Usually, you don’t need it. But … there is at least one edge case:
- If a theme file is a template part,
- and it is using global variables from the calling context (parent file),
- and register_globals is
on, - and it is just using these variables without any security check …
… an attacker can call this file, set the missing variables with GET or POST and make the theme file print those out. And then there is a security problem.
So … the best option is not a context check like the one from your example, but good code: avoid global variables, check their content before you print it out.
Related Posts:
- Should `get_template_directory_uri()` be escaped?
- Is it good to rename theme folder downloaded from WordPress.org?
- How to sanitize select box values in post meta?
- When to use esc_url, esc_html, esc_attr, and friends?
- Worthwhile to restrict direct access of theme files?
- Where i should not use if (!defined(‘ABSPATH’)) { exit; }?
- Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?
- Is it safe to enqueue a font style without putting http or https?
- Using esc_url with a hard coded url
- What is the safe way to print tracking code / pixel code before tag or tag
- Underscore Based Theme File Permissions in Git
- correct tags for validating input types
- How to escape multiple attribute at once in WordPress?
- Contact Form Security
- Do I need to escape get_the_post_thumbnail function?
- Strict Folder and File Permissions for WordPress Themes Folder
- hide theme files for admin beneath root
- Should we escape the values of constants?
- If necessary, how should wp_get_attachment_image() and its parameters be escaped?
- Theme Customizer not loading JS for live preview
- get_search_form() and aria_label
- Can’t remove DIV from hooks in Storefront child theme [closed]
- Admin: sub menu doesnt display under apperance when activate my themes
- Get data from style.css file and from from users->your profile
- Getting Different Size Of Attachment Images
- 2 loops, is_home won’t work, count is off
- how to remove the gallery shortcode in wordpress?
- How can I specify that an area of my theme contains widgets?
- How to dequeue css files?
- How to disable thumbnail filter for a specific template part or image size?
- get_template_part() doesn’t work
- Show for a particular page ID only title and short summary
- wpautop on section
- Extract all shortcode data from post into loop variables?
- wp_nav_menu and its fallback
- registering a global template wordpress 6.0
- Copying the theme style files and images to duplicate the website but with a difference
- reduce duplicate code in wordpress
- Assign custom classes to the divs inside the loop
- How to set Post meta-box defaults based on the choices made by user in Customizer?
- Theme Action to hook for one time only function [duplicate]
- Proper way to move a Bootstrap site to WordPress [closed]
- Theme development: How to add CSS classes to menu items?
- Woocommerce Product attribute not imported with wordpress Importer [closed]
- HTTP Error when uploading images over specific dimensions
- iPad WordPress theme?
- Adding link post format to theme and permalink to rss feed
- custom Background not showing after upgrade?
- How do I assign a particular post to a particular page in WordPress?
- Rolling your own WordPress Themes
- What are the permalinks options for “Category” base and removing it?
- Designing a custom archive.php inspired by the Autofocus theme
- Is a site with 1,500 pages, (1000 of which are E-Commerce Pages) Too Big to Migrate to WordPress?
- How to get blog-id of an MU site from functions.php
- Does single webpage do not need navigation to create a slug in permalink?
- Posts Page shows Classic Editor interface not Gutenberg
- Comment Form Development Issue
- Removing element from DOM with jquery through plugin Custom Scripts for Customizer
- WordPress theme doesn’t read my translations from pt_BR.po file
- Get gallery images description not work for some images id
- How to load jQuery with Ajax in WP version 5.3.2?
- How to get full native language instead of iso?
- Move the social media icons to the left of a WordPress nav menu for Soledad child Theme
- Is a multipurpose theme an alternative to modifying or creating a theme from scratch?
- Two instances of the theme folder in the URL
- I want to change the author name
- Does any JavaScript file load automatically for index.php file?
- WordPress menu walker – Get parent item text inside end_lvl function
- Display content on Single page
- WordPress Ajax Spitting out a page as a response?
- Filter URL and shortcodes from the_excerpt
- Check if redirected from a specific page template
- Postname permalink page not found error
- Horizontal Navigation
- Trouble creating custom sanitization function when uploading video files
- How to store and retrieve the attachment alignment?
- What’s the policy for building a theme that doesn’t support widgets/menus?
- Incorporate zilla shortcode into theme
- Custom image size doesn’t work
- Paginated WP_Query doesn’t return 404’s, even when posts don’t exist
- The content not wrapped in paragraph tags with get_page_by_title()
- How to assign the default file at “Appearance > Editor”?
- Not Found when using activity stream as front page with BuddyPress
- Import/Export WordPress demo
- Creating custom function in wordpress to return data from database
- How customizable is a self-hosted WordPress blog compared to a Blogger blog?
- Why we do need wp_enqueue_script() function?
- Is it possible to use “wordpress.org Theme Handbook” look&feel as a theme in my own site? [closed]
- getting id of page
- sanitize_option_{$option} filter returns null
- WP Customizer get control value on change
- Execute javscript when theme customizer loads (autosave issue)
- How to set the margin on an innerBlock in a block variation?
- Does a custom WordPress theme require updates to it’s source code?
- New directory created each time I upload new theme zip
- WordPress theme.json: Why doesn’t “contentSize” work
- Which is recommended to learn first: classic themes or block themes?
- WP “optimizing” PNGs into thumbnails 5X larger than originals – FIX
- Disable interactivity for core navigation
- WordPress function::: get_header();