New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Escape data at the point where it is output not before #6

Closed

westonruter opened this issue Oct 31, 2014 · 1 comment

Contributor

westonruter commented Oct 31, 2014

It’s best to do the output escaping as late as possible, ideally as it’s being outputted, as opposed to further up in your script. This way you can always be sure that your data is properly escaped and you don’t need to remember if the variable has been previously validated.

http://vip.wordpress.com/documentation/code-review-what-we-look-for/#validation-sanitization-and-escaping

Owner

kienstra commented Oct 31, 2014

You're right, I noticed that in the VIP standards. Thanks a lot for reviewing the theme.

This issue was closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment