Code from functions.php

function university_files()
   wp_localize_script('main-university-js', 'universityData', array(
        'root-url' => get_site_url()

add_action('wp_enqueue_scripts', 'university_files');

Code from JS

getResults() {
      universityData.root_url +
        "/wp-json/wp/v2/posts?search=" +
      (posts) => {
        <h2 class ="search-overlay__section-title">General Information</h2>
              ? `<ul class="link-list min-list">`
              : `No General Information Marched your search`
                (item) =>
                  `<li><a href="${item.link}">${item.title.rendered}</a></li>`
          ${posts.length ? `</ul>` : ""}
        this.isSpinnerVisible = false;

Image from inspect element where the error can be seen

  • you shouldn't build your HTML out of strings in javascript, it's insecure. jQuery already provides methods of doing it by building nodes. Don't do this: jQuery( '<a href="' + url '">test</a>') it's dangerous, you should do jQuery( 'a', { href: url, text: 'test' } ) instead it's safer and avoids a lot of exploits and attacks
    – Tom J Nowell
    Aug 7, 2022 at 18:52
  • This is new. I just started using jquery. Before I was relaying on plain js Aug 10, 2022 at 15:18
  • it's the same problem if you try and do it with plain JS by joining together HTML strings, build your DOM nodes and append them rather than passing it a big HTML string and it'll be much harder to hack you. The browser will do a tonne of security stuff for you, like checking the URL is a valid URL and formatting everything properly for free
    – Tom J Nowell
    Aug 11, 2022 at 9:09

1 Answer 1


Because you have:


But you localised:

'root-url' => get_site_url()

root_url != root-url

  • Thanks Tom. I really hate that after 3 years in wordpress and coding, I am still making syntax mistakes Aug 10, 2022 at 15:16
  • happens to the best of us :) I once spent 2 days stuggling because I'd use {} instead of [] on a useState call
    – Tom J Nowell
    Aug 11, 2022 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.