I see a lot of these in premium themes/plugins.
#1 - Why would you escape this? It's your own data. For consistency?
function prefix_a() {
$class_attr = 'a b c';
// Some more code.
return '<div class="' . esc_attr( $class_attr ) . '">Content</div>';
}
// Called somewhere.
prefix_a();
#2 - Again, why? The data doesn't come from the DB.
function prefix_b( $class ) {
// Some code.
return '<div class="' . esc_attr( $class ) . '">Content</div>';
}
// Called by a developer from the team.
prefix_b( 'developer adds a class' );
Yes, a child theme developer might call the function above, but he/she is already in control.
#3 - Why? If someone can add filters, it can do a lot more.
function prefix_c() {
$class_attr = apply_filters( 'prefix_c', 'foo bar' );
// Some code.
return '<div class="' . esc_attr( $class_attr ) . '">Content</div>';
}
// Called somewhere.
prefix_c();
I can only think about consistency and to be safe if someone uses untrusted data (excluding the #1 case).
$class_attr
or$class
variable) - the// Some more code.
or// Some code.
may have modified the variable/value by the timeesc_attr()
is called, particularly if filters are applied on that value, hence the value should be escaped, not just for security reasons, but also to ensure the HTML is valid. If the value actually remains unmodified from start to end, then you may assume it's for consistency and/or just to be better safe than sorry.. ✌