Csdrhrt

This isn't about what html escaping is or how it's done, but if there's an established best practice about when to do it.

I have some utility code in my plugin that may generate a WP_Error based on user input, and other display code that shows that WP_Error. Of course that user input needs to be html escaped when displaying, but I'm not sure when would be the best time to do it.

I have a choice about whether to:

• Escape the message as I'm constructing the WP_Error, and the display code shows it as-is.




• Don't worry about escaping when constructing the WP_Error, and in the display code fully escape all the WP_Error messages.

Either would work, but if my plugin ends up interacting with other plugins and possibly displaying their WP_Error or vice-versa, I'd like to match whatever precedent exists in the Wordpress world.

I had hoped the documentation would address this, but I didn't see anything on https://codex.wordpress.org/Class_Reference/WP_Error

No, escaping should happen at the moment of output ( late escaping ) so that we know that it only occurs once. Double escaping can allow specially crafted output to break out.

Since WP_Error does not output, and is not responsible for outputting, it should not perform any escaping internally, nor should its inputs be escaped. Validated/sanitised perhaps, but not escaped.

If we did escape on input, we would either have to double escape, or trust all WP_Error objects, which is a non-starter.

So instead, the code that recieves and outputs the WP_Error object is where the escaping should be, that way we escape on output safe in the knowledge that no early escaping has occurred, no double escaping happens, wether it's been escaped is not a problem we have to deal with, and the responsibility for escaping is clear and straight forward

It's a very good question.

WP_Error class doesn't do anything with messages you set. So what you set is what you get ;)

On the other hand, the error messages can contain HTML, so you can't escape all of them, when printing errors. For example here you get a message from wp-login.php file:

$errors->add('empty_username', __('<strong>ERROR</strong>: Enter a username or email address.'));

And to make things even harder - as you can see - it's passed through __() function, so after translation the message may contain even more HTML tags.

All of that means that you should take care of escaping data that may be harmful and remember that errors can contain HTML tags when printing them.

Personally, I'd keep the error messages basically plain text and static (don't include the user's input) - from what I've seen, most plugins take this mindset of error messages being short text-only notes of what has gone wrong. This allows you to use messages like "Password is too short" vs "'MyPass' is to short of a password".

If you need some HTML in the error message itself, I'd escape it on the way in.

$error = new WP_Error();



$message = "The correct tag is <strong></strong>";

$html_ok_message = htmlspecialchars($message);



$error->add($code, $html_ok_message, $data);

You could escape them on the way out if you know all the possible errors encountered have no HTML that needs to be displayed. If you escape them all always when outputting, you'll likely end up with things like <strong;Error> Something went wrong in XY_Other_plugin .