wppaste
WordPress

esc_html( string $text ): string

Since
2.8.0
Source
wp-includes/formatting.php:4673

Escape a string for HTML output with esc_html(), converting angle brackets, ampersands, and quotes to entities so untrusted text cannot inject markup. Available since WordPress 2.8.0, it validates the string as UTF-8 and passes the result through the esc_html filter before returning it.

Escaping for HTML blocks.

Parameters

$textstring

Return

string

Examples

Every example is editable and runs in a real WordPress booted in your browser by WordPress Playground. Press Run, then edit the code: clicking away re-runs it. Nothing is sent anywhere until you do.

Print an untrusted value inside an HTML element

Anything that came from a form, a URL or the database is untrusted at the point it is printed.

update_post_meta( 2, 'company_name', 'Acme <script>alert(1)</script> Ltd' );

$company = get_post_meta( 2, 'company_name', true );

echo "raw:     ", $company, "\n";
echo "escaped: ", esc_html( $company );

Escape at the point of output, not when saving, so the stored value stays intact.

Escape a translated string on output

Translations load from external files, so escape them like any other untrusted input (the esc_html__() shorthand combines both steps).

$heading = __( 'Recent projects', 'mytheme' );
echo '<h2>' . esc_html( $heading ) . '</h2>';

// Equivalent one-liner:
echo '<h2>' . esc_html__( 'Recent projects', 'mytheme' ) . '</h2>';

esc_html() is for text between tags only; inside attribute values use esc_attr(), and for href/src values use esc_url().

Hooks fired · 1

One hook fires while esc_html() runs, in this order:

  1. apply_filters( esc_html )filterline 4687 (+14 into the body)

    Filters a string cleaned and escaped for output in HTML.

Uses · 3

Used by · 50

Show all 50

Source

View on Trac View on GitHub 

function esc_html( $text ) {	$safe_text = wp_check_invalid_utf8( $text );	$safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );	/**	 * Filters a string cleaned and escaped for output in HTML.	 *	 * Text passed to esc_html() is stripped of invalid or special characters	 * before output.	 *	 * @since 2.8.0	 *	 * @param string $safe_text The text after it has been escaped.	 * @param string $text      The text prior to being escaped.	 */	return apply_filters( 'esc_html', $safe_text, $text );}

History

Introduced in 2.8.0. Unchanged from 6.7.7 through 7.1.0.

  1. 6.7.7
  2. 6.8.8
  3. 6.9.7
  4. 7.0.4
  5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data
Generated from the wordpress-develop 6.8.8 tag, from src/wp-includes/formatting.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.
Corrections
Something wrong on this page? Report it and it gets fixed in the next regeneration.