I would suggest using esc_html instead of esc_attr for that, e.g.
<a href="https://wordpress.stackexchange.com/questions/185318/<?php echo esc_url( $url );?>" class="<?php echo esc_attr( $classes ); ?>">
<?php echo esc_html( $title ); ?>
</a>
<div>
<?php echo wp_kses_post( $html_with_safe_tags );?>
</div>
<script>
<?php echo wp_json_encode( $data_for_js ); ?>
</script>
There is also:
esc_html__esc_attr__etc ( escape translations too! )esc_js– escape strings for javascript e.g.console.log(<?php echo esc_js($var); ?>);esc_url_rawwhen redirecting, use this insteadesc_sqlesc_textareasanitize_text_field- Whitelisting values
- type casting with
(int)orabsint - and others
Related Posts:
- What characters do I need to escape in XML documents?
- What characters must be escaped in HTML 5?
- How can I selectively escape percent (%) in Python strings?
- How do I escape a single quote in jQuery?
- Escape Character in SQL Server
- How to escape apostrophe (‘) in MySql?
- Should HTML output be passed through esc_html() AND wp_kses()?
- How to prevent escaping when saving HTML code in an option value?
- How to correctly escape query variables to be used in WP_Query
- esc_attr / esc_html / esc_url in echos
- When do I need to use esc_html()? [duplicate]
- what’s different between esc_attr, htmlspecialchars and htmlentities
- Allow all attributes in $allowedposttags tags
- When outputting a static string to the page, is it necessary to escape the output?
- How Flexible are the WordPress Coding Standards for PHPCS?
- why is esc_html() returning nothing given a string containing a high-bit character?
- How to properly escape a translated string?
- Translate a Constant while appeasing WordPress PHPCS
- Using esc_url() on a url more than once
- Do I need to escape get_theme_mod(‘url’) / (‘mail’) with esc_url?
- How to allow   with wp_kses()?
- Why esc_html_() is not used on every text that has a translation (on Twenty Twenty One)?
- Escaping crashes my output
- How to safely escape the title attribute
- How to safely escape data that contains HTML attributes
- Can wp_strip_all_tags be used as a substitute for esc_url, esc_attr & esc_html?
- Echoing a URL to a link
- wp_kses_post escaping doesn’t appear to work as described?
- file_get_contents | escaping doesnt show the page
- Help about Escaping
- How to keep specific tag from an html string?
- Escaping Issues
- Escaping and Special Characters (e.g. &)
- Escaping get_option( ‘time_format’ ) is nesserary?
- How should esc_url be combined with trailingslashit?
- Correct way of using esc_attr() and esc_html()
- Uses for the ‘"’ entity in HTML
- Illegal Escape Character “\”
- How is \\n and \\\n interpreted by the expanded regular expression?
- Why shouldn’t `'` be used to escape single quotes?
- What does it mean to escape a string?
- Invalid escape sequence (valid ones are \b \t \n \f \r \” \’ \\ )
- Escaping HTML strings with jQuery
- How do I escape ampersands in XML so they are rendered as entities in HTML?
- Unrecognized escape sequence for path string containing backslashes
- Should I escape wordpress functions like the_title, the_excerpt, the_content
- Best Practice for PHP
- What is the difference between esc_html filter vs attribute_escape filter?
- Sanitize and data validation with apply_filters() function
- Difference between esc_url() and esc_url_raw()
- How do translated, escaped strings (esc_attr) in Themes work?
- Escaping WP_Query tax_query when term has special character(s)
- Do I need to escape data passed to wp_localize_script()?
- How to escape html code with html allowed
- esc before saving or before displaying does it matter?
- Escaping built-in WP function return strings
- Updating a post without escaping ampersands?
- esc_url not working within add_settings_field callback
- Prevent add_shortcode from escaping a tag
- Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?
- wp_specialchars and wp_specialchars_decode in a shortcode plugin
- Sanitizing comments or escaping comment_text()
- I am not understandinhg $wpdb->prepare correctly
- meta_query works locally but not on live server
- Prevent escaping javascript in visual editor
- Sanitizing, Validating and Escaping in WordPress (Plugin)
- Escape when echoed
- Quotes being escaped inside wp_editor when saved with wp_kses_post
- Should I always prefer esc_attr_e & esc_html_e instead of _e?
- Is it safe and good practice to use do_shortcode to escape?
- WP_Editor – Saving Value into Plugin Option – Stripping HTML
- Is it necessary to escape LIKE term in WP_User_Query?
- Post Content, Special Characters and Filters
- WordPress stripping away backslashes from HTML
- Updating post data on save (save_post vs wp_insert_post_data)
- What is the safe way to print tracking code / pixel code before tag or tag
- mysql_real_escape_string() vs. esc_sql() in WordPress
- How to escape html generate by a loop
- HTML escaping data with ajax requests
- Add HTML to Term Description
- Is there any solution, ide/tool etc., for automatic escaping for WordPress?
- How to allow single quote with esc_html__() without sprintf()
- Proper way to use esc_html__ and esc_attr__ etc for escaping value for translation
- Wrapping add_query_arg with esc_url not working
- ACF Unexpected T_CONSTANT_ENCAPSED_STRING [closed]
- How to pass an array as attribute of shortcode to work properly shortcode parser?
- wordpress post not showing my “” text>?
- How to correctly escape an echo
- Escaping a WPDB Object in One Shot
- How to make MySQL search queries with quotes
- Escape html structure in php
- site_url() returns with additional backslashes
- Code auto escaping is not working when using short codes
- Allow iframe in custom meta box
- problem with quotes on new post
- Escaping data from database (users table) is necessary?
- Escaping admin_url output being passed to js (esc_js vs esc_url)
- how to escape alert/window.location.replace with variable
- Escaping inline JS correctly
- Is it necessary to use escape functions on everything or is it only necessary if you’re taking input from a 3rd party? (End Users, APIs, Etc.)