Is it necessary to use escape functions on everything or is it only necessary if you’re taking input from a 3rd party? (End Users, APIs, Etc.)

that wordpress.org page was probably written by someone that do not get security.

Escaping is done to make sure that your output, when is part of an HTML page, is displayed to the user as you intend it to be which means converting thing like “<” to the appropriate HTML entity.

Yes, if you do not escape a bad actor that can insert content to site’s pages can trick the pages to display information you would not like to be displayed, but the root cause usually is that you do not escape your output to make sure it will display only the string as should have been displayed.

Escaping is context based and you should not apply html related escaping to email which contain simple text, so not realy sure what is that claim about wordpress apis always escaping.

double escaping is not needed but usually not something to worry about as the additional CPU power required is probably close to 0.

Related Posts:

  1. Should I escape wordpress functions like the_title, the_excerpt, the_content
  2. From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
  3. What is the difference between esc_html filter vs attribute_escape filter?
  4. What’s the difference between esc_* functions?
  5. What to use instead of wp_kses() in user output
  6. How to escape custom css?
  7. Is security a problem in WordPress?
  8. Do you need to escape hard coded plain text?
  9. Do I need to use the esc_html() function on hard coded links?
  10. How Could I sanitize the receive data from this code
  11. Something is unescaping all html entities before output to browser [closed]
  12. XMLRPC slow and weird websites/services
  13. Limit Login Attempts BEFORE PHP is executed?
  14. Do we need to escape data that we receive from theme options?
  15. should I escape a literal url added in functions.php
  16. Why are the latest visits to my website originating from my own website?
  17. nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast? [closed]
  18. how to sanitizing $_POST with the correct way?
  19. SSL Error: unable to get local issuer certificate
  20. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
  21. Why does the URL http://a/%%30%30 crash Google Chrome?
  22. What does it mean to escape a string?
  23. When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site?
  24. Can an attacker use inspect element harmfully?
  25. Where does Internet Explorer store saved passwords?
  26. Infected Files – what to do [closed]
  27. WordPress 4.7.1 REST API still exposing users
  28. Why does WordPress need my private ssh key to update?
  29. When to use esc_html and when to use sanitize_text_field?
  30. Why does WordPress have more than one salt?
  31. What is the ideal setup to address security concerns?
  32. Will there be security updates for 3.1 once 3.2 is released?
  33. WordPress it’s cleaning a custom query_var to avoid sql injections?
  34. Can someone explain the use cases of esc_html?
  35. Tips for finding SPAM links injected into the_content
  36. Close a wordpress blog – keep site as it is but prevent hacks
  37. Is WordPress vulnerable to the httpoxy?
  38. Prevent setup-config.php page from appearing when host blocks database
  39. wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability
  40. WordPress and Security
  41. Is there a security risk giving someone temporary access to my blog’s code?
  42. Is /wp-login.php?redirect_to[] exploitable?
  43. How to properly sanitize/secure a WP Query coming from the front end
  44. brute force attack even though it is limited by IP
  45. What should I do about hacked server?
  46. How do I authenticate WP users from a chrome extension?
  47. Website is being flooded [closed]
  48. Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?
  49. Sanitizing comments or escaping comment_text()
  50. Is there any point setting the keys and salts in wp-config.php?
  51. Auth cookie value security risk?
  52. Where to store OAuth 2.0 client id and secret?
  53. Security – Shortcode injection attack
  54. Registration Plugin – Recaptcha integration
  55. How can I safely use $_SERVER[‘REQUEST_URI’] to avoid XSS?
  56. Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?
  57. Moving away from MD5: Where to declare the custom global $wp_hasher?
  58. Would it be dangerous to send all the wp_options to javascript file?
  59. Changing Table Prefixes – once done, am I good to go going forward?
  60. Should I disable directory listing for wp-includes?
  61. Safety side of storing emoji into database
  62. How can I safely hide the fact that my website runs on WordPress? [closed]
  63. How can I display nickname instead username in links
  64. My WordPress Websites are always under attack
  65. Is there value in using a wp_nonce for POST requests?
  66. What is the safe way to print tracking code / pixel code before tag or tag
  67. How to hide easy access to my website temporarily?
  68. Can I Remove xmlrpc.php completely?
  69. Any any insecure http:// URLs left in wordpress?
  70. White screen of death on admin pages after moving wp-config up two levels for security
  71. Can a WordPress administrator see other users’ passwords?
  72. Why my plugins are updating automatically?
  73. Privilege escalation bugs in 2.9?
  74. Content-Security-Policy blocks WordPress check boxes from being activated
  75. wordpress admin security
  76. Why do people use “admin” username by default? [closed]
  77. How to correctly escape an echo
  78. WordPress Database Re-installed (Hacked)
  79. WordPress Security tools
  80. Robots.txt file not updating
  81. Escaping a WPDB Object in One Shot
  82. How can I stop other plugins from using my class’ sensitive methods?
  83. What are WordPress Current Security Issues in 2017?
  84. wp-config.php moved above root results in no plugin updates
  85. Password-protect feed and make it usable in major aggregators
  86. how to find the way they hacked my WP site
  87. is this code properly secured
  88. How to get real password (before encrypt) when register a user?
  89. Directory to store secure file
  90. How can I give someone server access to only duplicate and modify a site?
  91. WP-JSON: Cross Origin Resource Sharing Vulnerability?
  92. How can I implement ansible with per-host passwords, securely?
  93. Why should I firewall servers?
  94. Does drilling a hole into a hard drive suffice to make its data unrecoverable?
  95. Can you alter the default wordpress strong password requirements?
  96. Verify Cryptographic Authenticity after Downloading Releases (Signatures)
  97. Fix CVE-2017-5487 vulnerability
  98. Content Security Policy blocking images from installed plugins’ popup info window, as they are from external domains – global fix?
  99. Which WP-CLI commands can be safely run with –allow-root flag?
  100. How can I find out exactly what Google is finding ‘Deceptive’ about my WordPress site?
Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)