0

I see a lot of these in premium themes/plugins.

#1 - Why would you escape this? It's your own data. For consistency?

function prefix_a() {
    $class_attr = 'a b c';

    // Some more code.

    return '<div class="' . esc_attr( $class_attr ) . '">Content</div>';
}

// Called somewhere.
prefix_a();

#2 - Again, why? The data doesn't come from the DB.

function prefix_b( $class ) {
    // Some code.

    return '<div class="' . esc_attr( $class ) . '">Content</div>';
}

// Called by a developer from the team.
prefix_b( 'developer adds a class' );

Yes, a child theme developer might call the function above, but he/she is already in control.

#3 - Why? If someone can add filters, it can do a lot more.

function prefix_c() {
    $class_attr = apply_filters( 'prefix_c', 'foo bar' );

    // Some code.

    return '<div class="' . esc_attr( $class_attr ) . '">Content</div>';
}

// Called somewhere.
prefix_c();

I can only think about consistency and to be safe if someone uses untrusted data (excluding the #1 case).

1
  • 1
    Why? Because the values are dynamic (coming from the $class_attr or $class variable) - the // Some more code. or // Some code. may have modified the variable/value by the time esc_attr() is called, particularly if filters are applied on that value, hence the value should be escaped, not just for security reasons, but also to ensure the HTML is valid. If the value actually remains unmodified from start to end, then you may assume it's for consistency and/or just to be better safe than sorry.. ✌
    – Sally CJ
    Jan 19, 2022 at 4:16

2 Answers 2

1
  1. You probably wouldn't. If you did it would be to make sure it was in place already if in future you decided to make the variable dynamic or filterable.
  2. In this case I would suggest it for similar reasons to #1. You may know where $class is coming from now, but this may change in future, and it prepares the function for potential use in different contexts where $class may not be controlled.
  3. You need to escape here because you know for certain that your code has no control over what the value of $class may be, and you should make sure that your code does not break if an improper value is passed. This is not solely a security concern. As you will learn from following questions on this site, many developers who use filters do not necessarily know what they are doing. They may write code that takes a dynamic value and adds it as a class using your filter. Most of the time this might be fine, but what if they are automatically pulling something in like a post title? Eventually there may be a post title with a " character, and this will break the markup of their site if you do not escape the values from that filter. An experienced developer would know what the problem is and escape it themselves, but not all developers who might use your filter are quite as experienced.
0

I think the best answer is in the official doc: https://developer.wordpress.org/plugins/security/securing-output/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.