php - How to correctly escape an echo

admin管理员组

文章数量:1200995

In WordPress they recommend that I should escape any part of the code of my plugin that shows data to the user, I have made most of the corrections but this specific case I don't know how to escape that echo. Please help.

<option value="">
    <?php _e( '- Default', MF_TEXT_DOMAIN ); ?>
</option>
<?php foreach ( $folders as $folder ) {
    $folder = trim( $folder );
    echo "<option value=\"{$folder}\">{$folder}</option>";
} ?>

In WordPress they recommend that I should escape any part of the code of my plugin that shows data to the user, I have made most of the corrections but this specific case I don't know how to escape that echo. Please help.

<option value="">
    <?php _e( '- Default', MF_TEXT_DOMAIN ); ?>
</option>
<?php foreach ( $folders as $folder ) {
    $folder = trim( $folder );
    echo "<option value=\"{$folder}\">{$folder}</option>";
} ?>

• php
• plugin-development
• security
• escaping

Share Improve this question edited Apr 21, 2022 at 8:02 cjbj 15k1616 gold badges4242 silver badges8989 bronze badges asked Apr 21, 2022 at 7:21 choseɳchoseɳ 1766 bronze badges

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 1

Escaping is only necessary when you have no full control of the the thing you are echoing. So as long as $folder is a variable that you have defined yourself, there's no real need to escape. But if there is user input involved, there is esc_html, to be used as follows:

echo esc_html ("this input string contains a > character");

In this case, however, more drastic measures may be needed, because there can be no html tags at all inside option tags, so you add wp_strip_all_tags like this:

$folder = wp_strip_all_tags ($folder);
echo esc_html ("<option value=\"{$folder}\">{$folder}</option>");

UPDATE (thanks to Kero in the comments for noticing the error)

$folder = esc_html (wp_strip_all_tags ($folder));
echo "<option value=\"{$folder}\">{$folder}</option>";

本文标签： phpHow to correctly escape an echo