I'm confused about the different uses of
wp_kses(). I understand that
esc_html() converts special characters to their HTML entity, and that
wp_kses() removes unwanted tags (e.g.,
<script>), but I'm not sure in what contexts they should be used together or separately.
If I run some untrusted HTML through
wp_kses() would be to avoid having the raw script displayed?
esc_html() makes it safe, and
wp_kses() makes it pretty. Is that correct?