How to escape html generate by a loop
This seems to have done the trick: // Display our list of font options $allowed_html = array( ‘option’ => array( ‘value’ => array(), ‘selected’ => array() ), ); echo wp_kses($fontListStr, $allowed_html);
escaping
Escaping crashes my output
There are several issues here: echo esc_attr_e should be just esc_attr_e, the _e means it already echo’s esc_attr_e is not just an escaping function, it’s a localisation API, it’s shorthand for echo esc_attr( __( esc_attr strips out HTML, it’s intended for use inside HTML attributes where HTML tags are not allowed. You must never pass … Read more
Why esc_html_() is not used on every text that has a translation (on Twenty Twenty One)?
The simple answer appears to be human error. Originally, during development, Twenty Twenty One had one menu, registered like this: ‘primary’ => __( ‘Primary Navigation’, ‘twentytwentyone’ ), Then somebody went through and added escaping to many __() throughout the theme, resulting in this: ‘primary’ => esc_html__( ‘Primary Navigation’, ‘twentytwentyone’ ), Then, later on, a second … Read more
Using esc_attr_e
I would suggest using esc_html instead of esc_attr for that, e.g. <a href=”https://wordpress.stackexchange.com/questions/185318/<?php echo esc_url( $url );?>” class=”<?php echo esc_attr( $classes ); ?>”> <?php echo esc_html( $title ); ?> </a> <div> <?php echo wp_kses_post( $html_with_safe_tags );?> </div> <script> <?php echo wp_json_encode( $data_for_js ); ?> </script> There is also: esc_html__ esc_attr__ etc ( escape translations too! … Read more
Unexpected esc_html and esc_attr behaviour
Use get_search_query or the_search_query to return/output the search term as a properly escaped value, don’t access $_GET directly. You’re trying to escape something that’s already URLencoded.
How to allow   with wp_kses()?
not sure the difference but I used   for adding a white space ..then passed it through wp_kses() The correct HTML entity for a non-breaking space is — note the ; which is required and without it (i.e.  ), the entity is not valid and when used with wp_kses(), you’d get &nbsp instead of … Read more
Do I need to escape get_theme_mod(‘url’) / (‘mail’) with esc_url?
Yes, you do. Even if you have sanitised the value when saving it, you should always escape on output. <a href=”https://wordpress.stackexchange.com/questions/355618/<?php echo esc_url( get_theme_mod(“url’ ) ); ?>”> If you’re outputting a mailto: link to an email address, you also need to escape this with esc_url(), just make sure that the mailto: part is included in … Read more
Using esc_url() on a url more than once
It’s okay to use it more than once, but not encouraged. However, in your first example, you’re saving the URL to the database. When you do that, or when using the URL in the wp_remote_* context, or a redirect, or any other non-display context, you should be using esc_url_raw() instead. Also note that get_post_meta will … Read more
Translate a Constant while appeasing WordPress PHPCS
You cannot use constants or anything other than actual strings with translation functions. This is because the code that reads your code, and produces the translatable strings does not actually run your code, it is reading your code. Here is a more detailed post on the topic: http://ottopress.com/2012/internationalization-youre-probably-doing-it-wrong/ But the short version is this: This … Read more
esc_js() breaks unicode sequences by removing the slash ‘\’ character
esc_js() breaks unicode sequences by removing the slash ‘\’ character