Much related to sanitizing everything, all variables that are echoed need to be escaped, so it can't hijack admin screens. There are many esc_*() functions you can use to make sure you don't show people the wrong data.
This is true for all $-variables, as it's possible that an XSS vulnerability in another plugin, or a MITM (Man in the Middle) attack, could subvert your data. It's doubly important when you're echoing content on the back-end of WordPress, as those are regularly targeted for exploits. By escaping, you ensure that you have future-proofed your plugin and protected your users.
Also keep in mind that sometimes a function is echoing when it should really be returning content instead. This is a common mistake when it comes to returning JSON encoded content. Very rarely is that actually something you should be echoing at all. Echoing is because it needs to be on the screen, read by a human. Returning (which is what you would do with an API) can be json encoded, though remember to sanitize when you save to that json object!
smileBeda
commented
3 years ago
Much related to sanitizing everything, all variables that are echoed need to be escaped, so it can't hijack admin screens. There are many
esc_*()functions you can use to make sure you don't show people the wrong data.This is true for all $-variables, as it's possible that an XSS vulnerability in another plugin, or a MITM (Man in the Middle) attack, could subvert your data. It's doubly important when you're echoing content on the back-end of WordPress, as those are regularly targeted for exploits. By escaping, you ensure that you have future-proofed your plugin and protected your users.
Also keep in mind that sometimes a function is echoing when it should really be returning content instead. This is a common mistake when it comes to returning JSON encoded content. Very rarely is that actually something you should be echoing at all. Echoing is because it needs to be on the screen, read by a human. Returning (which is what you would do with an API) can be json encoded, though remember to sanitize when you save to that json object!
There are a number of options to secure all types of content (html, email, etc). Yes, even HTML needs to be properly escaped. https://developer.wordpress.org/plugins/security/securing-output/
Remember: You must use the most appropriate functions for the context. If you’re outputting HTML, use esc_html(), and so on.
Example(s) from your plugin: