attribute_escape() shortcuts

[ryan]

attribute_escape() is often forgotten on value attributes, especially on translated messages. Maybe some shortcuts would improve adoption. Use esc() as shorthand for atribute_escape() and add _e_esc() and _t_esc() which run translations through attribute_escape(), thus avoiding the need to do this: echo attribute_escape( __('Translated string') )

[ryan]

_a(), _ea(), _xa() are other suggestions.

[ryan]

(In [11103]) attr(), _a(), _ea(), _xa() for shorthand attribute escaping. see #9650

[Denis-de-Bernardy]

thank you. you've just made coding shorter to write. :-)

[ryan]

(In [11104]) Some attr escaping. see #9650

[ryan]

(In [11109]) s/attribute_escape/attr/. see #9650

[ryan]

(In [11110]) attr escaping. see #9650

[Simek]

akismet.php file form Akismet Plugin also need to be updated.

[hakre]

Akismet

[markjaquith]

I find this to be harder to remember. My inclination would be to standardize the function names but keep them memorable and more obvious.

Here is my suggestion:

• __ = translate return suffix
• _e = translate echo suffix

Stick all escaping functions into an "esc" class.

methods:

• attr()
• url()
• js()
• html()
• sql()

html(), js(), attr() would have __ and _e suffix versions too.

So it would look like:

esc::[context][optional translation suffix]( $input, [optional translation domain]);

Example:

<a href="<?php echo esc::url( $my_url ); ?>"><?php esc::html_e( 'My translatable string' ); ?></a>

It's still shorter, but it's obvious that escaping is going on, and which context is being used. People already know __() and _e() so we keep those as suffixes. This also puts all our escaping in one place, so that curious people can look there to see which contexts they should be escaping but might not be.

[ryan]

Let's do it.

[ryan]

xgettext might not like that format though.

[ryan]

I can't get xgettext to recognize anything with a ::

[Denis-de-Bernardy]

mm... in that case we'd want to use straight functions instead: esc_html_e(), etc.

[link2caro]

keep _e and at the beginning for better auto-completion if straight functions are used

[link2caro]

sorry,

!_e()
__()

[markjaquith]

(In [11204]) _a(), _ea(), _xa(), attr() are now esc_attr(), esc_attr_e(), esc_attr_x(), esc_attr() -- still short, but less cryptic. see #9650

[markjaquith]

link2caro, considered that, but _eattr_esc() isn't very clear. The leading underscore makes it ideal as a suffix. Also:

attribute_escape(__('string'));

Becomes:

esc_attr__('string');

Maps well.

[Viper007Bond]

Let's not forget about js_escape(). Worth renaming to esc_js() or similar?

See also: #7648