';
echo ent2ncr( $text ); // Bad
echo number_format( 1024 );
echo ent2ncr( esc_html( $_data ) );
echo $foo ? $foo : 'no foo'; // Bad
echo empty( $foo ) ? 'no foo' : $foo; // Bad
echo $foo ? esc_html( $foo ) : 'no foo'; // OK
echo 4; // OK
exit( $foo ); // Bad
exit( esc_html( $foo ) ); // OK
die( $foo ); // Bad
die( esc_html( $foo ) ); // OK
printf( 'Hello %s', $foo ); // Bad
printf( 'Hello %s', esc_html( $foo ) ); // OK
printf( 'Hello %s! Hi %s!', esc_html( $foo ), $bar ); // Bad
vprintf( 'Hello %s', array( $foo ) ); // Bad
vprintf( 'Hello %s', array( esc_html( $foo ) ) ); // OK
// The below checks that functions which are marked as needed further sanitization
// don't spill over into later arguments when nested in a function call. There was
// a bug which would cause line 84 to be marked as needing sanitization because _x()
// is marked as needing sanitization.
do_something(
_x( 'Some string', 'context', 'domain' )
, array( $foo ) // OK
);
// There was a bug where an empty exit followed by other code would give an error.
if ( ! defined( 'ABSPATH' ) ) {
exit; // OK
} else {
other();
}
printf(
/* translators: this comment is just for you. */
esc_html__( 'Hello %s.', 'domain' )
, 'world'
// There were other long arguments down here "in real life", which is why this was multi-line.
);
wp_die( $message ); // Bad
wp_die( esc_html( $message ) ); // OK
wp_die( esc_html( $message ), $title ); // Bad
wp_die( esc_html( $message ), esc_html( $title ) ); // OK
wp_die( esc_html( $message ), '', array( 'back_link' => true ) ); // OK
wp_die( esc_html( $message ), '', array( 'back_link' => false ) ); // OK
wp_die( esc_html( $message ), '', array( 'response' => 200 ) ); // OK
echo '
', esc_html( $foo ), '
'; // OK
echo 'a', 'b'; // OK
echo 'Hello, ', $foo; // Bad
echo esc_html( $foo ), $bar; // Bad
echo (int) $foo, $bar; // Bad
echo (int) get_post_meta( $post_id, SOME_NUMBER, true ), do_something( $else ); // Bad
wp_die( -1 ); // OK
?>
' . sprintf( esc_html__( 'Some text -> %sLink text%s', 'textdomain' ), '', '' ). ''; // OK
echo ' ' . sprintf( esc_html__( 'Found %d results', 'textdomain' ), (int) $result_count ) . '
'; // OK
echo sprintf( 'Hello %s', $foo ); // Bad
echo sprintf( 'Hello %s', esc_html( $foo ) ); // OK
echo sprintf( 'Hello %s! Hi %s!', esc_html( $foo ), $bar ); // Bad
echo vsprintf( 'Hello %s', array( $foo ) ); // Bad
echo vsprintf( 'Hello %s', array( esc_html( $foo ) ) ); // OK
echo sprintf( __( 'Welcome to Genesis %s', 'genesis' ), PARENT_THEME_BRANCH ); // Bad x 2
echo sprintf( esc_html__( 'Welcome to Genesis %s', 'genesis' ), esc_html( PARENT_THEME_BRANCH ) ); // OK
echo esc_html( strval( $_var ) ? $_var : gettype( $_var ) ); // OK
echo ( $is_hidden ) ? ' style="display:none;"' : ''; // OK
echo sprintf( 'Howdy, %s', esc_html( $name ? $name : __( 'Partner' ) ) ); // OK
_e( 'Something' ); // Bad
esc_html_e( 'Something' ); // OK
echo $something // Bad
. esc_attr( 'baz-' // Rest is OK
. $r
. ( $r === $active_round ? ' foo' : '' )
. ( $r < $active_round ? ' bar' : '' )
) . 'something';
echo implode( ' ', $items ); // Bad
echo implode( ' ', urlencode_deep( $items ) ); // OK
echo implode( ' ', array_map( 'esc_html', $items ) ); // OK
echo implode( ' ', array_map( 'foo', $items ) ); // Bad
echo join( ' ', $items ); // Bad
echo join( ' ', array_map( 'esc_html', $items ) ); // OK
echo '';