Title: Standardizing and shortening the WP secu…
Author: Mark Jaquith
Published: May 5, 2009

---

 [  ](https://profiles.wordpress.org/markjaquith/) [Mark Jaquith](https://profiles.wordpress.org/markjaquith/)
9:16 pm _on_ May 5, 2009     
Tags: [API ( 14 )](https://make.wordpress.org/core/tag/api/),
[escaping ( 3 )](https://make.wordpress.org/core/tag/escaping/), [security ( 18 )](https://make.wordpress.org/core/tag/security/)

# Standardizing and shortening the WP secu…

Standardizing and shortening the WP security escaping functions.

`attribute_escape()` is now `esc_attr()`

Additionally, you can do attribute escaping and translationtranslation The process(
or result) of changing text, words, and display formatting to support another language.
Also see [localization](https://make.wordpress.org/core/2009/05/05/standardizing-and-shortening-the-wp-secu/?output_format=md#l10n),
[internationalization](https://make.wordpress.org/core/2009/05/05/standardizing-and-shortening-the-wp-secu/?output_format=md#i18n).
in one go. Just add the translation function to the end. Like so:

 * `esc_attr__()` — translate and return, attribute-escaped.
 * `esc_attr_e()` — translate and echo, attribute-escaped.

Will be following up with `esc_html` (with `__()` and `_e()` variants), `esc_url()`,
maybe some more. Will be nice, short, predictable, and allow you do translate/escape
in one go without a lot of nested parenthesis.

[#api](https://make.wordpress.org/core/tag/api/), [#escaping](https://make.wordpress.org/core/tag/escaping/),
[#security](https://make.wordpress.org/core/tag/security/)

### Share this:

 * [  Threads ](https://make.wordpress.org/core/2009/05/05/standardizing-and-shortening-the-wp-secu/?share=threads)
 * [  Mastodon ](https://make.wordpress.org/core/2009/05/05/standardizing-and-shortening-the-wp-secu/?share=mastodon)
 * [  Bluesky ](https://make.wordpress.org/core/2009/05/05/standardizing-and-shortening-the-wp-secu/?share=bluesky)
 * [  X ](https://make.wordpress.org/core/2009/05/05/standardizing-and-shortening-the-wp-secu/?share=x)
 * [  Facebook ](https://make.wordpress.org/core/2009/05/05/standardizing-and-shortening-the-wp-secu/?share=facebook)
 * [  LinkedIn ](https://make.wordpress.org/core/2009/05/05/standardizing-and-shortening-the-wp-secu/?share=linkedin)

 1. ![](https://secure.gravatar.com/avatar/ef73577d17a0d9172d1413a78897d21e3e23a9c1179a52cc14b2362382844b87?
    s=32&d=mm&r=g)
 2.  [Viper007Bond](http://www.viper007bond.com/)  5:04 am _on_ May 6, 2009
 3. An `esc_js()` or whatnot might be useful to (i.e. an improved `js_escape()` (see
    [#7648](https://core.trac.wordpress.org/ticket/7648)).
 4.  * ![](https://secure.gravatar.com/avatar/4633f38c261350c7ae7834b5de1017a11a237b8219c72e9115e50feaa69b90be?
       s=32&d=mm&r=g)
     *  [Mark Jaquith](http://markjaquith.com/)  5:58 am _on_ May 6, 2009
     * Yes, I meant to include that in the list of “coming soon” ones. Though `js_escape()`
       would continue to work, as would `attribute_escape()` and `wp_specialchars()`.
     * Improvements to `esc_js()` née `js_escape()` are a separate issue — I’ll take
       a look at that ticketticket Created for both bug reports and feature development
       on the bug tracker..
 5. Pingback: [WordPress News: BuddyPress News, WordPress 2.8 News, WordCamp Toronto & Virginia, WordPress.tv Feeds, and More | The Blog Herald](http://www.blogherald.com/2009/05/08/wordpress-news-buddypress-news-wordpress-28-news-wordcamp-toronto-virginia-wordpresstv-feeds-and-more/)
 6. ![](https://secure.gravatar.com/avatar/8dc47f82471b83a569ebfac28da590b24d58421d4a537fe2be19fcd485bc487f?
    s=32&d=mm&r=g)
 7.  [Leandro Vieira Pinho](http://leandrovieira.com)  3:11 am _on_ May 9, 2009
 8. Why not escape_attr than esc_attr?. Write escape is more intuitive than esc.

Comments are closed.

# Post navigation

[← Going through some of the accessibility …](https://make.wordpress.org/core/2009/05/03/going-through-some-of-the-accessibility/)

[Trying to keep the commit candidates und… →](https://make.wordpress.org/core/2009/05/11/trying-to-keep-the-commit-candidates-und/)