Escaping get_option( ‘time_format’ ) is nesserary?

Should you escape these?

$date_format="Y/m/d";
$time_format = get_option( 'time_format' );

No. That would be early escaping! Early escaping is very bad!

However, should you escape this?

echo'<td>'.$date .' '.$time.'</td>';

YES.

Escaping is not about wether it’s needed or not, if you ever find yourself saying “It shouldn’t be a problem because it’s always a” stop yourself and escape.

Escaping is about enforcing assumptions and expectations. Why trust that it will be safe when you can escape and guarantee that it’s safe?

This protects you in multiple ways, e.g. if you use esc_html you’ve guaranteed the string will never contain HTML, even if you make changes in the future further up, filters get added, etc, you always know that it’s safe because you escaped at the moment of output.

Related Posts:

  1. What characters do I need to escape in XML documents?
  2. What characters must be escaped in HTML 5?
  3. How can I selectively escape percent (%) in Python strings?
  4. How do I escape a single quote in jQuery?
  5. Escape Character in SQL Server
  6. How to escape apostrophe (‘) in MySql?
  7. Should HTML output be passed through esc_html() AND wp_kses()?
  8. How to prevent escaping when saving HTML code in an option value?
  9. How to correctly escape query variables to be used in WP_Query
  10. esc_attr / esc_html / esc_url in echos
  11. When do I need to use esc_html()? [duplicate]
  12. what’s different between esc_attr, htmlspecialchars and htmlentities
  13. Allow all attributes in $allowedposttags tags
  14. When outputting a static string to the page, is it necessary to escape the output?
  15. How Flexible are the WordPress Coding Standards for PHPCS?
  16. why is esc_html() returning nothing given a string containing a high-bit character?
  17. How to properly escape a translated string?
  18. Translate a Constant while appeasing WordPress PHPCS
  19. Using esc_url() on a url more than once
  20. Do I need to escape get_theme_mod(‘url’) / (‘mail’) with esc_url?
  21. How to allow &nbsp with wp_kses()?
  22. Using esc_attr_e
  23. Why esc_html_() is not used on every text that has a translation (on Twenty Twenty One)?
  24. Escaping crashes my output
  25. How to safely escape the title attribute
  26. How to safely escape data that contains HTML attributes
  27. Can wp_strip_all_tags be used as a substitute for esc_url, esc_attr & esc_html?
  28. Echoing a URL to a link
  29. wp_kses_post escaping doesn’t appear to work as described?
  30. file_get_contents | escaping doesnt show the page
  31. Help about Escaping
  32. How to keep specific tag from an html string?
  33. Escaping Issues
  34. Escaping and Special Characters (e.g. &)
  35. How to Git stash pop specific stash in 1.8.3?
  36. What are all the escape characters?
  37. Which characters need to be escaped when using Bash?
  38. Escape string Python for MySQL
  39. How do I use spaces in the Command Prompt?
  40. With “magic quotes” disabled, why does PHP/WordPress continue to auto-escape my POST data?
  41. Best Practice for PHP
  42. From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
  43. Escaping and sanitizing SVGs in metabox textarea
  44. Difference between esc_url() and esc_url_raw()
  45. Which WP functions do you need to use esc_html() or esc_url() on?
  46. What’s the difference between esc_* functions?
  47. What to use instead of wp_kses() in user output
  48. How to escape custom css?
  49. How to Use Wildcards in $wpdb Queries Using $wpdb->get_results & $wpdb->prepare?
  50. PHP Coding Standards, Widgets and Sanitization
  51. Should messages in WP_Error already be html escaped?
  52. When do I need to use esc_attr when using WordPress internal functions
  53. Disable escaping html
  54. Do you need to escape hard coded plain text?
  55. Escaping built-in WP function return strings
  56. How do I stop HTML entities in a custom meta box from being un-htmlentitied?
  57. Why should I escape translatable strings? and how shall i do that?
  58. esc_url not working within add_settings_field callback
  59. Do I need to use the esc_html() function on hard coded links?
  60. How Could I sanitize the receive data from this code
  61. Should you escape hardcoded URLs?
  62. Quotes being escaped inside wp_editor when saved with wp_kses_post
  63. When I re-save a post with [code] sections, the entities are double-escaped (> becomes > etc)
  64. Escape post image attachments added to template
  65. wp_query not searching with apostrophe
  66. Which escape function to use when escaping an email or plain text?
  67. Is Wrapping intval() Around esc_attr() Redundant for Escaping Input?
  68. Base64 & JSON Encode array in PHP, use as HTML data attribute, decode and parse in JavaScript …. with proper Escaping
  69. Something is unescaping all html entities before output to browser [closed]
  70. How to get my post title to work with an apostrophe (‘s)?
  71. Securing/Escaping Output of file content – reading via fread() in PHP
  72. WordPress stripping away backslashes from HTML
  73. esc_js() breaks unicode sequences by removing the slash ‘\’ character
  74. Unexpected esc_html and esc_attr behaviour
  75. HTML escaping data with ajax requests
  76. Allow HTML in Settings API input field
  77. Do we need to escape data that we receive from theme options?
  78. should I escape a literal url added in functions.php
  79. How to allow single quote with esc_html__() without sprintf()
  80. Proper way to use esc_html__ and esc_attr__ etc for escaping value for translation
  81. Wrapping add_query_arg with esc_url not working
  82. ACF Unexpected T_CONSTANT_ENCAPSED_STRING [closed]
  83. How to pass an array as attribute of shortcode to work properly shortcode parser?
  84. wordpress post not showing my “” text>?
  85. escape html in jQuery for WordPress
  86. echo cutom css code to WordPress page template file ? is this safe?
  87. Remove pre and code tags from WordPress
  88. Correct form of escaping and localization – functions.php breadcrumbs
  89. Escaping a Single Quote in str_replace for Nav Function
  90. wp_kses allow checkbox class and checked
  91. Escaping html for meta description
  92. How to make MySQL search queries with quotes
  93. Escaping WP_Query tax_query when term has special character(s)
  94. Escaping and sanitization
  95. Escape html structure in php
  96. site_url() returns with additional backslashes
  97. How to display post meta data in secure manner
  98. Code auto escaping is not working when using short codes
  99. Allow iframe in custom meta box
  100. how to sanitizing $_POST with the correct way?