<div dir="ltr">One thing to note with `<span style="font-family:arial,sans-serif;font-size:13px">sanitize_hex_color()` is that it is only available when the Customizer is loaded. You cannot use it outside of that context because the file that contains the function definition is not loaded.</span></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 3, 2014 at 8:56 AM, Srikanth Koneru <span dir="ltr"><<a href="mailto:tskk79@gmail.com" target="_blank">tskk79@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Color value will be used within <style></style><br></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Fri, Oct 3, 2014 at 9:18 PM, Otto <span dir="ltr"><<a href="mailto:otto@ottodestruct.com" target="_blank">otto@ottodestruct.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr">Maybe, maybe not. Depends on how and where it's being used.<div><br></div><div>Sanitizing or validating values on input is to make sure that the input is what you expect. If it's a hex color, then you want it to fit the pattern of a hex color, so that's why the <span style="font-family:arial,sans-serif;font-size:13px">sanitize_hex_color() function exists.</span></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">But when you're putting it back in a document, as output, then you're not verifying what the value is, but actually making sure that it is properly escaped for the context in which you are outputting it. If you were outputting it to an HTML attribute, then you'd actually want to use esc_attr(). If you were putting it in a URL (maybe as a query parameter appended on the end of it), then the whole URL should be passed through esc_url(). If it's going into some javascript, then esc_js() perhaps.</span></div><div><br></div><div><span style="font-family:arial,sans-serif;font-size:13px">Remember, you're not concerned with what it "is" when creating the output, but more with where that output is going to be located.</span></div><span><font color="#888888"><div><br></div></font></span><div class="gmail_extra"><span><font color="#888888"><div>-Otto</div></font></span><div><div>
<div class="gmail_extra"><br></div><div class="gmail_extra"><br></div><br><div class="gmail_quote">On Fri, Oct 3, 2014 at 10:38 AM, Ulrich Pogson <span dir="ltr"><<a href="mailto:grapplerulrich@gmail.com" target="_blank">grapplerulrich@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Yes, that would make sense to reuse <span style="font-family:arial,sans-serif;font-size:13px"><a href="https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp-customize-manager.php#L1221" target="_blank">sanitize_hex_color</a>()</span>. </div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On 3 October 2014 17:04, Srikanth Koneru <span dir="ltr"><<a href="mailto:tskk79@gmail.com" target="_blank">tskk79@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Probably good time to ask which function should I use to esc the color value I get from customizer via get_theme_mod?<br></div>Should I simply reuse the <span> sanitize_hex_color?</span></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 3, 2014 at 7:41 PM, priyanshu mittal <span dir="ltr"><<a href="mailto:priyanshu.mittal@gmail.com" target="_blank">priyanshu.mittal@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div>HI Ulrich <br><br><br></div>Thanks for the answer. I will ask users to do this as a required one.<br><br></div>Thanks<span><font color="#888888"><br></font></span></div><span><font color="#888888">Priyanshu<br></font></span></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 3, 2014 at 7:39 PM, Ulrich Pogson <span dir="ltr"><<a href="mailto:grapplerulrich@gmail.com" target="_blank">grapplerulrich@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">It is required to escape all data before being outputted anywhere in the theme. Security is the top priority.</div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On 3 October 2014 15:51, priyanshu mittal <span dir="ltr"><<a href="mailto:priyanshu.mittal@gmail.com" target="_blank">priyanshu.mittal@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Here is my ticket url: <a href="https://themes.trac.wordpress.org/ticket/21002" target="_blank">https://themes.trac.wordpress.org/ticket/21002</a><br><br></div><div>I have already sanitized the favicon url before saving it to the database.<br><br></div><div>My Question is do I still need to call the esc_url while outputing it in the html. Is this required or recommended.<br><br></div><div>The main reason I am asking is because recently I am also reviewing a theme which has similar type of code format.<br><br></div><div>So required or recommended?<br><br><br></div><div>Thanks<span><font color="#888888"><br>Priyanshu<br></font></span></div><div><br></div><br></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 3, 2014 at 6:57 PM, Justin Tadlock <span dir="ltr"><<a href="mailto:justin@justintadlock.com" target="_blank">justin@justintadlock.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>We would never have anything so specific as to use `esc_url()` in the guidelines. You'd need to use the most appropriate function for the job. If dealing with URLs, `esc_url()` will usually be your best bet. Questions such as this are better handled by looking at the specific case though. Generic answers/solutions are rarely a good idea when talking about sanitizing, validating, and/or escaping.</div><div><br></div><div>Here's the guideline:</div><div><br></div><div>"Themes are required to validate and sanitize all untrusted data before entering data into the database, and to escape all untrusted data before being output in the Settings form fields or in the Theme template files (see: Data Validation)"</div><div><br></div><div>See: <a href="https://make.wordpress.org/themes/handbook/guidelines/theme-security-and-privacy/" target="_blank">https://make.wordpress.org/themes/handbook/guidelines/theme-security-and-privacy/</a></div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div>On Fri, Oct 3, 2014 at 8:04 AM, priyanshu mittal <span dir="ltr"><<a href="mailto:priyanshu.mittal@gmail.com" target="_blank">priyanshu.mittal@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr"><div><div><div>Hi<br><br></div>Is that mandatory to use esc_url in the themes. If yes can you provide me the link where it has been mentioned.<br><br></div>Thanks<span><font color="#888888"><br></font></span></div><span><font color="#888888">Priyanshu<br></font></span></div>
</div></div></blockquote></div></div></blockquote></div></div></div></div></blockquote></div></div></div></div></blockquote></div></div></div></div></blockquote></div></div></div></div></blockquote></div></div></div></div></blockquote></div><br></div></div></div></div>
<br></div></div><span class="">_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org" target="_blank">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></span></blockquote></div><br></div>
<br>_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></blockquote></div><br></div>