When outputting data prior to rendering it, what is best practice in terms of when to use `esc_html()`? For example, what if my PHP template contains the following code: <?php $title = "Contact"; ?> <h1> <?php echo $title; ?> </h1> Would I need to wrap $title in `esc_html()`? If the answer is 'no,' can you give me an example of when I *would* need to wrap `$title` in `esc_html()`? Assume there is no user input on the page in-question. [This Codex page][1] seems to say 'yes,' a variable should be escaped with `esc_html()` *anytime it is enclosed in an HTML element*. But [this page][2] seems to indicate 'no', a variable should be escaped with `esc_html()` only if there is a chance the variable could text that could be interpreted as harmful/unexpected HTML (i.e. a dynamic variable, or user inputted variable). **Previous Stack Exchange Questions** I've seen the following Stack Exchange questions, which give some insight. But none have an accepted answer, so I was hoping to get one here. The replies in these questions indicate that the answer to my question is 'no,' `esc_attr()` is not needed in my particular case. - [Question 1][4] - The reply here simply says one doesn't need to `esc_html()` on hard coded URLs. - [Question 2][5] - The reply here indicates I need to `esc_html()`, "...anytime you are not 100% sure that what you want to output is a valid HTML for that context." - [Question 3][3] - This says, "don't bother to escape static strings, it's pointless." [1]: https://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data [2]: https://code.tutsplus.com/articles/data-sanitization-and-validation-with-wordpress--wp-25536 [3]: https://wordpress.stackexchange.com/questions/290351/which-wp-functions-do-you-need-to-use-esc-html-or-esc-url-on [4]: https://wordpress.stackexchange.com/questions/290174/do-i-need-to-use-the-esc-html-function-on-hard-coded-links [5]: https://wordpress.stackexchange.com/questions/88874/when-to-use-esc-url-esc-html-esc-attr-and-friends