Saturday, January 28, 2023
HomeWordPress DevelopmentEscaping get_option( 'time_format' ) is nesserary?

Escaping get_option( ‘time_format’ ) is nesserary?


Must you escape these?

$date_format="Y/m/d";
$time_format = get_option( 'time_format' );

No. That might be early escaping! Early escaping could be very dangerous!

Nonetheless, do you have to escape this?

echo'<td>'.$date .' '.$time.'</td>';

YES.

Escaping just isn’t about wether it is wanted or not, if you happen to ever end up saying “It should not be an issue as a result of it is all the time a” cease your self and escape.

Escaping is about imposing assumptions and expectations. Why belief that it is going to be protected when you’ll be able to escape and assure that it is protected?

This protects you in a number of methods, e.g. if you happen to use esc_html you’ve got assured the string won’t ever comprise HTML, even if you happen to make modifications sooner or later additional up, filters get added, and many others, you all the time know that it is protected since you escaped in the intervening time of output.

RELATED ARTICLES

LEAVE A REPLY

Please enter your comment!
Please enter your name here

- Advertisment -
Google search engine

Most Popular

Recent Comments