1

I've submitted a plugin for review and it was not accepted as it needs some fixes with data sanitization and escaping.

One of the flagged examples was this line:

echo'<td>'.$date .' '.$time.'</td>';

last line of this code block

// date & time
$date_format = 'Y/m/d';
$time_format = get_option( 'time_format' );

$s = strtotime($row->created_at);

$date = date($date_format, $s);
$time = date($time_format, $s);

echo'<td>'.$date .' '.$time.'</td>';

I don't understand why $date or $time would need to be escaped since they are put through PHP functions strtotime() and date()

Thanks in advance.

1 Answer 1

2

Should you escape these?

$date_format = 'Y/m/d';
$time_format = get_option( 'time_format' );

No. That would be early escaping! Early escaping is very bad!

However, should you escape this?

echo'<td>'.$date .' '.$time.'</td>';

YES.

Escaping is not about wether it's needed or not, if you ever find yourself saying "It shouldn't be a problem because it's always a" stop yourself and escape.

Escaping is about enforcing assumptions and expectations. Why trust that it will be safe when you can escape and guarantee that it's safe?

This protects you in multiple ways, e.g. if you use esc_html you've guaranteed the string will never contain HTML, even if you make changes in the future further up, filters get added, etc, you always know that it's safe because you escaped at the moment of output.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.