What is This esc_html_e() i wordpress php?

It’s a combination of _e(), which echoes a translatable string, and esc_html() which is for outputting text so that the text is not interpreted as HTML.

You would use it to prevent HTML being smuggled into a translation and breaking your markup or causing security issues.

For example, if your theme had:

_e( 'My translatable string', 'my-text-domain' );

Then it’s possible for a translation for 'My translatable string' to be something like '<script>alert('Bad!');</script>'. If you don’t use esc_html_e() then that script will be executed. If you use esc_html_e() then it won’t be, because the < & > characters will be escaped as &lt; & &gt;, which out output as < and > and not interpreted as HTML tags.

Leave a Comment