When outputting data prior to rendering it, what is best practice in terms of when to use
esc_html()? For example, what if my PHP template contains the following code:
<?php $title = "Contact"; ?> <h1> <?php echo $title; ?> </h1>
Would I need to wrap $title in
esc_html()? If the answer is 'no,' can you give me an example of when I would need to wrap
esc_html()? Assume there is no user input on the page in-question.
This Codex page seems to say 'yes,' a variable should be escaped with
esc_html() anytime it is enclosed in an HTML element. But this page seems to indicate 'no', a variable should be escaped with
esc_html() only if there is a chance the variable could text that could be interpreted as harmful/unexpected HTML (i.e. a dynamic variable, or user inputted variable).
Previous Stack Exchange Questions
I've seen the following Stack Exchange questions, which give some insight. But none have an accepted answer, so I was hoping to get one here. The replies in these questions indicate that the answer to my question is 'no,'
esc_attr() is not needed in my particular case.
- Question 1 - The reply here simply says one doesn't need to
esc_html()on hard coded URLs.
- Question 2 - The reply here indicates I need to
esc_html(), "...anytime you are not 100% sure that what you want to output is a valid HTML for that context."
- Question 3 - This says, "don't bother to escape static strings, it's pointless."