I am getting information from the database to show it to the user, example:

$data = (get_option('config')) ? get_option('config') : false;

I need to display this data when loading the webpage, example:

<label><?php echo $data['title']; ?></label>
<input type="text" value=" <?php echo $data['value']; ?> " >

Is it necessary protect this data before showing it to the user, if the information is obtained from the database?

Thank you very much


Well, it depends on the context. Usually we don't need to protect data for only showing it in frontend. But the best practice is, always escape or validate data, no matter where they comes from. Like for your case you can do that like below-

<label><?php echo esc_html( $data['title'] ); ?></label>
<input type="text" value=" <?php echo esc_attr( $data['value'] ); ?> " >

Hope this above helps.

| improve this answer | |
  • That’s not a string in that translate function. It’s a variable. Variables shouldn’t be used in translate functions. – Jacob Peattie Sep 29 '17 at 4:47
  • 1
    Uha... I didn't notice that ! Thanks ! @JacobPeattie I'll change my answer ! – CodeMascot Sep 29 '17 at 5:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.