WordPress.org
Get WordPress

Make WordPress Core

Changes between Initial Version and Version 1 of Ticket #51159, comment 4


Ignore:
Timestamp:
11/04/2025 04:12:40 PM (10 months ago)
Author:
jonsurrell

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #51159, comment 4

    initial v1  
    99-----
    1010
    11 [=#mostly-fine '''1:'''] `esc_url()` will not "double escape" HTML character references, so if the JSON contains the text `&` it will remain unchanged and decode to a plain `&` in the attribute value instead of being escaped as `&`. It's likely better to use an alternative that always escapes, but `esc_url()` is sufficient for illustration.
     11[=#mostly-fine '''1:'''] `esc_attr()` will not "double escape" HTML character references, so if the JSON contains the text `&` it will remain unchanged and decode to a plain `&` in the attribute value instead of being escaped as `&`. It's likely better to use an alternative that always escapes, but `esc_url()` is sufficient for illustration.