Recommendation: Escaping Translated Strings

[sakinshrestha]

• All translation functions must be escaped as sometimes an improper translation may break the html.
• E.g:
  • Almost all instances of __()/_e() need to be esc_html__()/esc_html_e()
    • 404.php line 17 becomes
      <h1 class="entry-title"><?php esc_html_e( 'Oops! That page can&rsquo;t be found.', 'memberlite' ); ?></h1>
  • esc_attr__() where used as attribute values
  • pass via wp_kses() if some html elements are required
• Check all files as there are a lot of these unescaped translation functions

[pbrocks]

Root files addres in PR

[pbrocks]

Balance addressed here PR

[ideadude]

Thanks