I have the following code inside one of my template files (NOT functions.php)

$datatoBePassed = array(
                'pageTitle' => get_the_title()
wp_localize_script( 'main-js', 'php_vars', $datatoBePassed );

I am wondering if there are any inherent security issues when doing something like this outside of functions.php. My goal here is very simple- I'm just passing the page title into JavaScript so that way it can highlight matching text red within an existing list. I know there are probably better ways to accomplish this, but this is the best solution at the moment. If this is insecure, I can just echo it out into a display:none div, and read that instead.

1 Answer 1


Input/output related security issue can be roughly sorted into two buckets:

  • someone manages to read information they are not supposed to;
  • someone manages to write information they are not supposed to.

Localize is not capable of writing anything into site, so you are safe on that front.

On the read side it's not much different from just echoing things into page source (which it's essentially doing). The only thing you need to be careful about is that data provided cannot be manipulated by user/input.

For example page title should be precisely for the page being processed and there should be no holes allowing it to return title for a different page (which might be private and such).

  • I see, thank you. I think I am safe, since I am using get_the_page on the page template file, so it should only acces that specific page that the user is currently visiting. Jul 18, 2016 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.