18

I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development like:

esc_html ( the_title () )

Edit: as pointed out in the answers below the above code is wrong regardless - the code should have read esc_html ( get_the_title () )

2
  • No, those functions are already sanitized, so its not required to do so. Except in the case of the_content which outputs HTML from the TinyMCE editor, in which you input. This is more so reserved for form inputs or data created on the front end for example by your users.
    – Adam
    May 18 '12 at 16:40
  • Those functions are not already sanitized and it is necessary to escape them unless post content is fully trusted and you want to allow HTML markup to be embedded. See developer.wordpress.org/reference/functions/the_title/…
    – lehiester
    Jul 10 at 15:24
16

Escaping depends entirely on the context in which you are using the functions. What is safe for displaying inside <h1> tags, is not necessarily safe to display for the value attribute of an input field, and even that wouldn't necessarily be safe as a href attribute value....

In short - perform the sanitisation yourself as you output it. Though in the case of the_title () or get_the_title (), esc_html is not necessary, since WordPress applies the following functions:

Note: the_title prints the title - so esc_html ( the_title () ) won't work. Similarly, the_content prints the content (in any case, you'd expect the content to display HTML).

4
  • oops silly me ... yes of course esc_html( the_title()) won't work. Thanks for your answer. May 18 '12 at 16:40
  • 4
    Related: to output Post Title in an HTML attribute, use the_title_attribute() May 18 '12 at 16:46
  • Misleading as currently written--sanitization is necessary e.g. for the_title/get_the_title if you don't want HTML markup to be embedded in post titles and/or the contents of post titles might not be fully trusted. From the documentation for the_title: "Like the_content(), the output of the_title() is unescaped. ... For this reason, do not write code that allows untrusted users to create post titles."
    – lehiester
    Jul 10 at 15:19
  • That is simply not true. the_title is not sanitised, nor escaped, and it echoes its content. Same with the_content, get_the_title and get_the_content. They all get raw DB values and echo/pass it to an echo function without further ado. Where please do you see the sanitisation and escaping applied in the_title function? Aug 20 at 7:40
7

Yes and no - depends on whether you want html in those functions to be output or not. If you escape the_content(), for example, and it contains a <div> tag, that tag would actually be output to the page as &lt;div&gt; instead.

By the way, if you do escape the output of those functions, you'll want to use their "get_" equivalents (ex. get_the_content()) as those functions echo their output directly.

1

You can simply write a function like this and hook it to the_title filter:

function my_escape_title( $title ){
    return esc_html( $title );
}
add_filter( 'the_title', 'my_escape_title' );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.