0

esc_url, esc_attr & esc_html are used to escape content that is untrusted so that potentially malicious code isn't executed. Can wp_strip_all_tags be used as an alternative? If not, why?

1
  • No, escaping HTML output is not same as stripping/removing/sanitizing HTML from output. Consider e.g. if you need to display HTML code in your blog.
    – birgire
    Jul 28, 2021 at 11:43

1 Answer 1

1

Not necessarily. They do different things. wp_strip_all_tags() strips HTML tags from a given string, but that's not the only reason you escape things. esc_attr(), for example, ensures that " characters are escaped so that a value doesn't break HTML attributes.

For example, if I have a variable whose value is the string my-"class, and I want to put it into an HTML attribute:

$my_class = 'my-"class';
echo '<div class="' . $my_class . '"></div>';

The resulting HTML will be:

<div class="my-"class"></div>

Which is invalid HTML, because the " in my value has closed the HTML attribute. wp_strip_all_tags() will not help you here.

2
  • Thanks. When should wp_strip_all_tags() be used?
    – Ryan
    Jul 28, 2021 at 9:02
  • When you want to strip tags from a string? I don't know really. I've never needed to use it. It might make more sense using it for sanitisation, so that tags are removed from a value on saving it, rather than on display, since this would communicate to the user that HTML tags are not allowed, while escaping just causes them to be displayed as plain text. Jul 28, 2021 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.