I'm looking through _s (underscores) starter theme and see that they're using esc_html for nearly everything. Just an example from functions.php

register_nav_menus( array(
        'primary' => esc_html__( 'Primary', '_s' ),
) );

register_sidebar( array(
        'name'          => esc_html__( 'Sidebar', '_s' ),
        'id'            => 'sidebar-1',
        'description'   => esc_html__( 'Add widgets here.', '_s' ),
        'before_widget' => '<section id="%1$s" class="widget %2$s">',
        'after_widget'  => '</section>',
        'before_title'  => '<h2 class="widget-title">',
        'after_title'   => '</h2>',
) );

My current understanding of esc_html is to use it when we output either data from the database or user input.

Why escape the names of the menu and sidebar?

It's only available to people that have access to the php files and it doesn't appear to be put into the db. I looked through the db and couldn't find anything related to the names, please correct me if I'm wrong.

Is the underscores theme just being overly cautious about everything?


  • 1
    I think they are using it to internationalize the theme Commented Nov 2, 2016 at 22:07
  • @user3635808 For translation? That makes more sense. I was only looking at this from a security viewpoint and didn't consider anything else
    – John_911
    Commented Nov 2, 2016 at 22:12
  • 1
    Yes, for translation. Commented Nov 2, 2016 at 22:12
  • @user3635808 Ahhh, I didn't even catch that I was looking up esc_html instead of esc_html__ - note the double underscores at the end.
    – John_911
    Commented Nov 2, 2016 at 22:15
  • @user3635808 That may make a good answer if you add in some research and examples :)
    – Howdy_McGee
    Commented Nov 2, 2016 at 22:18

4 Answers 4


esc_html() does two things:

  1. Checks for invalid UTF8 in a string.
  2. Converts a number of special characters into their HTML entities, specifically deals with: &, <, >, “, and ‘.

Using it instead of __(), _e and other i18n functions protects your website from possible errors that can occur with unaware translators who may use text that contains (1) invalid UTF8 characters or (2) unwanted HTML code. Trust me, many translators will be tempted to use some 'nice' HTML tags like <i>, <b> etc, even worse, they won't close them correctly.

  • If you take a look at the esc_html__() source code, you can see that this function only calls the esc_html() function with the string translation, so what this post is explaining are the escape benefits and why the developers escaped these strings.
    – amieiro
    Commented Oct 10, 2021 at 4:50
esc_html__( string $text, string $domain = 'default' )

Retrieve the translation of $text and escapes it for safe use in HTML output. so esc_html__() use to make internationalize as well as security purpose


  • 1
    This should be the accepted answer.
    – Mac
    Commented Nov 22, 2017 at 18:44
  • @Mac , Yes this should be accepted. esc_html__ forbids the use of HTML in translated strings. Commented Nov 22, 2017 at 18:50

The waters are muddy here. OP's question asks about esc_html(), but his code clearly uses esc_html__(). These are not the same. The accepted answer is wrong: it refers to esc_html(), which deals with safely escaping HTML blocks. Kanon Chowdhury's reply should be the accepted answer, because OP's code deals with the I18n aspects of the Underscores WordPress starter theme (which uses the esc_html__() function).


esc_html() and esc_html__() are NOT the same functions. The main difference is, esc_html() takes just one string and returns an escaped HTML string. On the other hand, esc_html__() takes 2 strings as parameters and returns a translated and escaped string.

The accepted answer is incorrect, indeed.

  • If you think that an answer is wrong (not just not useful), you are welcome to downvote it. Accepted answer status only means that the OP finds it good enough answer for his question, but do not indicate quality, or even general correctness, those are indicated by the number of upvotes. Commented Jun 6, 2018 at 4:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.