11

why do developers use

<?php esc_html_e() >?

in 404 pages, what does it mean, how does it works?

15

It's a combination of _e(), which echoes a translatable string, and esc_html() which is for outputting text so that the text is not interpreted as HTML.

You would use it to prevent HTML being smuggled into a translation and breaking your markup or causing security issues.

For example, if your theme had:

_e( 'My translatable string', 'my-text-domain' );

Then it's possible for a translation for 'My translatable string' to be something like '<script>alert('Bad!');</script>'. If you don't use esc_html_e() then that script will be executed. If you use esc_html_e() then it won't be, because the < & > characters will be escaped as &lt; & &gt;, which out output as < and > and not interpreted as HTML tags.

1
  • 1
    All above said is correct I'd like to add a few links for you to further educate yourself (Google and - most of all - the Codex are your friends by the way): This is a good read on sanitizing data: codex.wordpress.org/… This is on the other part of the subject, translations (the whole Theme Handbook is extremely useful): developer.wordpress.org/themes/functionality/… – galingong Nov 12 '17 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.