Title pretty much says it all. I took a look at the source, and I didn't see any escaping being done. But, I can't say for sure.

wp_localize_script( 'script-hook', 'object_name', array(
    'param_1'   => $value_1, // This?
    'param_2'   => esc_js( $value_2 ) // Or, this?
) );
  • What happens when you try running text that needs to be escaped through it?
    – Toby Allen
    Feb 24 '16 at 21:18
  • 1
    What? Experiment myself when I can just ask the internet? :) I'm not an expert on XSS, but when I passed in a string with a script tag, this is what was output: var object_name = {"param_1":"<script>alert(\"xss\");<\/script>"}; no alert was triggered on initial page load. Is that conclusive?
    – Dominic P
    Feb 24 '16 at 21:40

As far as I know wp_localize_script doesn't escape data any more than is necessary to produce valid JSON, and everything is sent as a string. The function was originally designed to allow translating the strings used in your JS into other languages (hence the "localize" part of the function name). So if the data you're passing is coming from a user input or is otherwise user-generated then you'll definitely want to escape it.

  • 2
    This. It escapes to make valid JavaScript. Nothing more. If you need to escape for some other use, do so.
    – Otto
    Feb 25 '16 at 0:30
  • Thanks for the clarification. Perhaps a note should be made in the code reference or Codex?
    – Dominic P
    Feb 25 '16 at 1:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.