I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development like:

esc_html ( the_title () )

Edit: as pointed out in the answers below the above code is wrong regardless - the code should have read esc_html ( get_the_title () )

| improve this question | | | | |
  • No, those functions are already sanitized, so its not required to do so. Except in the case of the_content which outputs HTML from the TinyMCE editor, in which you input. This is more so reserved for form inputs or data created on the front end for example by your users. – Adam May 18 '12 at 16:40

Escaping depends entirely on the context in which you are using the functions. What is safe for displaying inside <h1> tags, is not necessarily safe to display for the value attribute of an input field, and even that wouldn't necessarily be safe as a href attribute value....

In short - perform the sanitisation yourself as you output it. Though in the case of the_title () or get_the_title (), esc_html is not necessary, since WordPress applies the following functions:

Note: the_title prints the title - so esc_html ( the_title () ) won't work. Similarly, the_content prints the content (in any case, you'd expect the content to display HTML).

| improve this answer | | | | |
  • oops silly me ... yes of course esc_html( the_title()) won't work. Thanks for your answer. – byronyasgur May 18 '12 at 16:40
  • 4
    Related: to output Post Title in an HTML attribute, use the_title_attribute() – Chip Bennett May 18 '12 at 16:46

Yes and no - depends on whether you want html in those functions to be output or not. If you escape the_content(), for example, and it contains a <div> tag, that tag would actually be output to the page as &lt;div&gt; instead.

By the way, if you do escape the output of those functions, you'll want to use their "get_" equivalents (ex. get_the_content()) as those functions echo their output directly.

| improve this answer | | | | |

You can simply write a function like this and hook it to the_title filter:

function my_escape_title( $title ){
    return esc_html( $title );
add_filter( 'the_title', 'my_escape_title' );
| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.