In WordPress they recommend that I should escape any part of the code of my plugin that shows data to the user, I have made most of the corrections but this specific case I don't know how to escape that echo. Please help.

<option value="">
    <?php _e( '- Default', MF_TEXT_DOMAIN ); ?>
<?php foreach ( $folders as $folder ) {
    $folder = trim( $folder );
    echo "<option value=\"{$folder}\">{$folder}</option>";
} ?>

1 Answer 1


Escaping is only necessary when you have no full control of the the thing you are echoing. So as long as $folder is a variable that you have defined yourself, there's no real need to escape. But if there is user input involved, there is esc_html, to be used as follows:

echo esc_html ("this input string contains a > character");

In this case, however, more drastic measures may be needed, because there can be no html tags at all inside option tags, so you add wp_strip_all_tags like this:

$folder = wp_strip_all_tags ($folder);
echo esc_html ("<option value=\"{$folder}\">{$folder}</option>");

UPDATE (thanks to Kero in the comments for noticing the error)

$folder = esc_html (wp_strip_all_tags ($folder));
echo "<option value=\"{$folder}\">{$folder}</option>";
  • Won't this return &lt;option value... which is invalid HTML?
    – kero
    Commented Apr 21, 2022 at 8:25
  • I understand, but WordPress requires me to always escape for security. In this case, any escape attempt that I make in that echo results in nothing being shown in the output, it does not return the value of $folder, it does not show anything. Even your answer I just tried. I don't know if I should add that this <option> is part of a <select> and that $folders comes from the database with a get_option() But without escape, as it is in my question, it works correctly
    – choseɳ
    Commented Apr 21, 2022 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.