Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [escaping]

The tag has no usage guidance.

4
votes
2answers
198 views

What’s the difference between esc_html, esc_attr, esc_html_e, and so on?

I got feedback from security guy and he pointed out that I should use proper escaping of user input in my code. So I've done some research and found escaping functions. What’s the difference between ...
0
votes
1answer
27 views

How to safely return the HTML?

I have return '<button type="button" class="btn btn-success">Open Now</button>'; If I echo this it will work fine. I am getting an warning like echo is used without escaping. I know ...
1
vote
1answer
46 views

meta_query works locally but not on live server

I'm filtering posts by author's last name initials. On my local server, the query runs beautifully, but when I push live, it doesn't. It doesn't find anything. Does it have anything to do with the way ...
7
votes
1answer
233 views

Sanitize and data validation with apply_filters() function

Should we sanitize and validate the apply_filters() like the examples below? absint( apply_filters( 'slug_excerpt_length', 35 ) ); wp_kses_post( apply_filters( 'slug_excerpt_more', '&hellip;' ) );...
1
vote
0answers
63 views

Must I serialize/sanitize/escape array data before using set_transient?

Everything is in the question. For a notices system to show warnings/errors in the admin, I´m using transient. When I published my first plugin, I received an email to ask me to sanitize/validate/...
0
votes
1answer
102 views

Translate a Constant while appeasing WordPress PHPCS

The following works but isn't up to snuff with PHP Code Sniffer WordPress coding standards <?php esc_html_e( ADDRESS, 'wprig' ); ?> Linter yells at me with: [WordPress.WP.I18n....
1
vote
1answer
224 views

I am not understandinhg $wpdb->prepare correctly

I have a query that runs fine in raw PHP but I cannot run using $wpdb. I seem to be missing something in the advice provided at How do you properly prepare a %LIKE% SQL statement? My code is global $...
0
votes
0answers
20 views

Escaping a WPDB Object in One Shot

I know array mapping works for escaping a bunch of values in an array, making them safe for output in HTML. But is there a way to do the same thing with an object? If not, I guess the object could ...
-1
votes
1answer
157 views

Escaping and Special Characters (e.g. &)

I know it's best practise to escape all output. However I run into issues when people use special characters in their content. e.g. &, –, etc. Note I'm using Timber, so for example if a post ...
0
votes
1answer
13 views

Escape post image attachments added to template

What is the secure way to use wp_get_attachment_image() in a template?
0
votes
2answers
647 views

Escaping / encoding data before insert into a database?

Is the correct strategy to never escape data before it's put into a database. I feel like I've seen that referenced before but I couldn't find it now and this didn't clear it up for me: https://...
1
vote
1answer
501 views

wp_query not searching with apostrophe

I'm trying to search WP_Query for the data containing the phrase "Dalton's Law" in meta_query. This is an AJAX search, and here's what I"m doing: //in this case $_POST['query'] is the phrase "Dalton'...
8
votes
2answers
498 views

Which WP functions do you need to use esc_html() or esc_url() on?

I've come across situations where people have used either esc_html() or esc_url() with certain WP functions such as home_url('/'). An example being in the opening anchor tag of <a> link back to ...
1
vote
1answer
44 views

Do I need to use the esc_html() function on hard coded links?

I understand when using certain WP functions like site_url(); you should escape these with the esc_html(); function in the following manner: <?php esc_html(site_url()) ?> My question is, if I ...
0
votes
1answer
49 views

How to escape multiple attribute at once in WordPress?

