how does esc_html__ (the 2nd one) protect the $message variable from being hacked ? what's the point to use this protection here (the second one with a plain text)?


function unknown(){

    /* If the user input any text, escape it. */
    if ( !empty ( $_POST['unknown'] ) )
        $message = esc_html ( $_POST['unknown'] );

    /* If no text was input, use a default, translated message. */
        $message = esc_html__( 'No message input by the user.', 'unknown' );

    return $message;



2 Answers 2


It really doesn't do much in that scenario. If you're going to leave that message as a string constant instead of something that is system or user generated, you're fine using one of the other translation functions: __() or _x(). esc_html__() is a little overkill for that particular line of code.


The main reason for the esc_ functions is to protect your site against bad input, either intentional or accidental. You're going to want to use the appropriate function whenever you're working with any data that can be manipulated by a user or is not explicitly set by you.

If you have any questions about WP functions in the future my recommendation would be to check the source. Either do a search in a WP install to find the function, or click the link at the bottom of the codex page that links to the source file.

  • thanks, so it is useless here? i found it in a book, but i guess the "esc_" function is to be used when a "user" is writing something, right? or is it because a "hacker" can intercept the communication between the code and the file with all the translations...? i don't really know about this...
    – Paul
    Mar 19, 2012 at 21:10
  • Updated my answer to be a bit more helpful.
    – DM.
    Mar 20, 2012 at 0:59

One major principle of preventing security holes is "Escape late." That means that, ideally, esc_html() or esc_attr() should be used right when you echo or return the final HTML, not before. So, that's one thing that the example you gave gets wrong.

As for the purpose of esc_html__(), as I understand it, is to prevent weird characters from translated strings (not the original ones you see in the code) from messing up textareas and such.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.