Security Notes

Security considerations for wpzylos-views.

This is critical. Views render HTML. Improper escaping leads to XSS vulnerabilities.

Output Escaping Rules

Escape ALL dynamic output. No exceptions.

ContextFunctionExample
HTML textesc_html()<?php echo esc_html($title); ?>
Attributesesc_attr()<input value="<?php echo esc_attr($value); ?>">
URLsesc_url()<a href="<?php echo esc_url($link); ?>">
JavaScriptesc_js()onClick="alert('<?php echo esc_js($msg); ?>')"
Textareaesc_textarea()<textarea><?php echo esc_textarea($text); ?></textarea>
HTML contentwp_kses_post()<?php echo wp_kses_post($content); ?>

Common XSS Vulnerabilities

Unescaped Output

// Bad: XSS vulnerability
<h1><?php echo $title; ?></h1>

// $title could be: <script>stealCookies()</script>

// Good: Escaped
<h1><?php echo esc_html($title); ?></h1>

Attribute Injection

// Bad: Attribute injection
<input value="<?php echo $value; ?>">

// $value could be: " onmouseover="stealData()

// Good: Escaped
<input value="<?php echo esc_attr($value); ?>">

URL Injection

// Bad: JavaScript URL injection
<a href="<?php echo $url; ?>">Link</a>

// $url could be: javascript:stealCookies()

// Good: Escaped (blocks javascript: URLs)
<a href="<?php echo esc_url($url); ?>">Link</a>

Template Checklist

  • All text output uses esc_html()
  • All attribute values use esc_attr()
  • All URLs use esc_url()
  • User HTML uses wp_kses_post() or wp_kses()
  • No raw echo $variable; anywhere