Make WordPress Core

Opened 7 years ago

Closed 7 years ago

Last modified 5 years ago

#9650 closed defect (bug) (fixed)

attribute_escape() shortcuts

Reported by: ryan Owned by:
Milestone: 2.8 Priority: normal
Severity: normal Version:
Component: Formatting Keywords: security i18n
Focuses: Cc:

Description (last modified by ryan)

attribute_escape() is often forgotten on value attributes, especially on translated messages. Maybe some shortcuts would improve adoption. Use esc() as shorthand for atribute_escape() and add _e_esc() and _t_esc() which run translations through attribute_escape(), thus avoiding the need to do this: echo attribute_escape( __('Translated string') )

Attachments (2)

9650.diff (4.5 KB) - added by ryan 7 years ago.
9650 .patch (3.6 KB) - added by hakre 7 years ago.

Download all attachments as: .zip

Change History (23)

#1 @ryan
7 years ago

  • Component changed from General to Formatting
  • Keywords security i18n added
  • Owner anonymous deleted

#2 @ryan
7 years ago

  • Description modified (diff)

#3 @ryan
7 years ago

_a(), _ea(), _xa() are other suggestions.

7 years ago

#4 @ryan
7 years ago

(In [11103]) attr(), _a(), _ea(), _xa() for shorthand attribute escaping. see #9650

#5 @Denis-de-Bernardy
7 years ago

thank you. you've just made coding shorter to write. :-)

#6 @ryan
7 years ago

(In [11104]) Some attr escaping. see #9650

#7 @ryan
7 years ago

(In [11109]) s/attribute_escape/attr/. see #9650

#8 @ryan
7 years ago

(In [11110]) attr escaping. see #9650

#9 @Simek
7 years ago

akismet.php file form Akismet Plugin also need to be updated.

#10 @Denis-de-Bernardy
7 years ago

  • Milestone changed from Unassigned to 2.8

7 years ago


#11 @markjaquith
7 years ago

I find this to be harder to remember. My inclination would be to standardize the function names but keep them memorable and more obvious.

Here is my suggestion:

  • __ = translate return suffix
  • _e = translate echo suffix

Stick all escaping functions into an "esc" class.


  • attr()
  • url()
  • js()
  • html()
  • sql()

html(), js(), attr() would have __ and _e suffix versions too.

So it would look like:

esc::[context][optional translation suffix]( $input, [optional translation domain]);


<a href="<?php echo esc::url( $my_url ); ?>"><?php esc::html_e( 'My translatable string' ); ?></a>

It's still shorter, but it's obvious that escaping is going on, and which context is being used. People already know __() and _e() so we keep those as suffixes. This also puts all our escaping in one place, so that curious people can look there to see which contexts they should be escaping but might not be.

#12 @ryan
7 years ago

Let's do it.

#13 @ryan
7 years ago

xgettext might not like that format though.

#14 @ryan
7 years ago

I can't get xgettext to recognize anything with a ::

#15 @Denis-de-Bernardy
7 years ago

mm... in that case we'd want to use straight functions instead: esc_html_e(), etc.

#16 @link2caro
7 years ago

  • Cc tran.minhquan@… added

keep _e and at the beginning for better auto-completion if straight functions are used

#17 @link2caro
7 years ago



#18 @markjaquith
7 years ago

(In [11204]) _a(), _ea(), _xa(), attr() are now esc_attr(), esc_attr_e(), esc_attr_x(), esc_attr() -- still short, but less cryptic. see #9650

#19 @markjaquith
7 years ago

link2caro, considered that, but _eattr_esc() isn't very clear. The leading underscore makes it ideal as a suffix. Also:




Maps well.

#20 @Viper007Bond
7 years ago

Let's not forget about js_escape(). Worth renaming to esc_js() or similar?

See also: #7648

#21 @ryan
7 years ago

  • Resolution set to fixed
  • Status changed from new to closed
Note: See TracTickets for help on using tickets.