I have an issue with custom widgets and WordPress Coding Standards. When you create a custom widget, your class should have a "widget" method that will display the widget. Something like:

public function widget( $args, $instance ) {
    echo $args['before_widget'];
    ?> <span><?php echo esc_html( 'Great widget', 'text-domain' ); ?></span> <?php
    echo $args['after_widget'];

While this is perfectly functional, this will not pass PHP code sniffer tests with WordPress coding standards because $args['after_widget']; and $args['before_widget']; are not escaped...

What am I doing wrong?


These arguments contain arbitrary HTML and cannot be properly escaped. This is essentially a limitation on how Widgets code was designed and you can see in core Widget classes that no escaping is done on these.

Lessons to learn:

  • WP core doesn't consistently adhere to its own coding standards (and getting there isn't considered worth targeted effort);
  • passing around chunks of HTML is bad idea, in your own code pass data and render appropriately with proper escaping.
  • Ok thanks, glad I'm not crazy. I saw the core widget but figured that may still be a "better" way to do this. – guillaume.molter Dec 12 '16 at 18:20

This is a problem with overly strict coding standards, not with how you should write wordpress code. In this context both parameters are assumed to be valid HTML (they are defined in sidebar registration time).

Anyway in most tools like that there is a way to instruct the linter/sniffer to ignore that line or function.

BTW the standards you are talking about are probably the wordpress.com VIP standards, not the wordpress one - https://make.wordpress.org/core/handbook/best-practices/coding-standards/php/

  • Hi Mark, No it's core: github.com/WordPress-Coding-Standards/… – guillaume.molter Dec 12 '16 at 19:00
  • And yes there are ways to ignore the line...but I just wanted to make sure that that was the way to go here. – guillaume.molter Dec 12 '16 at 19:01
  • No they are not. The link to the coding standard is the one I have given, the link that you have given is an implementation of that coding standard into the sniffer. The result might be (and probably is) something that is more than the minimal requirements set by wordpress core development. Unlike what @rarst said, core mostly follows its coding standard, mostly because it is very easy to follow ;) – Mark Kaplun Dec 12 '16 at 19:45
  • .... loking more carfully into that github project, and you can see there are several different validatiors maintained there, one of them is the core standard, and the other (the more strick) is the wordpress.com standard – Mark Kaplun Dec 12 '16 at 19:51
  • To be clear escape sniff is part of WordPress Extra ruleset, which is considered addition to baseline WordPress Core ruleset. Of course I would consider escaping to be inherently mandatory, regardless of its formal status in WP coding standards. This is more about it being outside of "coding style" scope than being inessential. – Rarst Dec 13 '16 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.