1

I've been trying to submit a plugin for review and I keep having problems with the echo line. The last version I sent was like this.

<option value="">
    <?php _e( '- Default', MF_TEXT_DOMAIN ); ?>
</option>
<?php foreach ( $folders as $folder ) {
    $folder = trim( $folder );
    $folder = esc_attr( $folder );
    echo "<option value=\"{$folder}\">{$folder}</option>";
} ?>

And the WordPress response was:

This is not escaped:

echo "<option value=\"{$folder}\">{$folder}</option>";

$folder MUST be escaped when it's echo'd.

Now I'm ready to submit the code for review again but first I want to make sure I'm correct.

Here the new code

<option value="">
    <?php _e( '- Default', MF_TEXT_DOMAIN ); ?>
</option>
<?php foreach ( $folders as $folder ) {
    $folder = trim( $folder );
    echo '<option value="' . esc_attr( $folder ) . '">' . esc_attr( $folder ) . '</option>';
} ?>

I'd be very grateful if someone could help, as I'm a bit confused about the (escaped).

2
  • They might not have flagged this as it isn't a security issue, but _e( '- Default', MF_TEXT_DOMAIN ); is not valid. You cannot use variables (or constants or functions) in place of a text domain - you can only use a string.
    – vancoder
    Apr 26, 2022 at 16:03
  • @vancoder - Oh... I didn't know that, thanks for noticing... although I haven't been told anything about it.
    – choseɳ
    Apr 26, 2022 at 16:32

1 Answer 1

3

In fact to be super pedantic, I think the correct code is actually:

echo '<option value="' . esc_attr( $folder ) . '">' . esc_html( $folder ) . '</option>';

Since the first variable is an attribute, and the second is encased in html, although I wold bet that the code you have would pass review, and is certainly fit for purpose.

1
  • Excellent, thank you very much for your answer.
    – choseɳ
    Apr 26, 2022 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.