1

Is it really need to escape translatable strings?

enter image description here

1 Answer 1

3

Is it really need to escape translatable strings?

Yes. If a string is translatable then that means its value can be changed from an external source. This means it's not safe.

and how shall i do that?

See the documentation on how to escape with WordPress.

When it comes to translatable strings, there are two main functions to use: esc_html__(), esc_attr__(), esc_html_e(), and esc_attr_e(). These functions are essentially just esc_html() and esc_attr() combined with the __() or _e() translation functions.

The thing you need to be aware of is that escaping should happen as late as possible. Ideally the last thing that happens before output. In your screenshot you appear to be just defining strings for later use. In that case you wouldn't use esc_html__() at this point. Instead you'd just use __() and then use esc_html() whenever you actually output the string.

Here's a couple of good resources on the topic:

3
  • Thank you , so that means if i am doing echo __('Error : The post type is not WooCommerce Product','pgggo'); it should be echo esc_html__('Error : The post type is not WooCommerce Product','pgggo');
    – user145078
    May 25, 2019 at 10:02
  • 1
    Right. Or just use esc_html_e(), which also echoes. May 25, 2019 at 10:10
  • Perfect. thanks
    – user145078
    May 25, 2019 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.