Encodes < > & ” ‘ (less than, greater than, ampersand, double quote,
single quote). Will never double encode entities.
Given that, arguably, both of those strings need sanitization. Imagine a site name like >> "My" Website's Great Title <<"
Also, since you are using this in Javascript, you should probably be using esc_js instead.
The convention is, “understand how markup works, and how malicious hackers work, and act accordingly.” That is how you know how to use these functions. Also, Trust No One.
See also this article from our member Stephen Harris: Data Sanitization and Validation With WordPress
Related Posts:
- Sanitizing, Validating and Escaping in WordPress (Plugin)
- Escape when echoed
- Is Wrapping intval() Around esc_attr() Redundant for Escaping Input?
- How to be escape Variables and options when echo?
- Uninstall, Activate, Deactivate a plugin: typical features & how-to
- Best way to initiate a class in a WP plugin?
- How do you debug plugins?
- How to structure a plugin
- What’s the preferred method of writing AJAX-enabled plugins?
- Add multiple plugin directories
- What are the differences between WPINC and ABSPATH?
- How to add a shortcode button to the TinyMCE editor?
- Where do I put the code snippets I found here or somewhere else on the web?
- What Plugins Demonstrate Great WP Plugin Development? [closed]
- is_plugin_active function doesn’t exist
- Delete WordPress plugin Repository
- Custom pages with plugin
- How to change a user’s password programatically
- Who are the most trusted plugin developers? [closed]
- How can I find plugins’ slug?
- List all sidebar names?
- What are the common security flaws I need to look for? [closed]
- Get plugin_dir_url() from one level deep within plugin
- Pass PHP variable to javascript
- Where is the best place to use add_filter
- Can a developer adopt a plugin marked as “not updated in over 2 years”?
- Conditionally enqueue a widget’s script/stylesheet in HEAD (only when present on page!)
- How to implement WordPress plugin update that modifies the database?
- What is difference between get_bloginfo(‘url’) and get_site_url()?
- Custom media upload content for inserting custom post shortcode
- Stop a plugin in the activation process when a certain WP version is not met then show error message in admin_notices action hook
- How to Add a Third Level Sub Menu to the WordPress Admin Menu
- How to Add an Index to Plugin Database table
- Does the number of downloads displayed for a plug-in in the WordPress.org plug-in directory include automatic updates?
- how to create child WordPress plugin
- Redesigning Custom Post Type “Add New” page
- How to safely sanitize a textarea which takes full HTML input
- How to Remove Certain Screen Options and Meta Boxes from add/edit post type?
- Making my plugin multi-site compatible
- Why activate_plugin is not working in register_activation_hook
- Get plugin directory from a theme
- dealing with large HTML output via plugin code
- Best Practice for Referencing the Plugin Directory
- Getting Path To Uploaded Attachment Image After Upload
- Update plugin from personal API
- Giving Multiple Authors Access to a Plugin’s WP.org Repo
- Plugin upgrading: Widget settings
- Create a table in custom plugin on the activating it?
- How to call a plugin function from index.php
- dbDelta only creates the last table
- How would you require and automatically download dependent plugins?
- Update my custom WordPress Plugin through my own server [duplicate]
- Do plugin files have to follow a specific convention to be “picked up” by WordPress?
- Loading external page template and enqueue script from plugin causes 403 forbidden error
- How can I make it so the Add New Post page has Visibility set to Private by default?
- My custom made plugin has “a new version available” which links to unrelated plugin
- wp.media update options and force render on uploader
- WordPress Plugin Development In MVC Architecture, How?
- Creating two database tables via plugin
- Is it a good idea to edit an already existing plugin to add more functionality?
- How to stop showing admin notice after close button has been clicked
- Custom Filter in WordPress to modify footer information via plugin?
- Checking if an attribute exists in a shortcode
- How to create a WordPress plugin for another wordpress plugin?
- Does a plugin’s “main” file need to be named the same as the folder containing it?
- Query Posts by Custom Field ‘Price’
- Rewriting every url
- Is There a WordPress Hook to Filter the Edit Posts View?
- Symlinked plugin directory doesn’t appear in Admin
- Add section (add_settings_section) to a custom page (add_submenu_page)
- Where the Nickname is being used in WordPress
- Where can I find a schema of wordpress plugin core architecture?
- Creating a WordPress admin page without a menu for a plugin
- How to delete custom taxonomy terms in plugin’s uninstall.php?
- Problems with autoloading classes via sp_autoload_register / maybe interfering WP-specific autoloader
- Redirect to settings page after install
- How does WordPress handle MySQL row lock errors?
- Advice on naming files for a plugin
- How to remove duplicate sub-menu name for top level menu items in a plugin?
- WordPress plugin from own server
- How to avoid plugin name conflicts from the upgrade notifier?
- WordPress Plugin Development from Scratch. How? [closed]
- Page Templates from plugin not working after upgrading WP to 4.7 or upper version
- Creating a user’s own folder on user registration
- When can you get current page ID and initialize hooks right after?
- Namespaces in WordPress – How do I initiate the main class?
- Show Similar Post Titles ( Similar to Stack Exchange )
- How to add option box in “Edit Post” plugin API?
- Customize plugin update “new version is available” text
- Add rewrite rule to permalink structure
- Notify Admins about Plugin Merge
- How do I unlock a post programmatically?
- Customizing subject in comment notification e-mails
- category_name not working (not showing up in sql query debug)
- How to save the values of checkbox to the register setting?
- enqueue script only if it is not already enqueue
- Is there any record of installed plugins in the database?
- Why do I get this “plugin does not have a valid header” error?
- Using require_once in a Plugin?
- How can I make my custom shortcode work in a Custom HTML Widget?