0

I saw themeforest/WordPress.org has said all WordPress default get functions need to be escaped output for security region for WordPress Theme or Plugin development, Now I want to show password form if a post has password protected. So now I'm using get_the_password_form () function. Now I need to know this function do I need escaping?

If answer Yes, Please help me, How can I escape this function? Like esc_html (), or esc_url () etc. Which function do i need to use for escaping ?

Here is Themeforest Requirements

And Here is my code

<div class="single-blog-content">
   <?php 
        if(post_password_required()) { 
            echo get_the_password_form( );                              
        }else {
            the_excerpt(); 
        }
    ?>
</div>
1
  • You couldn't really escape it. It contains HTML so escaping it would only break it. You should contact Themeforest if you have questions about their requirements. Jan 10 '19 at 6:51
1

There is nothing to escape in your code.

Let’s say given function should return only plain text and no HTML entities should be allowed. For example you want to display the search query string.

In such case you should use esc_html.

This way, if user puts <b>ala</b> as search string, your site will print exactly that.

If you won’t escape that string before printing it, it will be treated as HTML code and you’ll see bold word ala only.

But... You have to escape with proper function depending on context.

So:

<h1>You’re looking for: <?php echo esc_html( get_query_var( 's' ) ); ?></h1>

But:

<input name="s" value="<?php echo esc_arg( get_query_var( 's' ) ); ?>"/>

So, let’s get back to your code...

get_the_password_form()

should display HTML tags and they should be processed as HTML code by browser - so you can’t escape it. If you will, you’ll see a string containing HTML tags instead of form.

2
  • Verify nice example, thanks for help with great example. Jan 10 '19 at 10:03
  • Hi, I've got the answer for this question, I've checked this function in WordPress codex, And I saw this function not echo function and also this function already escaped. If any want to need source, then any one check in WordPress codex. Here is Codex Link developer.wordpress.org/reference/functions/… Thanks everyone for help me. Jan 10 '19 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.