Can someone explain the use cases of esc_html?

esc_html() does two things:

  1. Checks for invalid UTF8 in a string.
  2. Converts a number of special characters into their HTML entities, specifically deals with: &, <, >, “, and ‘.

Using it instead of __(), _e and other i18n functions protects your website from possible errors that can occur with unaware translators who may use text that contains (1) invalid UTF8 characters or (2) unwanted HTML code. Trust me, many translators will be tempted to use some ‘nice’ HTML tags like <i>, <b> etc, even worse, they won’t close them correctly.

Related Posts:

  1. How to redirect all HTTP requests to HTTPS
  2. What’s the best approach for generating a new API key?
  3. Simplest two-way encryption using PHP
  4. How does the SQL injection from the “Bobby Tables” XKCD comic work?
  5. how fix “this certificate cannot be verified up to a trusted certification authority”
  6. How can bcrypt have built-in salts?
  7. Getting a List of Currently Available Roles on a WordPress Site?
  8. What’s the easiest way to stop WP from ever logging me out
  9. Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
  10. How safe / sanitized is wp_insert_posts()?
  11. From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
  12. Why are passwords exportable as plain text in WordPress?
  13. What’s the difference between esc_* functions?
  14. How to set up fail2ban with WordFence?
  15. How to remove “Connection Information” requirement on localhost install of WP on MACOSX
  16. Disable comment windows for all existing posts (pages/blogposts)
  17. WordPress “Site Health Status” trust it or myself for its security advice?
  18. Generate WordPress salt
  19. Stop wordpress automatically escaping $_POST data
  20. Is WP vulnerable when updating plugins or themes?
  21. how can i embed wordpress backend in iframe
  22. Garbage in beginning of wp-config.php – was this WP installation compromised?
  23. Can I force a password change?
  24. What is the relationship between cURL, WordPress and cacert.pem?
  25. Is it necessary to use esc_url with template tags such as get_permalink?
  26. What is pclzip.lib.php file that wordfence think it’s a malicious code
  27. How to prevent bot or someone to modify any file automatically?
  28. How to disable XML-RPC from Linux command-line in a total way?
  29. HTTP Security Headers in wp-config
  30. How to remove javascript malware in wordpress site [closed]
  31. Staging Site: Made Public – Security Questions
  32. Best Way to Enable Two Step Authentication
  33. Securing my WordPress Files and Directories
  34. Single sign-on: wp_authenticate_user vs wp_authenticate
  35. Securing a multi-user permission structure
  36. Is default functions like update_post_meta safe to use user inputs?
  37. No option “I would like my site to be private, visible only to users I choose” in Privacy Settings
  38. How does the “authentication unique keys and salts” feature work?
  39. vs WordPress Security
  40. esc_html__ security : what for in this example?
  41. Securing wp-config leads to sensitive information leak on wp-settings
  42. Suspicious Files
  43. What’s the point of forbidding access to wp-config.php?
  44. wp-json and what data does it give away?
  45. Is is necessary to use security plugin for wordpress? [closed]
  46. neccessary?
  47. wp-config.php being written by attacker
  48. Simple Online Payment for Event Registration [closed]
  49. What may be causing failure of auto-install features in WordPress (v3.0.3)?
  50. Client side HTTP parameter pollution (reflected)
  51. Local file inclusion critical security issue [closed]
  52. my wordpress website is suspended [closed]
  53. Malware script in database post table only? [closed]
  54. Best practices to assert current_user_can() with guests
  55. XMLRPC slow and weird websites/services
  56. iTheme Security always lockout my account [closed]
  57. Is it sensible to worry about sanitizing admin input in plugin custom CSS?
  58. WordPress Front end Form – Enable to Submit PHP Codes
  59. Is it safe use wp_editor in public contact form
  60. Is WordPress MultiSite secure & how much can it scale? [closed]
  61. How to find exploited wordpress plugin [closed]
  62. How I can open back door for myself?
  63. How safe is current_user_can()?
  64. Is it safe to give wordpress directories ownership to www-data?
  65. Do we need to escape data that we receive from theme options?
  66. Why does WordPress change a file’s permissions?
  67. Side effects of disallowing *.php requests in production environment?
  68. Outgoing new connection to linked Websites – why?
  69. My Site keeps crashing due to the wp-confg file being deleted
  70. Someone keeps changing my SITEURL (mysql injection or xss?) [closed]
  71. Who updates the wp-admin/core file?
  72. How WordPress sanitizes post content on save? Or it doesn’t?
  73. Replace domain in database
  74. Does this code indicate an exploit?
  75. What highest security brake with wordpress and static files?
  76. Spam in WordPress root folder
  77. Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?
  78. HSTS header not being added correctly
  79. how to protect wordpress content from crawler
  80. Should I worry about SQL injection when using REST API?
  81. How can I backup my site if it gets hacked?
  82. Cannot access wp admin of WordPress website (security plugin issue) [closed]
  83. Why are the latest visits to my website originating from my own website?
  84. Secure Multiple WordPress Installations on shared hosting
  85. How do I hide WordPress users from security scanning?
  86. Background Updates Not Happening
  87. wp-config.php file and code injection
  88. Able to go to WordPress admin even after deleting auth cookies from request headers
  89. FORCE_SSL_ADMIN affecting subdomains
  90. What is the best security $_POST method?
  91. Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
  92. Bank account number and Sort Code in a form [closed]
  93. Directory to store secure file
  94. How can I give someone server access to only duplicate and modify a site?
  95. WP-JSON: Cross Origin Resource Sharing Vulnerability?
  96. How can I implement ansible with per-host passwords, securely?
  97. Why should I firewall servers?
  98. Does drilling a hole into a hard drive suffice to make its data unrecoverable?
  99. Can you alter the default wordpress strong password requirements?
  100. how to sanitizing $_POST with the correct way?

Leave a Comment

error code: 523