I am working to internationalize my plugin. As I can see on Wordpress site about esacaping, it says you should always use it. But as I can see in many popular plugins, they have used _e instead apart from few specific cases. So should I always use escaping or not for all strings, if not then for what specific cases should we use it?

1 Answer 1


Always escape output unless you have a great reason not to.

The main thing that you lose when escaping translated strings is the ability to use html tags and html entities in the original string and translations, but you should probably not get into a situation in which translators are required to know html just in order to translated several words in the first place.

If for whatever reason you have to include an html entity as part of the string you can use printf/sprintf to give the translator some flexibility on the location of such an entity in string with something like

printf('%s&%s',esc_html__('first part','td'),esc_html__('second part','td'))

where & is just an example for an html entity.

Obviously there might be more complex scenarios that might be impossible to escape in a sane way, but your guiding light should be to always escape by default.

  • Splitting the string, if it is mid-sentence, would probably be bad for translation. It is actually fine to include HTML entities, since esc_html() is idempotent and won't double-escape. It would only be if you wanted to include actual HTML tags. In that case, you can use wp_kses() on the result, or possibly split the string as suggested.
    – J.D.
    Aug 20, 2017 at 19:37
  • always good to learn something new, but I do not like the idea of using the kses family as a solution as those functions as they might remove parts of the string which means they are sanitizing and not escaping. (and maybe someone like you that is not fed up with how core works, can fix the description of esc_html to correctly reflect what it does) Aug 21, 2017 at 4:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.