The general rule, at least as espoused by Mark Jaquith, is sanitize on input, escape on output (the corollary to this rule being sanitize early, escape late).
So: use sanitization filters (such as the kses() family) when storing untrusted data in the database, and use escaping filters (i.e. the esc_*() family) when outputting untrusted data in the template.
Related Posts:
- why is esc_html() returning nothing given a string containing a high-bit character?
- What characters do I need to escape in XML documents?
- What characters must be escaped in HTML 5?
- How can I selectively escape percent (%) in Python strings?
- How do I escape a single quote in jQuery?
- Escape Character in SQL Server
- How to escape apostrophe (‘) in MySql?
- How to prevent escaping when saving HTML code in an option value?
- Escaping and sanitizing SVGs in metabox textarea
- Sanitize and data validation with apply_filters() function
- What’s the difference between esc_* functions?
- How to correctly escape query variables to be used in WP_Query
- How to escape custom css?
- esc_attr / esc_html / esc_url in echos
- When do I need to use esc_html()? [duplicate]
- Escaping WP_Query tax_query when term has special character(s)
- what’s different between esc_attr, htmlspecialchars and htmlentities
- Allow all attributes in $allowedposttags tags
- When outputting a static string to the page, is it necessary to escape the output?
- Escape hexadecimals/rgba values
- How Flexible are the WordPress Coding Standards for PHPCS?
- Sanitizing comments or escaping comment_text()
- How to properly escape a translated string?
- Must I serialize/sanitize/escape array data before using set_transient?
- Sanitizing, Validating and Escaping in WordPress (Plugin)
- How Could I sanitize the receive data from this code
- How to sanitize user input?
- Which escape function to use when escaping an email or plain text?
- WP_Editor – Saving Value into Plugin Option – Stripping HTML
- What is the safe way to print tracking code / pixel code before tag or tag
- Translate a Constant while appeasing WordPress PHPCS
- Using esc_url() on a url more than once
- Do I need to escape get_theme_mod(‘url’) / (‘mail’) with esc_url?
- How to allow   with wp_kses()?
- Using esc_attr_e
- Why esc_html_() is not used on every text that has a translation (on Twenty Twenty One)?
- Escaping crashes my output
- How to escape html generate by a loop
- How to safely escape the title attribute
- Do we need to escape data that we receive from theme options?
- How to safely escape data that contains HTML attributes
- Can wp_strip_all_tags be used as a substitute for esc_url, esc_attr & esc_html?
- Echoing a URL to a link
- wp_kses_post escaping doesn’t appear to work as described?
- file_get_contents | escaping doesnt show the page
- Help about Escaping
- How to keep specific tag from an html string?
- How to use wp_filter_oembed_result?
- Escaping WP_Query tax_query when term has special character(s)
- Escaping and sanitization
- Escaping WP_Query tax_query when term has special character(s)
- Escaping Issues
- Escaping and Special Characters (e.g. &)
- Escaping data from database (users table) is necessary?
- Escaping get_option( ‘time_format’ ) is nesserary?
- esc_url, esc_url_raw or sanitize_url?
- how to sanitizing $_POST with the correct way?
- How should esc_url be combined with trailingslashit?
- Correct way of using esc_attr() and esc_html()
- esc_html don’t work on variable but do work on pasted text
- How to Git stash pop specific stash in 1.8.3?
- What are all the escape characters?
- Uses for the ‘"’ entity in HTML
- How can I add ” character to a multi line string declaration in C#?
- Illegal Escape Character “\”
- Escape quotes in JavaScript
- Which characters need to be escaped when using Bash?
- Escape string Python for MySQL
- what is a good method to sanitize the whole $_POST array in php?
- How is \\n and \\\n interpreted by the expanded regular expression?
- Why shouldn’t `'` be used to escape single quotes?
- What does it mean to escape a string?
- Invalid escape sequence (valid ones are \b \t \n \f \r \” \’ \\ )
- Escaping HTML strings with jQuery
- What’s the Use of ‘\r’ escape sequence?
- How do I use spaces in the Command Prompt?
- How do I escape ampersands in XML so they are rendered as entities in HTML?
- Unrecognized escape sequence for path string containing backslashes
- With “magic quotes” disabled, why does PHP/WordPress continue to auto-escape my POST data?
- Is sanitize_title enough to generate post slugs?
- What’s the difference between esc_html, esc_attr, esc_html_e, and so on?
- Should I escape wordpress functions like the_title, the_excerpt, the_content
- In Which Contexts are Plugins Responsible for Data Validation/Sanitization?
- wordpress sanitize array?
- Data sanitization: Best Practices with code examples
- Should I sanitize an email address before passing it to the is_email() function?
- How safe / sanitized is wp_insert_posts()?
- Best Practice for PHP
- When to use esc_html and when to use sanitize_text_field?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- How to safely sanitize a textarea which takes full HTML input
- What is the difference between esc_html filter vs attribute_escape filter?
- What is the difference between wp_strip_all_tags and wp_filter_nohtml_kses?
- Difference between esc_url() and esc_url_raw()
- How to print translation supported text with HTML URL
- Custom page with variables in url. Nice url with add_rewrite_rule
- Which WP functions do you need to use esc_html() or esc_url() on?
- Sanitize content from wp_editor
- How to properly validate data from $_GET or $_REQUEST using WordPress functions?
- What to use instead of wp_kses() in user output