When working with themes and plugins, it’s a common practice to escape WordPress data. Honestly, this is a standard practice in all web development:
Whenever you’re retrieving information from the database to display to the user, it should be validated and escaped so that nothing but clean, readable text is rendered to the user.
In WordPress, you’re likely to see this in one of two ways (or maybe both ways depending on your setup):
- You’re retrieving information from the database via
get_optionand then displaying it to the user. - You’re retrieving information from the cache and displaying it to the user.
There may be other ways that you’re grabbing the information, but the specifics beyond what’s above are outside the purpose and scope of this post.
Instead, the point I’m working towards is that we should escape WordPress data in the context of a template file or a view rather than in the context of a function.


