I am very new to wordpress development. When I submitted my plugin for review it was rejected because "Variables and options must be escaped when echo'd". How do i escape the following 2 blocks of code?

 <label for="<?php echo $this->plugin_name . '-' . $switch['id']; ?>">


 echo "<style>img[ci-src] {opacity: 0;} img.ci-image-loaded {opacity: 1;}</style>";

1 Answer 1


According to the developers handbook, these are the functions that should be used when outputting anything:

esc_attr() // Use on everything else that’s printed into an HTML element’s attribute.
esc_html() // Use anytime an HTML element encloses a section of data being displayed.
esc_js() // Use for inline Javascript.
esc_textarea() // Use this to encode text for use inside a textarea element.
esc_url() // Use on all URLs, including those in the src and href attributes of an HTML element.
esc_url_raw() // Use when storing a URL in the database or in other cases where non-encoded URLs are needed.
wp_kses() // Use for all non-trusted HTML (post text, comment text, etc.)
wp_kses_post() // Alternative version of wp_kses() that automatically allows all HTML that is permitted in post content.
wp_kses_data() // Alternative version of wp_kses() that allows only the HTML permitted in post comments.

so in your case it would be:

<label for="<?php echo esc_attr( $this->plugin_name . '-' . $switch['id'] ); ?>">

As pointed out by @jacob-peattie in the case of the second example, escaping it is unnecessary, because no dynamic content is being rendered. But if the rejection message specifically pointed this out as something that needs to be escaped, than this is the way to do it:

 echo "<style>" . esc_html( "img[ci-src] {opacity: 0;} img.ci-image-loaded {opacity: 1;}" ) . "</style>";

Edit: I mixed up esc_html and esc_attr at first, now it's correct.

  • The second block of code does not need to be escaped, as there's nothing dynamic in it. Jan 27, 2022 at 14:39
  • I know this is probably unnecessary, but I looked at official Twenty themes and they do escape even plain text, so I'm not sure why that is, but included it anyway. Jan 27, 2022 at 14:42
  • They escape text that can be translated using functions like __ and _e because translation makes that text dynamic. Jan 27, 2022 at 14:56
  • But they use esc_html__() instead of just __(), so I thought that had to be intentional. Jan 27, 2022 at 15:00
  • esc_html__ is just a function that does esc_html() and __() at the same time. Any text inside that function is dynamic, because it can be translated. Jan 27, 2022 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.