to escape for some other use, do so.
    – Otto
    Commented Feb 25, 2016 at 0:30
  • Thanks for the clarification. Perhaps a note should be made in the code reference or Codex?
    – Dominic P
    Commented Feb 25, 2016 at 1:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.