esc_js( string $text ): string
- Since
- 2.8.0
- Source
wp-includes/formatting.php:4723
", <, >, &, and fixes line endings.Description
Escapes text strings for echoing in JS. It is intended to be used for inline JS (in a tag attribute, for example onclick="..."). Note that the strings have to be in single quotes. The 'js_escape' filter is also applied here.
Compatibility
- WordPress
- since 2.8.0
- PHP
- 7.4–8.6-dev
- 6.7.7
- 6.8.8
- 6.9.7
- 7.0.4
- 7.1.0
Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.
Parameters
$textstring- The text to be escaped.
Return value
string- Escaped text.
Performance profile
How much work a call to esc_js() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.
- Cost class
- Moderate
- Scaling
- Constant
- Instructions
- 31
- Plugin surface
- 1 hook
- Called by
- 21
Reads stored settings via get_option(), cached per request but not free on a cold cache.
No loop in the body: the same number of instructions runs whatever you pass in.
Executed per call on PHP 8.5. The body compiles to 31.
Third-party callbacks on 'js_escape' run inside this call, and their cost is not bounded by anything here.
21 places in core call this, so the cost is paid more often than your own code shows.
What it touches
- hookthird-party callbacks
apply_filters()called directly - optionoption read or write
get_option()one call below esc_js()
Further down the call graph this can also reach cache, serialize, query and transient. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.
What one call costs · 1 distinct outcome
One number would be a lie: the work depends on which branch runs. These are every distinct cost esc_js() can have, taken from its control-flow graph on PHP 8.5.
| When | Instructions | Calls it makes |
|---|---|---|
| always | 31 | wp_check_invalid_utf8(), _wp_specialchars(), stripslashes(), addslashes(), apply_filters() |
Across PHP versions
| PHP | Compiled | Executed | Branches | Notes |
|---|---|---|---|---|
| 8.6-dev | 31 | 31 | 0 | |
| 8.5 | 31 | 31 | 0 | 1 more instruction than PHP 8.4 |
| 8.4 | 30 | 30 | 0 | 9 fewer instructions than PHP 8.3 |
| 8.3 | 39 | 39 | 0 | |
| 8.2 | 39 | 39 | 0 | |
| 8.1 | 39 | 39 | 0 | |
| 7.4 | 39 | 39 | 0 |
An instruction is not a fixed amount of time, so a matching count is not necessarily the same speed; what it rules out is a difference in the work itself.
Hooks and filters fired · 1
One hook fires while esc_js() runs, in this order:
- apply_filters( js_escape )filterline 4740 (+17 into the body)
Filters a string cleaned and escaped for output in JavaScript.
Uses · 3
- wp_check_invalid_utf8()Checks for invalid UTF8 in a string.
- _wp_specialchars()Converts a number of special characters into their HTML entities.
- apply_filters()Calls the callback functions that have been added to a filter hook.
Used by · 21
- Bulk_Upgrader_Skin::after()Performs an action following a bulk update.
- Bulk_Upgrader_Skin::before()Performs an action before a bulk update.
- Bulk_Upgrader_Skin::error()Displays an error message about the update.
- Custom_Image_Header::js_1()Displays JavaScript based on Step 1 and 3.
- WP_Admin_Bar::_render_item()
- WP_Customize_Site_Icon_Control::content_template()Renders a JS template for the content of the site icon control.
- WP_Links_List_Table::handle_row_actions()Generates and displays row action links.
- WP_Themes_List_Table::display_rows()Generates the list table rows.
- _thickbox_path_admin_subfolder()Prints thickbox image paths for Network Admin.
- dismissed_updates()Display dismissed updates.
- iframe_header()Generic Iframe header for use with Thickbox.
- js_escape()Escape single quotes, specialchar double quotes, and fix line endings.
Show all 21
- link_submit_meta_box()Displays link create form fields.
- sanitize_bookmark_field()Sanitizes a bookmark field.
- sanitize_post_field()Sanitizes a post field based on context.
- sanitize_term_field()Sanitizes the field value in the term based on the context.
- sanitize_user_field()Sanitizes user field based on context.
- wp_default_packages_vendor()Registers all the WordPress vendor scripts that are in the standardized `js/dist/vendor/` location.
- wp_iframe()Outputs the iframe to display the media upload page.
- wp_print_media_templates()Prints the templates used in the media manager.
- wp_save_image()Saves image to post, along with enqueued changes in `$_REQUEST['history']`.
Source code
function esc_js( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $safe_text = _wp_specialchars( $safe_text, ENT_COMPAT ); $safe_text = preg_replace( '/&#(x)?0*(?(1)27|39);?/i', "'", stripslashes( $safe_text ) ); $safe_text = str_replace( "\r", '', $safe_text ); $safe_text = str_replace( "\n", '\\n', addslashes( $safe_text ) ); /** * Filters a string cleaned and escaped for output in JavaScript. * * Text passed to esc_js() is stripped of invalid or special characters, * and properly slashed for output. * * @since 2.0.6 * * @param string $safe_text The text after it has been escaped. * @param string $text The text prior to being escaped. */ return apply_filters( 'js_escape', $safe_text, $text );}Changelog
Introduced in 2.8.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
About this page
- Parsed data
- Generated from the wordpress-develop 7.1.0 tag, from
src/wp-includes/formatting.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it. - Corrections
- Something wrong on this page? Report it and it gets fixed in the next regeneration.