I'm developing a WordPress theme and trying to escaping group of attribute at once that store with a variable. <?php $attributes = array(); $classes = array( 'header-section' ); if ( true == ...
0
votes
0answers
99 views

problem with esc_attr( ob_get_clean() )

I am using wordpress resume manager plugin and there under repeated field the code is: <a href="#" class="resume-manager-add-row" data-row="<?php ob_start(); ?> <div ...
0
votes
1answer
1k views

HTML escaping data with ajax requests

I follow the WP philosophy of late escaping, but I'm not sure when to escape HTML special characters when working with ajax requests. Note, as of my understanding, when setting data to an element ...
0
votes
1answer
919 views

How do I escape a table name or column name in SQL? esc_sql doesn't do this

If you want to escape string values in an SQL query, you can use WordPress's esc_sql function: <?php $wpdb->get_var( "SELECT * FROM something WHERE foo = '" . esc_sql( $foo ) . "'" ); You can ...
0
votes
1answer
74 views

Correct form of escaping and localization - functions.php breadcrumbs

I got this code for generating a WordPress breadcrumb online and want to make sure it's safe to use in a theme <?php //// BREADCRUMB START //// function the_breadcrumb() { $showOnHome = ...
0
votes
0answers
20 views

Is there any way to find non escaped data in theme?

I am getting soft rejection from themeforest several times for same theme.I have sanitize all data.But may be missing some places,I have checked through out my theme, but could not find.Is there any ...
1
vote
1answer
219 views

Should I always prefer esc_attr_e & esc_html_e instead of _e?

I am working to internationalize my plugin. As I can see on Wordpress site about esacaping, it says you should always use it. But as I can see in many popular plugins, they have used _e instead apart ...
2
votes
1answer
94 views

Prevent escaping javascript in visual editor

I tried to put my JavaScript code directly to my blog content, but It seems WordPress escapes [ ] chars. Input: <p>Some content blah blah</p> <script> var locations = [{ lat: ...
0
votes
0answers
167 views

Escaping a Single Quote in str_replace for Nav Function

I'm trying to modify a nav walker so that it displays the menu item's description. I'm basing my solution off of https://themefoundation.com/menu-item-descriptions/, and have provided the function ...
1
vote
1answer
3k views

Base64 & JSON Encode array in PHP, use as HTML data attribute, decode and parse in JavaScript … with proper Escaping

I'm looking to pass an arbitrary array from PHP to JavaScript while properly escaping. I'm leaning on using base64 and I imagine that base64 isn't data attribute safe, so as a good developer I am ...
8
votes
1answer
418 views

What is the difference between esc_html filter vs attribute_escape filter?

What is the exact difference between esc_html and attribute_escape filter? esc_html() uses esc_html filter and esc_attr() uses attribute_escape filter. Both encodes < > & " ' (less than, ...
4
votes
3answers
2k views

How to print translation supported text with HTML URL

I am somewhat new in WordPress if it is about "deeper" customization. Now I am having this function: esc_html_e( 'Dear Guest, with Your information we not find any room at the moment. Please contact ...
6
votes
2answers
1k views

esc_attr / esc_html / esc_url in echos

Hi I am trying to understand when and why I should use these esc-alternatives and so far I think I understand that it is needed to secure that input is not containing wrong characters and in that ...
11
votes
5answers
1k views

Best Practice for PHP

When doing a template such as single.php and you have php wrapped in html, is it best to : Start + Stop PHP? for example <h1 class="post-tilte"><?php the_title(); ?></h1> <p ...
2
votes
1answer
445 views

Escape hexadecimals/rgba values

I know that sanitize_hex_color exists for sanitizing hexadecimal values going into the database (and only exists in the Customizer), but what's the best function to escape those same values. Should I ...
5
votes
0answers
106 views

Escaping and sanitizing SVGs in metabox textarea

I want to include inline SVGs in a metabox textarea. That's easy. What's killing me is how do I sanitize the textarea before saving the postmeta, and how do I escape it? Halp? Thanks!
1
vote
1answer
116 views

WordPress stripping away backslashes from HTML

Hi I'm kind of new to WordPress. I have come across this issue lately when running my webpages from my WordPress server. I have this piece of code that clears any white spaces in the text input field....
0
votes
1answer
27 views

product description text displays above website when in shop page [closed]

Product description text appears above and outside of website. It is seen when in the shop page. When I look at the site from my smart phone, and also while visiting site from the back office. http://...
1
vote
1answer
63 views

Does balanceTags() provide any escaping / protection?

I'm just getting into WordPress and keep seeing sample code with balanceTags() used when echoing out a variable. Am I right in thinking it does nothing in terms of output validation? Thank you
0
votes
1answer
201 views

wp_kses allow checkbox class and checked

I'm having a hard time getting wp_kses to allow the class for an input. These approaches didn't work: input' => array( 'type' => true, 'class' => true, 'name' => true, '...
0
votes
1answer
498 views

Updating post data on save (save_post vs wp_insert_post_data)

I am trying to modify post data on post save action. Firstly I tried to use save_post hook like that function post_save_action($post_id, $post, $update) { if ($this->...
1
vote
2answers
630 views

PHP Coding Standards, Widgets and Sanitization

I have an issue with custom widgets and WordPress Coding Standards. When you create a custom widget, your class should have a "widget" method that will display the widget. Something like: <?php ...
0
votes
3answers
161 views

Using esc_url() on a url more than once

If I have a front-end post form where a user enters a url, is it OK and recommended to use esc_url() twice - once for cleaning the input before using update_post_meta for database storage, and again ...
1
vote
2answers
1k views

Quotes being escaped inside wp_editor when saved with wp_kses_post

Hi have a setting screen where I allow users to create HTML emails with the convenience of the editor they are already used to from posts and pages using wp_editor(); Everything seems to work fine ...
2
votes
4answers
3k views

How to escape html code with html allowed

i am a little confused how to use escape function on a variable having html code in it. i have tried this https://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data but i could not ...
4
votes
1answer
262 views

how to escape wp_oembed_get for phpcs

I am using phpcs to help with making sure I write nice, valid WP theme code but am coming across the following issue regarding escaping before output. If I try to use echo wp_oembed_get( 'https://www....
0
votes
0answers
69 views

Shortcode not being converted correctly

Can someone tell me why this shortcode doesn't get rendered in the browser as expected: //Create Shortcodes function gafw_disable_adsense( $atts ){ return '<!--noadsense-->'; } ...
1
vote
1answer
53 views

What is the safe way to print tracking code / pixel code before </head> tag or </body> tag

What is the safe way to print tracking code / pixel code before </head> tag or </body> tag from theme options. In header.php I printed the following code before the </head> tag if (...
0
votes
1answer
253 views

Escaping html for meta description

I am using this code to add to my posts a meta description from a custom field. $des = get_post_meta( get_the_id(), 'fl_description', true); if( ! empty( $des ) ){ $meta_des = esc_html($des); ...
0
votes
1answer
339 views

Render the metabox input values as HTML

I'm new to PHP and WordPress. I've created a site on WordPress, where the user can add an HTML code snippet (the inputs are taken using a metabox and displayed). The problem is WordPress doesn't ...
1
vote
0answers
52 views

How to escape attachment image caption text?

I'm outputting an attachment image's caption but feel I should escape the output: <figcaption> <?php echo get_post( get_post_thumbnail_id() )->post_excerpt; ?> </figcaption> ...
0
votes
1answer
616 views

How to make MySQL search queries with quotes

Hi everybody I run a wordpress based website and I'd like to store the search queries called by users to use them as analytics data to know what's most searched etc... So I have a custom table where ...
2
votes
2answers
439 views

How Flexible are the WordPress Coding Standards for PHPCS?

In my WordPress workflow I use Gulp and have a task that runs my PHP files through PHPCS using the WordPress coding standards tests (https://github.com/WordPress-Coding-Standards/WordPress-Coding-...
4
votes
2answers
173 views

esc before saving or before displaying does it matter?

In a lot of how to create a custom meta box tutorials, when saving data, i.e., update_post_meta the data is escaped: update_post_meta( $post_id, 'city', esc_attr( ucwords( $_POST['city'] ) ) ); ...
0
votes
0answers
54 views

Escaping and sanitization

I have created a custom metabox for a certain plugin - events CPT. In it I can add talks by event days, with images, speaker names, descriptions, titles and times. So all either input fields or ...
0
votes
1answer
134 views

Unexpected esc_html and esc_attr behaviour

On my site's search results page I am outputting the search term as follows: <?php echo esc_html($_GET['s']); ?> For the search term "SEARCH-TERM" (including the quotes) I would expect this to ...