Skip to main content
Share Your Experience: Take the 2024 Developer Survey
48 votes

What’s the difference between esc_html, esc_attr, esc_html_e, and so on?

esc_html() escapes a string so that it is not parsed as HTML. Characters like < are converted to &lt;, for example. This will look the same to the reader, but it means that if the value being ...
Jacob Peattie's user avatar
24 votes
Accepted

Sanitize and data validation with apply_filters() function

There's some confusion here, because not all of these are validation, there are 2 others that are necessary to understand what's appropriate: validation sanitisation escaping Sanitisation ...
Tom J Nowell's user avatar
  • 59.4k
14 votes

How to escape html code with html allowed

You are looking for wp_kses(). https://developer.wordpress.org/reference/functions/wp_kses/ There are more helper functions like wp_kses_post() and wp_kses_data()
Jory Hogeveen's user avatar
11 votes
Accepted

Which WP functions do you need to use esc_html() or esc_url() on?

Any that return data. If a function outputs internally, then it's taken responsibility for escaping if a function returns the data for use, it will be unescaped to avoid double escaping, it's your ...
Tom J Nowell's user avatar
  • 59.4k
11 votes
Accepted

Translate a Constant while appeasing WordPress PHPCS

You cannot use constants or anything other than actual strings with translation functions. This is because the code that reads your code, and produces the translatable strings does not actually run ...
Otto's user avatar
  • 32.6k
10 votes

Best Practice for PHP

That's question is only relevant, because WordPress use a mix from a coding language and layout language. If you would use a template language, syntax, than is this topic not relevant. But to your ...
bueltge's user avatar
  • 17.1k
10 votes
Accepted

how to escape wp_oembed_get for phpcs

Note that the WPCS standards for PHPCS are not "official". I am one of the maintainers, and all that we can do is to do our best to match the standards that WordPress suggests. In this case, I'm ...
J.D.'s user avatar
  • 3,915
10 votes
Accepted

What is the difference between esc_html filter vs attribute_escape filter?

It would appear that out of the box, there isn't a difference function esc_html( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );...
Tom J Nowell's user avatar
  • 59.4k
10 votes

What’s the difference between esc_html, esc_attr, esc_html_e, and so on?

esc_html would be used inside of html for example between a <p> tag <p><?php echo esc_html( $some_variable ); ?></p> esc_attr would be used for escaping attribute values on ...
jrmd's user avatar
  • 321
8 votes
Accepted

PHP Coding Standards, Widgets and Sanitization

These arguments contain arbitrary HTML and cannot be properly escaped. This is essentially a limitation on how Widgets code was designed and you can see in core Widget classes that no escaping is done ...
Rarst's user avatar
  • 99.6k
8 votes

Best Practice for PHP

Just as additional information. WordPress has handbooks for PHP & HTML on best practice regarding coding standards, also for CSS, JavaScript and Accessibility. You might find them helpful for ...
Nicolai Grossherr's user avatar
8 votes
Accepted

How to print translation supported text with HTML URL

Since esc_html_e will escape HTML link (hence will show the HTML anchor as plain text), you'll need to segment the text and escape the non-HTML part with esc_html_e or esc_html__, and print the HTML ...
Fayaz's user avatar
  • 8,917
8 votes
Accepted

When do I need to use esc_html()?

While this is probably a duplicate of What’s the difference between esc_html, esc_attr, esc_html_e, and so on? I'm going to go ahead and provide an answer anyway, since as @cag8f indicated, there's ...
butlerblog's user avatar
  • 4,996
7 votes
Accepted

esc_attr / esc_html / esc_url in echos

Yes! You should always be escaping Escape Late, Escape Often Escaping is about intent, if you intend to output a URL, use esc_url, and it will definately be a URL ( if the data is malicious it will ...
Tom J Nowell's user avatar
  • 59.4k
6 votes

Escaping / encoding data before insert into a database?

