Skip to content

Adding esc_attr exemple and talk about escaping a textarea #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Adding esc_attr exemple and talk about escaping a textarea #1

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8c68378
Update escaping-output.md
Jun 12, 2016
9af09ff
Merge pull request #1 from MaximeCulea/escaping-textarea
Jun 12, 2016
486ae6b
Update escaping-output.md
Jun 12, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion security/escaping-output.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,9 @@ WordPress thankfully has a few helper functions we can use for most of what we

`esc_attr()` can be used on everything else that's printed into an HTML element's attribute.

@todo example for esc_attr()
```
<a href="#" class="<?php echo esc_attr( implode( ', ', $custom_classes ) ); ?>">Click me</a>
```

It's important to note that most WordPress functions properly prepare the data for output, and you don't need to escape again.

Expand All @@ -39,6 +41,14 @@ It's important to note that most WordPress functions properly prepare the data f

@todo include note of wp_post_kses()

Special case when working on *textarea*. While applying wp_kses will delete <br /> html tag and newlines will not be preserved, there is a trick to do it.

```
<div class="excerpt">
echo trim( str_replace( '%newline%', '<br />', wp_kses( str_replace( '<br />', '%newline%', $string ), '' ) ) );
</div>
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MaximeCulea I'm not sure I agree with this necessarily. Why not use wp_post_kses() ?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@danielbachhuber, I didn't found wp_post_kses().
So if using wp_kses, it delete the
html which will break new lines.

```

### Conclusion

Whenever you're rendering data from the database, you'll want to make sure it's properly escaped. Escaping helps prevent issues like cross-site scripting.