HTML Content Output and XSS Prevention

WordPress data escaping is crucial when displaying user-generated content, database values, or any dynamic data in HTML contexts. The primary escaping function esc_html() converts special characters to HTML entities, preventing malicious scripts from executing while preserving text content. This is essential for displaying post titles, user comments, form values, and any content that might contain HTML characters. Here are practical examples of HTML escaping in different contexts:

// Escaping post titles and content
echo '
' . esc_html(get_the_title()) . '
';
echo '
' . esc_html($user_comment) . '
';

// Escaping form input values
echo '';

// Escaping meta data
$custom_field = get_post_meta($post_id, 'custom_text', true);
echo '
' . esc_html($custom_field) . '
';

// Escaping array data
$tags = get_post_meta($post_id, 'product_tags', true);
if (is_array($tags)) {
    foreach ($tags as $tag) {
        echo '' . esc_html($tag) . '';
    }
}

URL and Link Attribute Escaping

URL escaping prevents malicious JavaScript injection through href attributes and ensures valid URL formatting. WordPress provides esc_url() for general URL escaping and esc_attr() for HTML attributes. This is particularly important when outputting user-provided URLs, dynamic links, or any URL parameters that could be manipulated. Proper URL escaping prevents JavaScript injection through href attributes and ensures cross-site scripting protection:

// Escaping URLs in links
$website_url = get_post_meta($post_id, 'website_url', true);
echo 'Visit Website';

// Escaping internal WordPress URLs
echo 'Contact Us';

// Escaping URLs with parameters
$search_term = $_GET['search'];
$search_url = add_query_arg('search', $search_term, home_url('/search/'));
echo 'Search Results';

// Escaping admin URLs
if (current_user_can('edit_posts')) {
    $edit_url = get_edit_post_link($post_id);
    echo 'Edit Post';
}

// Escaping custom redirect URLs
$redirect_url = $_POST['redirect_to'];
wp_redirect(esc_url_raw($redirect_url));

Database Value and Meta Data Output

When displaying database values, custom field data, or WordPress meta information, proper escaping ensures safe output regardless of data source. This includes post meta, user meta, option values, and any stored data that will be displayed to users. Different data types require different escaping approaches based on their intended display context:

// Escaping post meta data
$product_price = get_post_meta($post_id, 'price', true);
$product_description = get_post_meta($post_id, 'description', true);
$product_url = get_post_meta($post_id, 'external_url', true);

echo '
';
echo '' . esc_html($product_price) . '';
echo '
' . esc_html($product_description) . '
';
echo 'View Product';
echo '
';

// Escaping user meta data
$user_bio = get_user_meta($user_id, 'biography', true);
$user_website = get_user_meta($user_id, 'website', true);
$user_location = get_user_meta($user_id, 'location', true);

echo '
';
echo '
' . esc_html($user_bio) . '
';
echo 'Website';
echo '' . esc_html($user_location) . '';
echo '
';

// Escaping option values
$site_footer_text = get_option('custom_footer_text');
$contact_email = get_option('contact_email');
echo '';

Translation and Internationalization Escaping

WordPress internationalization requires special escaping considerations when outputting translated strings that might contain dynamic data. Translation functions combined with escaping ensure both security and proper localization. This is crucial for multilingual sites and plugins that need to display translated content safely:

// Escaping translated strings with variables
$username = get_current_user()->display_name;
$welcome_message = sprintf(
    __('Welcome back, %s!', 'textdomain'),
    esc_html($username)
);
echo '
' . $welcome_message . '
';

// Escaping translated strings with HTML
$login_link = wp_login_url();
$login_message = sprintf(
    __('Please log in to continue.', 'textdomain'),
    esc_url($login_link)
);
echo '
' . $login_message . '
';

// Escaping pluralized translations
$comment_count = get_comments_number();
$comment_text = sprintf(
    _n(
        '%s comment',
        '%s comments',
        $comment_count,
        'textdomain'
    ),
    number_format_i18n($comment_count)
);
echo '' . esc_html($comment_text) . '';

// Escaping admin notice translations
function display_admin_notice() {
    $message = __('Settings saved successfully!', 'textdomain');
    echo '
' . esc_html($message) . '
';
}

Official WordPress Documentation:

WordPress Data Escaping – Comprehensive official guide to WordPress data escaping and output security

WordPress Escaping Functions – Complete reference of WordPress escaping functions

WordPress Security Handbook – Official WordPress security documentation including escaping best practices

WordPress Coding Standards – Official WordPress development standards including security practices

Escaping Function Reference:

esc_html() – Escapes HTML blocks and inline elements

esc_attr() – Escapes HTML attributes

esc_url() – Checks and cleans URLs for display

esc_js() – Escapes text strings for echoing in JavaScript

esc_textarea() – Escapes text for textarea display

wp_kses() – Filters text content and strips disallowed HTML