I'm outputting an attachment image's caption but feel I should escape the output:

    <?php echo get_post( get_post_thumbnail_id() )->post_excerpt; ?>

I was tempted to use esc_html( get_post( get_post_thumbnail_id() )->post_excerpt ) but the caption may contain legitimate markup such as <a href=""></a> etc.

How should I escape image attachment caption text considering it may contain markup I'd like to keep?

  • get_post() already have a lot of filters which handles sanitation of the post object, so IMO you do not need extra sanitation – Pieter Goosen Jul 7 '16 at 10:06
  • My understanding is you should always late escape (i.e. at the point of output)? – henrywright Jul 7 '16 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.