Always escape output unless you have a great reason not to.
The main thing that you lose when escaping translated strings is the ability to use html tags and html entities in the original string and translations, but you should probably not get into a situation in which translators are required to know html just in order to translated several words in the first place.
If for whatever reason you have to include an html entity as part of the string you can use printf
/sprintf
to give the translator some flexibility on the location of such an entity in string with something like
printf('%s&%s',esc_html__('first part','td'),esc_html__('second part','td'))
where &
is just an example for an html entity.
Obviously there might be more complex scenarios that might be impossible to escape in a sane way, but your guiding light should be to always escape by default.
Related Posts:
- How to make a WordPress plugin translation ready?
- How to provide translations for a WordPress TinyMCE plugin?
- Problems with localization
- `wp_set_script_translations` with `wp.i18n` does not return translated strings in simple plugin
- Can’t we use strings defined as PHP constants if we want to translate them in a plugin?
- WordPress: After Gutenberg plugin migration to block.json the localization/ translations with PolyGlot in JavaScript does not work anymore
- How to i18n text coming from the db or from an external source
- Should shorcodes in i18n plugins be translated and if so, how?
- Generate JSON files for language translation from po file without wp-cli i18n make-json
- How to prevent someone from entering strings without making it available for translation?
- Plugin language always shows WP site language, not profile language
- Is hint for translator compulsory while internationalizing a string containing variables?
- Translation not working for Constant strings in Plugin
- Save translation file of third party plugin in a custom plugin?
- How to print translation supported text with HTML URL
- Preparing a string in an array for localization
- Escaping built-in WP function return strings
- Shortcodes, output buffering, and WordPress functions
- Multiple textdomains
- How to properly load text domain of custom mu plugin
- How does gettext works for translating readme file of plugin?
- WordPress Localization and Templating
- How to properly load text domain of custom mu plugin
- How to update the language used by wordpress from a plugin
- Singular name Plugin localization
- use __($str) to translate strings (symfony/twig)
- Plugin Localization
- Is it possible to check is loaded language files correctly with WordPress plugin?
- Translate strings not recognised in plugin
- What is the way to ship read-me strings like plugin-strings for internationalization?
- Making my plugin translation ready. Poedit not working
- How to sanitize user input?
- Some strings from a .mo file do not load
- A better way to include localized labels in WordPress plugins
- Widget translation on my plugin
- How to render a time-of-day string like ’16:42′ with a site’s chosen time format?
- Frontend language per user
- Plugin translations not installed but… strings are translated!
- .mo translation strings not loading in PHP scripts that handle AJAX calls
- WP_Editor – Saving Value into Plugin Option – Stripping HTML
- Securing/Escaping Output of file content – reading via fread() in PHP
- What can be reason for no plugin-strings available under stable section on translate.wordpress.org?
- Build a translation correcter plugin
- Is there a way to test that readme looks in other language before submitting translation?
- Translation per IP location [closed]
- Translate slug in WPMU with PO files
- Shortcode returning localized HTML part
- mysql_real_escape_string() vs. esc_sql() in WordPress
- load_plugin_textdomain doestn’t work with add_action plugins_loaded
- Translate MCE button text/tooltip in custom plugin
- esc_html__() and __() not working within arrays
- Readme.txt seems to be cached but not the version
- Return Value of load_plugin_textdomain
- I18n not working in plugin
- Mixing l18n string from my plugin with WordPress’ translations
- Translate javascript with WordPress built-in localization API for static strings
- Why would you use esc_attr() on internal functions?
- Translating plugin settings page – dropdown list
- Make dynamic string translatable
- Translation issue with global variables
- How to ignore extra whitespaces in translation functions like _e?
- Using HTML links within translatable string
- Plugin not properly prepared for localization
- How to translate wordpress backend to another language
- Borrowing of Previously Translated Strings by Child Plugin
- Translations only load from `wp-content/languages/plugins` but not from the plugin’s languages folder
- escape html in jQuery for WordPress
- Use localized plugin name and description even when the plugin is disabled
- Include external po file for 3th party plugin to theme
- HTML Elements in my WP Plugin being generated in JS. Security and Translated Text Question about this method being used
- Do I lose translations when I change my Text domain for my plugin on wp.org?
- Transform internationalized plugin into internationalized mu-plugin?
- Load custom translation in custom plugin fails
- Add language localisation to javascript alert?
- How to store in the database directly the translation?
- Load textdomain from global languages directory
- Plugin translation not being displayed
- Problem with Poedit [closed]
- How to translate WP plugin name?
- How are themes and plugins localized using the gettext GNU framework?
- get the queried_object of an url
- esc_url, esc_url_raw or sanitize_url?
- React Plugin Settings Page Localization
- How to get locale within WP REST Request?
- How are bulk actions handled in custom list table classes?
- Creating Settings Page with dropdowns for Plugin
- Empty POST data on server on AJAX request using Angular $http
- Commit changes to WordPress Plugin SVN with TortoiseSVN
- Slow WP_query due to nested wp_query. Need Suggestions
- Is @wordpress/env locked to node v14 or can I also use node v16?
- How can I add a simple custom field to my plugin?
- Run uninstall.php if a checkbox is checked from settings page
- Gravity Forms Anchor only on Front Page?
- Multiple page plugin settings
- how to get the top 10 popular blogs
- Override woocommerce loop-start.php from theme using plugin?
- Relational / Associate tables using native WordPress functionality
- Pull commentdata for pre_comment_on_post from comment_post_ID
- How to Rewrite WordPress URL for a Plugin
- WordPress, GIT, Renamed Plugin Dir + files – Working Code now Broken [closed]