1

This question already has an answer here:

When outputting data prior to rendering it, what is best practice in terms of when to use esc_html()? For example, what if my PHP template contains the following code:

<?php $title = "Contact"; ?>
<h1> <?php echo $title; ?> </h1>

Would I need to wrap $title in esc_html()? If the answer is 'no,' can you give me an example of when I would need to wrap $title in esc_html()? Assume there is no user input on the page in-question.

This Codex page seems to say 'yes,' a variable should be escaped with esc_html() anytime it is enclosed in an HTML element. But this page seems to indicate 'no', a variable should be escaped with esc_html() only if there is a chance the variable could text that could be interpreted as harmful/unexpected HTML (i.e. a dynamic variable, or user inputted variable).

Previous Stack Exchange Questions

I've seen the following Stack Exchange questions, which give some insight. But none have an accepted answer, so I was hoping to get one here. The replies in these questions indicate that the answer to my question is 'no,' esc_attr() is not needed in my particular case.

  • Question 1 - The reply here simply says one doesn't need to esc_html() on hard coded URLs.
  • Question 2 - The reply here indicates I need to esc_html(), "...anytime you are not 100% sure that what you want to output is a valid HTML for that context."
  • Question 3 - This says, "don't bother to escape static strings, it's pointless."

marked as duplicate by Jacob Peattie, fuxia Feb 6 at 14:01

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • While none of the questions you indicated have an accepted answer, there are answers there. So it's just that the OPer did not bother to come back and mark one accepted. Tom's answer on the last one you indicated (and what Jacob marked as a duplicate) is a good one that tells you what you need to know - when you don't need esc_html(). – butlerblog Feb 6 at 13:02
  • The question I flagged as a duplicate was not one of the ones in the original question, which is why I flagged it. – Jacob Peattie Feb 6 at 14:01
3

While this is probably a duplicate of What’s the difference between esc_html, esc_attr, esc_html_e, and so on? I'm going to go ahead and provide an answer anyway, since as @cag8f indicated, there's not an accepted answer on that question (but I'll add that I think Tom's answer there tells you what you need to know).

You need to escape output when there's a possibility that the output might be changed somewhere or may have some "untrusted" value.

In the case of your example (repeated below),

<?php $title = "Contact"; ?>
<h1> <?php echo $title; ?> </h1>

you do not need to escape this. "Contact" is already set and is a safe value and is not changed. In fact, as written, you are wasting space (and readability) and it really should be just hard HTML.

Now, if you do something to $title, that changes things. You would need to escape the output in that case because you don't know what the value might be.

For example:

<?php $value = get_user_meta( $user_id, 'some_meta', true ); ?>
<p>My Value: <?php echo esc_html( $value ); ?></p>

This needs to be escaped because you don't actually know what the value is, and thus you don't know if it is safe to output. That's where it needs to be escaped.

It is important to also know the following:

  1. Learn which escape functions do which tasks. Using one that isn't appropriate for the data could result in not fully escaping the value, or breaking it in some other way. There are escape functions for different data types, so use the correct one.
  2. Know if the data needs to be escaped. If you're using a WP function that already escapes the data, then you're double escaping it and that can result in bad output. If you're not sure, look up the function and review the source.
  • OK understood on all. The main question for me to research now is: When can I consider a value 'safe' enough to not escape it. For example, is it safe to grab the alt text from an image, and insert it into an <img> tag, like this? $post_id = 99; $imgAlt = get_post_meta($post_id,'_wp_attachment_image_alt', true); ?> <img src="https://example.com" alt="<?php echo $imgAlt;?>" /> I guess I have to assume my WordPress users would never insert malicious code into an 'alt text' field in the WordPress media library. Does that sound like an accurate understanding? – cag8f Feb 7 at 6:43
  • To be clear, researching whether a value is 'safe' or not is something I will undertake on my own, outside of this Stack Exchange question. – cag8f Feb 7 at 6:44
  • "I guess I have to assume my WordPress users would never insert malicious code into an 'alt text' field in the WordPress media library." - Actually, the opposite is true. You should always "assume" the worst. So your comment example is a perfect example of when you should escape output. – butlerblog Feb 7 at 12:44
  • 1
    Got it. I was actually planning to follow up with, "I don't think I can/should assume that my WordPress users will always input something safe here." So my educated guess was to wrap in in esc_attr(). Thanks for confirming. – cag8f Feb 7 at 13:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.