do_settings_sections() doesn’t escape quotes

I found the problem. You need to escape the values in the _render functions, using esc_attr, like this:

function my_setting_render() {
    $options = get_option('my_option_name');
    ?><input name="my_option_name[my_setting]" value="<?php echo esc_attr($options['my_setting']);?>">
    <?php

}

Leave a Comment