The general rule, at least as espoused by Mark Jaquith, is sanitize on input, escape on output (the corollary to this rule being sanitize early, escape late). So: use sanitization filters (such as the kses() family) when storing untrusted data in the database, and use escaping filters (i.e. the esc_*() family) when outputting untrusted data … Read more
Escaping depends entirely on the context in which you are using the functions. What is safe for displaying inside <h1> tags, is not necessarily safe to display for the value attribute of an input field, and even that wouldn’t necessarily be safe as a href attribute value…. In short – perform the sanitisation yourself as … Read more
esc_html() escapes a string so that it is not parsed as HTML. Characters like < are converted to <, for example. This will look the same to the reader, but it means that if the value being output is <script> then it won’t be interpreted by the browser as an actual script tag. Use this … Read more
I think I found it. Problem (bug): http://core.trac.wordpress.org/ticket/18322 Solution: http://codex.wordpress.org/Function_Reference/stripslashes_deep Note: As suggested by @Alexandar O’Mara, you might want to reconsider overwriting the superglobals like this. If it’s appropriate for your situation, for example, you might just “strip locally” using an alternative like $post = array_map(‘stripslashes_deep’, $_POST); Also see @quickshiftin’s excellent answer.
You can either use a double backslash each time or use the @ symbol
When your XML contains &amp;, this will result in the text &. When you use that in HTML, that will be rendered as &.
Single quotation marks won’t do in that case. You have to add quotation marks around each path and also enclose the whole command in quotation marks:
\r is a carriage return character; it tells your terminal emulator to move the cursor at the start of the line. The cursor is the position where the next characters will be rendered. So, printing a \r allows to override the current line of the terminal emulator. Tom Zych figured why the output of your … Read more
Since you’re using jQuery, you can just set the element’s text property:
You need to escape the “\” in the file path.