Question is in the title, thanks in advance (:

  • 1
    it depends if you want to produce HTML, JSON or other format. – Kaperto Jan 3 at 13:49

Yes, you do. Even if you have sanitised the value when saving it, you should always escape on output.

<a href="<?php echo esc_url( get_theme_mod( 'url' ) ); ?>">

If you're outputting a mailto: link to an email address, you also need to escape this with esc_url(), just make sure that the mailto: part is included in the escaped value, so that it's a valid URL:

<a href="<?php echo esc_url( 'mailto:' . get_theme_mod( 'mail' ) ); ?>">
| improve this answer | |
  • Thank you. What kind of escape should I use (if any) when I use get_theme_mod to input text inside p or h1 tag for example? Eg: <p> <?php echo get_theme_mod( 'text' ); ?> </p> – Arttyor Jan 16 at 15:53
  • Use esc_html() – Jacob Peattie Jan 16 at 23:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.