You escape on output, what I suspect here is a confusion between escaping sanitizing and validating Sanitise and clean when data arrives. This strips out stuff that shouldn't be there, e.g. upper ...
Tom J Nowell's user avatar
  • 59.4k
5 votes

Best Practice for PHP

As explained in above answer, the first method is designer friendly & second method maybe suitable in cases of plugins and complex php codes where the number of html tags are only few. But most ...
Anwer AR's user avatar
  • 1,007
5 votes

PHP Coding Standards, Widgets and Sanitization

This is a problem with overly strict coding standards, not with how you should write wordpress code. In this context both parameters are assumed to be valid HTML (they are defined in sidebar ...
Mark Kaplun's user avatar
  • 23.4k
5 votes
Accepted

Sanitizing, Validating and Escaping in WordPress (Plugin)

Now I have familiarized myself with the above principles via the documentation and I think I have understood them now I don't know which documentation you read, but you should check the Plugin ...
Sally CJ's user avatar
  • 39.3k
4 votes
Accepted

Using esc_url() on a url more than once

It's okay to use it more than once, but not encouraged. However, in your first example, you're saving the URL to the database. When you do that, or when using the URL in the wp_remote_* context, or a ...
kovshenin's user avatar
  • 2,583
4 votes

Updating a post without escaping ampersands?

That is correct, the updating in the Admin section does not change the & to &amp; while the wp_update_post() function (which can be found under /wp-includes/post.php on line 3772) does but ...
Bassel Banbouk's user avatar
4 votes
Accepted

esc before saving or before displaying does it matter?

Yes it does. Escaping depends on context and in worst case like using esc_html when writing directly to the DB are just a security hole. Even if there is no security issue, there is theoretical one. ...
Mark Kaplun's user avatar
  • 23.4k
4 votes
Accepted

How do I escape a table name or column name in SQL? esc_sql doesn't do this

I can't find a function shipped with WordPress that does this, so I created my own: function esc_sql_name( $name ) { return str_replace( "`", "``", $name ); } You can use it like this: $...
Flimm's user avatar
  • 683
4 votes
Accepted

When outputting a static string to the page, is it necessary to escape the output?

The _e() function displays a translated string; so 1) You're actually echoing a dynamic text; and 2) Yes, you should escape a translated string. Relevant excerpt taken from the internationalization ...
Sally CJ's user avatar
  • 39.3k
3 votes
Accepted

Unexpected esc_html and esc_attr behaviour

Use get_search_query or the_search_query to return/output the search term as a properly escaped value, don't access $_GET directly. You're trying to escape something that's already URLencoded.
Milo's user avatar
  • 78.5k
3 votes
Accepted

Quotes being escaped inside wp_editor when saved with wp_kses_post

Wordpress always escapes quotes encountered in the super globals variables. It is done in https://developer.wordpress.org/reference/functions/wp_magic_quotes/ You will most likely want to strip it ...
Mark Kaplun's user avatar
  • 23.4k
3 votes

Escaping and sanitizing SVGs in metabox textarea

Here is a PHP library that was created for sanitizing SVG files that may be worth looking into. https://github.com/darylldoyle/svg-sanitizer Here is an example of how this could be used: // Now do ...
Marc's user avatar
  • 721
3 votes

Which WP functions do you need to use esc_html() or esc_url() on?

Any output of untrusted data (including data from database) must be sanitized. WordPress Codex describes available functions: https://codex.wordpress.org/Data_Validation Code sniffers, following ...
KAGG Design's user avatar
  • 1,842
3 votes
Accepted

wp_query not searching with apostrophe

Try using sanitize_text_field instead of esc_html wp> $search_query = "Dalton's Law <br/>"; string(18) "Dalton's Law <br/>" wp> $query = apply_filters( 'get_search_query', $...
phatskat's user avatar
  • 3,144
3 votes
Accepted

Should messages in WP_Error already be html escaped?

No, escaping should happen at the moment of output ( late escaping ) so that we know that it only occurs once. Double escaping can allow specially crafted output to break out. By escaping, we're ...
Tom J Nowell's user avatar
  • 59.4k
3 votes
Accepted

How to allow &nbsp with wp_kses()?

not sure the difference but I used &nbsp for adding a white space ..then passed it through wp_kses() The correct HTML entity for a non-breaking space is &nbsp; — note the ; which is ...
Sally CJ's user avatar
  • 39.3k

Only top scored, non community-wiki answers of a minimum length are eligible