I am getting information from the database to show it to the user, example:

$data = (get_option('config')) ? get_option('config') : false;

I need to display this data when loading the webpage, example:

<label><?php echo $data['title']; ?></label>
<input type="text" value=" <?php echo $data['value']; ?> " >

Is it necessary protect this data before showing it to the user, if the information is obtained from the database?

Thank you very much

up vote 4 down vote accepted

Well, it depends on the context. Usually we don't need to protect data for only showing it in frontend. But the best practice is, always escape or validate data, no matter where they comes from. Like for your case you can do that like below-

<label><?php echo esc_html( $data['title'] ); ?></label>
<input type="text" value=" <?php echo esc_attr( $data['value'] ); ?> " >

Hope this above helps.

  • That’s not a string in that translate function. It’s a variable. Variables shouldn’t be used in translate functions. – Jacob Peattie Sep 29 '17 at 4:47
  • 1
    Uha... I didn't notice that ! Thanks ! @JacobPeattie I'll change my answer ! – CodeMascot Sep 29 '17 at 5:13

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.