Using wp_localize_script in template file - is it secure?

Question

I have the following code inside one of my template files (NOT functions.php)

$datatoBePassed = array(
                'pageTitle' => get_the_title()
            );
wp_localize_script( 'main-js', 'php_vars', $datatoBePassed );

I am wondering if there are any inherent security issues when doing something like this outside of functions.php. My goal here is very simple- I'm just passing the page title into JavaScript so that way it can highlight matching text red within an existing list. I know there are probably better ways to accomplish this, but this is the best solution at the moment. If this is insecure, I can just echo it out into a display:none div, and read that instead.

Answer 1

Input/output related security issue can be roughly sorted into two buckets:

• someone manages to read information they are not supposed to;
• someone manages to write information they are not supposed to.

Localize is not capable of writing anything into site, so you are safe on that front.

On the read side it's not much different from just echoing things into page source (which it's essentially doing). The only thing you need to be careful about is that data provided cannot be manipulated by user/input.

For example page title should be precisely for the page being processed and there should be no holes allowing it to return title for a different page (which might be private and such).