0

I am using a class that handles the output of WP settings fields. This class uses the function "add_settings_field" which receives as a "callback" parameter the name of the function that prints the html of the field.
add_settings_field( $args["name"], $args["label"], $args["callback"], $args["menu_slug"], $args["section"], $args );

If I escape the html, instead of the fields the html is printed as a string (see screenshot).

public function callback_text( $args ) {
        $value       = $this->get_option( $args['id'], $args['option'], $args['std'] );
        $size        = isset( $args['size'] ) && !is_null( $args['size'] ) ? $args['size'] : 'regular';
        $type        = isset( $args['type'] ) ? $args['type'] : 'text';
        $placeholder = empty( $args['placeholder'] ) ? '' : ' placeholder="' . $args['placeholder'] . '"';
        $required = $args["required"] ? 'required' : '';

        $html        = sprintf(
            '<input type="%1$s" class="%2$s-text" id="%4$s" name="%3$s" value="%5$s"%6$s %7$s/>',
            esc_attr( $type ),
            esc_attr( $size ),
            esc_attr( $args['name'] ),
            esc_attr( $args['id'] ),
            esc_attr( $value ),
            $placeholder,
            esc_attr( $required )
        );
        $html       .= $this->get_field_description( $args );

        echo esc_html( $html );
    }

esc_html return string

How can I escape the html correctly?
Should I escape the html for the settings field in this case?

Thanks, Giulia

1 Answer 1

0

You don’t need to escape HTML you wrote. You wrote it and it’s hard-coded a certain way so there’s no way for it to be replaced by malicious or broken code. You only need to escape the external values that are being inserted into the attributes and you’ve done that.

Also, note that the purpose of esc_html() is to escape a value so that it is not treated as HTML.

3
  • Thanks Jacob that was what I thought but I wasn't sure. Commented Jul 15, 2022 at 14:15
  • 1
    @GiuliaRabita-Metup Jacob is right, but I still wanted to jump in to commend you for being thorough with escaping! Good way to start your WordPress journey on WPSE!
    – kraftner
    Commented Jul 15, 2022 at 14:34
  • I note that some plugin reviewers want you to escape everything, including hard-coded html, or a variable that contains hard-coded html. (Having that issue right now with a new plugin I am trying to get through review.) Commented Feb 10, 2023 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.