I'm developing a WordPress theme and trying to escaping group of attribute at once that store with a variable.

$attributes = array();
$classes = array(
if ( true == $noticebar ) {
    $classes[] = 'topnotice-exist';
if ( true == $option['switch-top-bar'] ) {
    $classes[] = 'topbar-exist';
if ( true == $option['switch-menu-sticky'] ) {
    if ( '2' == $option['fixed-menu-style'] ) {
        $classes[] = 'fixed-after-pixel';
    } elseif ('3' == $option['fixed-menu-style']) {
        $classes[] = 'only-after-scroll-up';
    } else {
        $classes[] = 'only-after-scroll';

$classes = implode( ' ', $classes );

if ( $classes ) {
  $attributes[] = 'class="' . trim( $classes ) . '"';

if ( $option['transition'] ) {
    $attributes[] = 'data-transition="' . esc_attr( $option['transition'] ) . '"';
$attributes[] = 'id="header"';
$attributes = implode( ' ', $attributes );

<div <?php echo $attributes; ?>> <!-- here is my question -->
    <!-- html/php -->

So my question is how may I escape $attribute here, I can't use esc_attr() nor esc_html() . currently I'm using wp_kses_post() for escaping this $attribute variable but I'm not sure that is it good idea or not.

I have good idea about sprintf() and printf() so don't bring them here, I just need know, How can I echo $attribute with proper way according to WordPress escaping roles?

  • there is nothing wrong with your code. please explain the actual issue you have Oct 26 '17 at 7:00
  • I don't have one, My question was, how can I echo $attributes variable here and maintain WordPress standard escaping rules. Or if I directly echo $attributes variable here is it good for codex theme or like themeforest?
    – mlimon
    Oct 26 '17 at 8:34
  • 1
    if you want to match some code style verification tool than you need to follow what it want. Your code as it is is in perfect shape. To get past WPCS you might need to echo each attribute by itself, other tools might need different things, but again this is basically a limitation on how good are the tools in statically inspecting your code. Oct 26 '17 at 9:26

The reason you escape attributes is to make sure that the values don't have any characters that will break the HTML of the element. For example, if you didn't escape:

$attr = 'foo"> <script>alert("Bad!");</script>'; 

Then this:

<div class="<?php echo $attr; ?>"></div>

Would output:

<div class="foo"> <script>alert("Bad!");</script>"</div>

Which would let the script run.

So wp_kses_post() is completely wrong for this, because it's not going to prevent that because it doesn't escape characters for attributes. This is what esc_attr() is for, but you can't use that with your current code because your array includes the attribute name and ="". Meaning it's too late to escape $attribute because you can't escape the values without breaking the attributes.

But here's the thing: All but one of your attributes is coded by you! There's no point escaping any of your classes because they're not coming from potentially unsafe user input. The only value that needs to be escaped is $option['transition'], because it's coming from a saved option. But you're already doing that.

But to answer the question in your title, in case someone comes searching, the way to bulk escape attributes would be to put the values into an array and use array_map() to run esc_attr() on all of them.

See this example, imagining $attribute was initially populated with unsafe inputs:

$attribute = array(

$attribute = array_map( 'esc_attr', $attribute );
  • Thanks for your brief. anyway if I directly echo $attributes here. Then is it maintaining the standard rules of WordPress?
    – mlimon
    Oct 26 '17 at 8:32
  • 1
    The only ‘rule’ is to escape before output. It doesn’t have to be literally in the same line as the echo though. So what you have now is fine from an escaping perspective. Oct 26 '17 at 10:23
  • That's all I want to know :). thanks for the help, anyway I'm still curious to know. If you need to add multiple attributes not just attribute value then how you are guys gonna do that?
    – mlimon
    Oct 26 '17 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.