Should HTML output be passed through esc_html() AND wp_kses()?

The general rule, at least as espoused by Mark Jaquith, is sanitize on input, escape on output (the corollary to this rule being sanitize early, escape late).

So: use sanitization filters (such as the kses() family) when storing untrusted data in the database, and use escaping filters (i.e. the esc_*() family) when outputting untrusted data in the template.

Related Posts:

  1. why is esc_html() returning nothing given a string containing a high-bit character?
  2. What characters do I need to escape in XML documents?
  3. What characters must be escaped in HTML 5?
  4. How can I selectively escape percent (%) in Python strings?
  5. How do I escape a single quote in jQuery?
  6. Escape Character in SQL Server
  7. How to escape apostrophe (‘) in MySql?
  8. How to prevent escaping when saving HTML code in an option value?
  9. Escaping and sanitizing SVGs in metabox textarea
  10. Sanitize and data validation with apply_filters() function
  11. What’s the difference between esc_* functions?
  12. How to correctly escape query variables to be used in WP_Query
  13. How to escape custom css?
  14. esc_attr / esc_html / esc_url in echos
  15. When do I need to use esc_html()? [duplicate]
  16. Escaping WP_Query tax_query when term has special character(s)
  17. what’s different between esc_attr, htmlspecialchars and htmlentities
  18. Allow all attributes in $allowedposttags tags
  19. When outputting a static string to the page, is it necessary to escape the output?
  20. Escape hexadecimals/rgba values
  21. How Flexible are the WordPress Coding Standards for PHPCS?
  22. Sanitizing comments or escaping comment_text()
  23. How to properly escape a translated string?
  24. Must I serialize/sanitize/escape array data before using set_transient?
  25. Sanitizing, Validating and Escaping in WordPress (Plugin)
  26. How Could I sanitize the receive data from this code
  27. How to sanitize user input?
  28. Which escape function to use when escaping an email or plain text?
  29. WP_Editor – Saving Value into Plugin Option – Stripping HTML
  30. What is the safe way to print tracking code / pixel code before tag or tag
  31. Translate a Constant while appeasing WordPress PHPCS
  32. Using esc_url() on a url more than once
  33. Do I need to escape get_theme_mod(‘url’) / (‘mail’) with esc_url?
  34. How to allow &nbsp with wp_kses()?
  35. Using esc_attr_e
  36. Why esc_html_() is not used on every text that has a translation (on Twenty Twenty One)?
  37. Escaping crashes my output
  38. How to escape html generate by a loop
  39. How to safely escape the title attribute
  40. Do we need to escape data that we receive from theme options?
  41. How to safely escape data that contains HTML attributes
  42. Can wp_strip_all_tags be used as a substitute for esc_url, esc_attr & esc_html?
  43. Echoing a URL to a link
  44. wp_kses_post escaping doesn’t appear to work as described?
  45. file_get_contents | escaping doesnt show the page
  46. Help about Escaping
  47. How to keep specific tag from an html string?
  48. How to use wp_filter_oembed_result?
  49. Escaping WP_Query tax_query when term has special character(s)
  50. Escaping and sanitization
  51. Escaping WP_Query tax_query when term has special character(s)
  52. Escaping Issues
  53. Escaping and Special Characters (e.g. &)
  54. Escaping data from database (users table) is necessary?
  55. Escaping get_option( ‘time_format’ ) is nesserary?
  56. esc_url, esc_url_raw or sanitize_url?
  57. how to sanitizing $_POST with the correct way?
  58. How should esc_url be combined with trailingslashit?
  59. Correct way of using esc_attr() and esc_html()
  60. Uses for the ‘"’ entity in HTML
  61. How is \\n and \\\n interpreted by the expanded regular expression?
  62. Why shouldn’t `'` be used to escape single quotes?
  63. Unrecognized escape sequence for path string containing backslashes
  64. In Which Contexts are Plugins Responsible for Data Validation/Sanitization?
  65. wordpress sanitize array?
  66. When to use esc_html and when to use sanitize_text_field?
  67. Does WordPress sanitize arguments to WP_Query?
  68. Shortcode putting html such as
  69. How to properly sanitize strings without $wpdb->prepare?
  70. Is there an equivalent of the PHP function sanitize_key in Gutenberg?
  71. Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?
  72. wp_specialchars and wp_specialchars_decode in a shortcode plugin
  73. Sanitizing search data for use with WP_Query
  74. Filter string like a slug
  75. Change filename during upload
  76. Preserve old values on error in setting API
  77. Post Content, Special Characters and Filters
  78. Data sanitization for user registration and user login
  79. Updating post data on save (save_post vs wp_insert_post_data)
  80. mysql_real_escape_string() vs. esc_sql() in WordPress
  81. WordPress messes up with data attributes in shortcode output
  82. textarea field is getting escaped for some unknown reason
  83. Allow HTML in Settings API input field
  84. Input sanitation
  85. WP_Customize_Manager: How to get control ID
  86. How to use checked() function with multiple check box group? How to properly sanitize that checkbox group?
  87. escape html in jQuery for WordPress
  88. echo cutom css code to WordPress page template file ? is this safe?
  89. Sanitize WordPress Array Input?
  90. How to save Checkbox-Options in Plugin Options Page
  91. Remove pre and code tags from WordPress
  92. Correct form of escaping and localization – functions.php breadcrumbs
  93. wp_kses allow checkbox class and checked
  94. Comparing pre-saved post_title to post-saved post_title
  95. How to display post meta data in secure manner
  96. Settings api sanatize callback not being triggered
  97. Sanitizing a custom query’s clauses
  98. wp_set_object_terms() without accents
  99. How can I properly sanitize the update_option in WordPress?
  100. What is the proper way to sanitize $_POST and $_GET vars?

Leave a Comment