WordPress Security in WordPress - Escaping
Syntax
- esc_html( string $text )
- esc_url( string $url, array $protocols, string $_context )
- esc_js( string $text )
- wp_json_encode( mixed $data, int $options, int $depth = 512 )
- esc_attr( string $text )
- esc_textarea( string $text )
Remarks
Security should be always in mind when developing. Without security an app is open to various attacks such as SQL Injections, XSS, CSRF, RFI etc that can lead to serious problems.
Untrusted data comes from many sources (users, third party sites, your own database!, ...) and all of it needs to be validated both on input and output. (Source: WordPress Codex)
The data should be validated, sanitized or escaped depending the use and the purpose.
To validate is to ensure the data you've requested of the user matches what they've submitted. (Source: WordPress Codex)
Sanitization is a bit more liberal of an approach to accepting user data. We can fall back to using these methods when there's a range of acceptable input. (Source: WordPress Codex)
To escape is to take the data you may already have and help secure it prior to rendering it for the end user. (Source: WordPress Codex)
