When to use esc_url, esc_html, esc_attr, and friends?

Those function are used to produce a valid HTML and not to sanitize input. You should use them anytime you are not 100% sure that what you want to output is a valid HTML for that context.

Should you escape everything? I guess the _s theme people decided that it is better to be safe then sorry, and there is some logic to that.

Leave a Comment