[wp-trac] [WordPress Trac] #57133: $type should be escaping in 'user-new.php'

[WordPress Trac]

#57133: $type should be escaping in 'user-new.php'
---------------------------+-----------------------------------------------
 Reporter:  monzuralam     |       Owner:  (none)
     Type:  defect (bug)   |      Status:  new
 Priority:  normal         |   Milestone:  Awaiting Review
Component:  Users          |     Version:  trunk
 Severity:  normal         |  Resolution:
 Keywords:  has-patch      |     Focuses:  administration, coding-standards
  2nd-opinion              |
---------------------------+-----------------------------------------------
Changes (by peterwilsoncc):

 * keywords:  has-patch close 2nd-opinion => has-patch 2nd-opinion


Comment:

 My inclination is to add the escaping as a defensive coding measure.

 While the variables are set to values that do not require escaping
 currently, this may change in the future so it would be good to protect
 core contributors from their future selves.

 My personal approach is to escape anything that is a variable:

 {{{#!php
 <?php
 // Needs escaping
 $attr = __( 'Attribute value' );
 ?>
 <div data-attr="<?php echo esc_attr( $attr ); ?>"></div>
 <?php

 // Does not need escaping
 ?>
 <div data-attr="<?php echo __( 'Attribute value' ); ?>"></div>
 }}}

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/57133#comment:7>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform