0

If I register a post type then which escaping should I use for escaping label?

function book_setup_post_type() {
    $args = array(
        'public'    => true,
        'label'     => __( 'Books', 'textdomain' ),
        'menu_icon' => 'dashicons-book',
    );
    register_post_type( 'book', $args );
}
add_action( 'init', 'book_setup_post_type' );
1
  • For securing output you should just do alright with esc_html() and if it's gonna be translation ready you would be better off using esc_html_e() or esc_html__(). For your ref: developer.wordpress.org/themes/theme-security/…
    – Kumar
    Commented Feb 24, 2020 at 12:23

1 Answer 1

1

None. Escaping should happen late, on output. This is just registering the strings for later use, so it's too early to escape. All the places in WordPress where the post type label is used automatically, WordPress should already be escaping it.

If you're outputting any of the labels yourself, you would probably use esc_html():

$post_type_object = get_post_type_object( 'book' );
$post_type_labels = get_post_type_labels( $post_type_object );

echo esc_html( $post_type_labels->singular_name );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.