esc before saving or before displaying does it matter?

Yes it does. Escaping depends on context and in worst case like using esc_html when writing directly to the DB are just a security hole.

Even if there is no security issue, there is theoretical one. The user asked you to store A, and you are storing B. In a simple cases B is exactly how A should be displayed in the HTML, but life is rarely simple and while at one point you want to display A in an input for which you want to do esc_attr and at another in a textarea for which you will want to use esc_html. If you already transformed A into B in the DB, it is a PITA to reconstruct for B what was the original A to apply the correct escape function on it.

Rule of thumb: In the DB you should store the raw values the user submitted (probably sanitized, but not escaped), escaping should be done only on output.

Related Posts:

  1. Allow iframe in custom meta box
  2. Passing error/warning messages from a meta box to “admin_notices”
  3. Add “upload media” button in meta box field
  4. get registered metaboxes by post type or post ID
  5. How to get meta box data to display on a page
  6. Add a meta description to home page?
  7. Check if meta key value already exists
  8. How do I stop HTML entities in a custom meta box from being un-htmlentitied?
  9. get_post_meta doesn’t work
  10. Metabox of one post influence setting on other
  11. How to store multiple input values with same meta_key
  12. Consolidate Metaboxes into 1 Big Metabox
  13. unable to save post meta on single field with multiple selects
  14. metabox upload file
  15. Why is variable value emptry in $_POST but available in $_REQUEST?
  16. Why does get_post_meta not work with the posts page?
  17. How to get meta box values – WP tuts tutorial
  18. Change the post date from a meta box
  19. update_post_meta and get_post_meta not working
  20. Repeatable custom meta fields
  21. how to save multiple checkboxes value in wordpress dynamically
  22. Using WYSIWYG In custom meta boxes
  23. Multiplicate entry on update_post_meta
  24. Undefined index error in custom post metabox
  25. Custom Meta box only returns most recent value on page
  26. How to prevent further updates of custom meta when using actions to set one meta based on another
  27. How to create a button click counter meta box?
  28. meta box & callback function
  29. $_GET & $post_ID
  30. get_post_meta as a list for drop down search filter
  31. Parse a text area custom meta box and assign as value to existing meta keys
  32. Getting metabox value?
  33. Hide Page Title with Post Meta
  34. Save meta data with post, Without using any plugin [closed]
  35. Editor meta box Showing but not saving
  36. How can i get multi checkboxes value in metbox?
  37. Show value of select dropdown in meta box
  38. remove a single post_meta
  39. Echo 2 values from one key in Array with get_post_custom
  40. save radio button selection in post-meta on submit
  41. post meta – problem : copy the same meta for all the articles
  42. Custom Meta Data is not being saved
  43. Update Post Meta in Front End with a form
  44. Update Post meta with custom variable
  45. get_post_meta not working on my custom-function page
  46. update_post_meta doesn’t work
  47. Removing Meta Generator
  48. Only allow one meta key value per post in a category
  49. use post meta in add_meta_boxes action
  50. Custom meta box not saving values of radio buttons in WordPress
  51. Can’t save drop down select date in meta boxes
  52. update_post_meta does not work
  53. add_post_meta not saved
  54. when saveing $meta_box i get Undefined index error
  55. Updating post meta and Meta Box plugin
  56. Related posts and custom meta_box?
  57. Select Options Meta Data is Not Updating in Edit Meta Box
  58. How to display meta box data using “Meta boxes as needed”
  59. Metadata in loops
  60. Calling Data from Custom Meta Box
  61. How can i remove blank area caused by theme’s post meta boxes?
  62. Datepicker altField and altFormat to save a new meta key/value in a post?
  63. My meta box don’t want to save value
  64. CPT posts in drop downed in meta box on page doesn’t return post ID
  65. How to set default screen options?
  66. Access the environment of an admin page from another admin page
  67. Add filter ‘wpautop’ to meta box textarea
  68. Dynamically Creating Meta Boxes
  69. Remove border on custom meta box
  70. Create a page Meta Box listing all blog users
  71. make a excerpt on data from a meta box?
  72. Add_meta_box not appearing, but does appear in screen options
  73. Decide Metabox Configurations for All Users
  74. how to save and get selected item id list with add_meta_box
  75. Why is my Custom Meta Box Field Inputs NOT saving?
  76. Resetting admin post form on JS validation fail
  77. New WP_Query loop in admin causes problems
  78. How do you List all Sidebars in a Metabox
  79. shortcode in a custom metabox
  80. How to I retrieve the ID from the Posts page?
  81. How to add metabox ONLY to specific WooCommerce product type [closed]
  82. Issue on Working with Metabox – Checkbox to enable Sale Items
  83. wpalchemi metabox doesn’t show value from my post type
  84. Why do I have to press the “Update” button twice to save my meta box values?
  85. How to use Gutenberg in CMB2?
  86. WP_Meta_Query object with conditionals
  87. ShortCut on meta boxes
  88. Post edit screen: How to check if meta_box is registered?
  89. Saving multiple fields (dropdown and text) in custom metabox
  90. Add post meta data date to event
  91. where can i see the registered new field for posts using register_meta() ?
  92. delete post meta data in array WordPress
  93. WordPress check if value equals and echo “checked”
  94. Custom metabox for file upload return empty filename
  95. Video slideshow
  96. Meta Box Value not saving / populating?
  97. How to set default screen options?
  98. Reload meta box content with AJAX
  99. Form submit from modal window to parent window
  100. Metaboxes – why they don’t render php in expected manner?

Leave a Comment

techhipbettruvabetnorabahisbahis forumutaraftarium24edueduseduseduedusedueduseduseduedu