0

On my site's search results page I am outputting the search term as follows:

<?php echo esc_html($_GET['s']); ?>

For the search term "SEARCH-TERM" (including the quotes) I would expect this to appear in the source as:

&quot;SEARCH-TERM&quot;

But what the source actually contains is:

\"SEARCH-TERM\"

which appears on the page as \"SEARCH-TERM\".

I am also outputting the search term as follows:

<input type="search" value="<?php echo esc_attr($_GET['s']); ?>">

This is appearing in the source as:

<input type="search" value="\"SEARCH-TERM\"">

and is actually appearing in the input box as \"SEARCH-TERM\" when viewed by the user.

The search term appears in the URL as %22SEARCH-TERM%22 which I believe is the correct URL representation of the search phrase.

I am struggling to understand why the characters are not being escaped as expected when using esc_html and esc_attr.

Any insight would be greatly appreciated.

I am running WordPress version 4.4.2.

Improve this question
5
  • 3
    $_GET and $_POST are "quoteescaped" by default. so you have to unescape first like this : echo esc_html(wp_unslash($_GET["s"]))
    – mmm
    Commented Mar 17, 2016 at 16:39
  • @mmm, why not a proper answer?
    – Mark Kaplun
    Commented Mar 17, 2016 at 17:05
  • because an answer at another question was downvoted because the answer was too short. then from now a put the small answer in comments
    – mmm
    Commented Mar 17, 2016 at 17:20
  • @mmm Your previous answer was downvoted due to it only being a link. You should actually reread my message to that answer. Answers can be a one liner if it directly answers the question and does not send someone to another place where he/she might find an answer. Just a note, if your answer gets downvoted due to lack of info, you can always edit your answer, and if the edit is sufficient, the downvotes can be removed. I always remove my downvote if an answer was properly edited ;-)
    – Pieter Goosen
    Commented Mar 17, 2016 at 17:49
  • 1
    @PieterGoosen my answer was not a just a link, I answer by giving the name of the function which provide the exact data which was researched and in these answers I try to add a link in order that next time, this personne will search on the codex before to ask here. finally my answer was so small that you only saw the link ^^
    – mmm
    Commented Mar 17, 2016 at 17:59

1 Answer 1

Reset to default
3

Use get_search_query or the_search_query to return/output the search term as a properly escaped value, don't access $_GET directly. You're trying to escape something that's already URLencoded.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.