Security Notes
Security considerations for wpzylos-i18n.
Translation Output
Always Escape Translated Text
Translations could contain malicious content from .mo files:
// Bad: Unescaped translation
echo $translator->__('Welcome');
// Good: Escaped for HTML
echo esc_html($translator->__('Welcome'));
// Good: For attributes
echo '<input placeholder="' . esc_attr($translator->__('Search')) . '">';
Placeholders
Use Sprintf Safely
// Bad: Direct interpolation
echo $translator->sprintf(__('Hello %s'), $userInput);
// Good: Escape the substituted value
echo $translator->sprintf(
__('Hello %s'),
esc_html($userInput)
);