Security Notes
Security considerations for wpzylos-views.
This is critical. Views render HTML. Improper escaping leads to XSS vulnerabilities.
Output Escaping Rules
Escape ALL dynamic output. No exceptions.
| Context | Function | Example |
|---|---|---|
| HTML text | esc_html() | <?php echo esc_html($title); ?> |
| Attributes | esc_attr() | <input value="<?php echo esc_attr($value); ?>"> |
| URLs | esc_url() | <a href="<?php echo esc_url($link); ?>"> |
| JavaScript | esc_js() | onClick="alert('<?php echo esc_js($msg); ?>')" |
| Textarea | esc_textarea() | <textarea><?php echo esc_textarea($text); ?></textarea> |
| HTML content | wp_kses_post() | <?php echo wp_kses_post($content); ?> |
Common XSS Vulnerabilities
Unescaped Output
// Bad: XSS vulnerability
<h1><?php echo $title; ?></h1>
// $title could be: <script>stealCookies()</script>
// Good: Escaped
<h1><?php echo esc_html($title); ?></h1>
Attribute Injection
// Bad: Attribute injection
<input value="<?php echo $value; ?>">
// $value could be: " onmouseover="stealData()
// Good: Escaped
<input value="<?php echo esc_attr($value); ?>">
URL Injection
// Bad: JavaScript URL injection
<a href="<?php echo $url; ?>">Link</a>
// $url could be: javascript:stealCookies()
// Good: Escaped (blocks javascript: URLs)
<a href="<?php echo esc_url($url); ?>">Link</a>
Template Checklist
- All text output uses
esc_html() - All attribute values use
esc_attr() - All URLs use
esc_url() - User HTML uses
wp_kses_post()orwp_kses() - No raw
echo $variable;anywhere