As far as I know wp_localize_script doesn’t escape data any more than is necessary to produce valid JSON, and everything is sent as a string. The function was originally designed to allow translating the strings used in your JS into other languages (hence the “localize” part of the function name). So if the data you’re passing is coming from a user input or is otherwise user-generated then you’ll definitely want to escape it.
Related Posts:
- Multiple wp_localize_script
- wp_localized_script is not defined when called via jquey ajax
- Use wp_localize_script for non existing script
- How do you pass a boolean value to wp_localize_script [duplicate]
- Pass multiple PHP variables to JS in Options Page
- How to get the post ID when creating JS variables with localize_script
- Localization of JavaScript which is only used in one page
- Find out if enqueued script uses wp_localize_script?
- Using wp_localize_scripts
- How do I pass the template url to javascript in the ADMIN area of my theme?
- wp_localize_script no longer working after 5.5 update
- How can I get variable from php function and use it in wp_localize_script?
- wp localize script is not working in a custom AJAX request
- Using template tags in external JS file
- Issue with wp_localize_script
- Translate string with wp_localize_script()
- What about Deferring a localized script?
- help with wp_localize_script
- Is there a way to know the name of all variables passed by wp_localize_script?
- How to define variables in WordPress AJAX?
- Uses for the ‘"’ entity in HTML
- How can I add ” character to a multi line string declaration in C#?
- Escape quotes in JavaScript
- How is \\n and \\\n interpreted by the expanded regular expression?
- Why shouldn’t `'` be used to escape single quotes?
- What’s the Use of ‘\r’ escape sequence?
- Unrecognized escape sequence for path string containing backslashes
- What’s the difference between esc_html, esc_attr, esc_html_e, and so on?
- Should HTML output be passed through esc_html() AND wp_kses()?
- How to intercept already localized scripts
- What is the difference between esc_html filter vs attribute_escape filter?
- How to print translation supported text with HTML URL
- What is the correct way to build a widget using OOP
- Creating Multiple wp_localize_script for Shortcode?
- How do translated, escaped strings (esc_attr) in Themes work?
- w3 total cache minification breaks wp_localize_script() [closed]
- How to escape html code with html allowed
- esc before saving or before displaying does it matter?
- Updating a post without escaping ampersands?
- Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?
- wp_specialchars and wp_specialchars_decode in a shortcode plugin
- Sanitizing comments or escaping comment_text()
- How to properly escape a translated string?
- Setting HTML properties in a Gutenberg plugin using WordPress settings
- I am not understandinhg $wpdb->prepare correctly
- Nonces, AJAX, script variables & security in WordPress
- meta_query works locally but not on live server
- Wp_localize_script from Shortcode [closed]
- Sanitizing, Validating and Escaping in WordPress (Plugin)
- wp_localize_script and host/browser cache
- Escape when echoed
- Should I always prefer esc_attr_e & esc_html_e instead of _e?
- How can I output a php value into a JS file within WordPress?
- Different uniqid when calld in wp_localize_script and shortcode
- Script Localization doesn’t work
- WP_Editor – Saving Value into Plugin Option – Stripping HTML
- Is it necessary to escape LIKE term in WP_User_Query?
- Post Content, Special Characters and Filters
- Enqueue scripts all over but not in single.php
- Updating post data on save (save_post vs wp_insert_post_data)
- What is the safe way to print tracking code / pixel code before tag or tag
- mysql_real_escape_string() vs. esc_sql() in WordPress
- Path to image in js with wp_localize_script [closed]
- Escaping crashes my output
- How to escape multiple attribute at once in WordPress?
- Trouble inserting string containing quotations marks with wpdb in save_post hook
- How to be escape Variables and options when echo?
- Is there any solution, ide/tool etc., for automatic escaping for WordPress?
- Can wp_strip_all_tags be used as a substitute for esc_url, esc_attr & esc_html?
- issue in wp_localize_script
- Localize script not working in ajax
- product description text displays above website when in shop page [closed]
- wp_localize_script not passing the data
- How to load dynamic option with ajax
- Getting jQuery AJAX to work in WordPress (getting -1)
- wp_enqueue_script calling jQuery at different times for different browsers?
- how can i send this to wp_head – escape problem
- Get localize of a loaded javascript
- wp_kses_post escaping doesn’t appear to work as described?
- How to Object.freeze wp_localize_script
- Get with jQuery the value of an ACF field
- how to unescape wordpress output
- Help about Escaping
- How to use wp_filter_oembed_result?
- localize_script or rest api
- I can’t load my images from a js file using wp_localize_script
- bundled jquery in theme js not working with wp_localize_script
- Frontend AJAX Request causes Error: ‘Call to undefined function add_action’
- wp localize script makes variable global, how to solve that?
- Multiple shortcodes only use attributes from one of the shortcodes on custom plugin
- How to get, in WP page’s script, a wp enqueued script (in Functions.php)?
- Render the metabox input values as HTML
- Pass list of categories to JS
- Where is escaped the shortcode?
- Escaping a shortcode so it displays as-is [duplicate]
- Escaping and Special Characters (e.g. &)
- WordPress wp_localize_script nonce and ajax URL
- Using `esc_attr( get_block_wrapper_attributes() )`, results in `class=””wp-block-foo””`
- esc_url, esc_url_raw or sanitize_url?
- how to sanitizing $_POST with the correct way?