Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP which is 200+ options long, but is stored - in its entirety - simply as $ctry_code_sel. Of course, I get the sentiment that "Everything is Suspect", and I get using wordpress's native esc_url and esc_attr_e etc. in response, but it seems that esc_html_e et.al. are of no use in cases such as this.

When the time comes - on any given page - that I want to output my select field (e.g echo $ctry_code_sel;) is there something I can/should be doing there to guard against cross-site-scripting attack etc.?


As long as you do not allow anyone to edit/add new countries to your list I don't see any problems. The content of $ctry_code_sel is only controlled/modified by you.

If, on the other hand, you allow users to modify any data you use to generate the select, you should use escaping methods directly during generation, not after the HTML for the select is finished.

And as you are using a country list, maybe this could also be helpful for you: https://github.com/umpirsky/country-list/

  • Thanks, that was my take but it's nice to get a little validation. As for the country list... wish I had known about it months ago when I was working it out on my own -- flags and all. One really nice feature there is the language options, however -- narrow minded as it might be -- my plugin is intended for the English Speaking U.S. market exclusively, so I probably won't trouble to re-envision it. – WallabyKid Mar 18 '13 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.