So what's the difference between these, and when should we use each one? Is esc_attr() safe enough to escape any type of data you get from the user ?
-
This is very close to whats the difference between esc_* functions question. If you add this as comment there I will try to write out my answer to include functions you mention.– RarstOct 28, 2010 at 16:47
1 Answer
esc_attr() is, for the most part, an alias for a) kses (strips evil chars to prevent xss) and b) htmlspecialchars(), for use in HTML attributes. It can be used to display sanitized user input that cannot contain HTML.
If you need only to sanitize strings before storing in the db, there are multiple variants of kses available.
Also, don't miss the other esc_*() functions. There are quite a few.
The other two you mention are self-explanatory.