Every earlier lesson's code examples already used esc_html(), esc_attr(), and esc_url() without fully explaining why. This lesson covers the reason directly: escaping is what stands between a theme and a genuinely serious security hole.
Any value that ultimately comes from user input — a custom field, a comment, a URL parameter, a title someone typed into the editor — could theoretically contain HTML or JavaScript instead of plain text. Echo it straight into a page without escaping, and that code doesn't just display as text; it executes. That's a Cross-Site Scripting (XSS) vulnerability, and it's the single most common security issue in hand-written WordPress themes.
Escaping converts a value into a form that's always safe to display in a specific context — the function to use depends entirely on where the value is going:
| Function | Use for |
|---|---|
esc_html() | Plain text between HTML tags — <p><?php echo esc_html( $x ); ?></p> |
esc_attr() | A value inside an HTML attribute — alt="<?php echo esc_attr( $x ); ?>" |
esc_url() | A URL, in an href or src |
wp_kses_post() | Content that's allowed to contain some HTML (bold, links, and so on) — used for rich content like the_content(), which handles this internally already |
<a href="<?php echo esc_url( $link ); ?>" title="<?php echo esc_attr( $title ); ?>">
<?php echo esc_html( $label ); ?>
</a>This has been the pattern all along
Every single one of these functions is used correctly in every code example across this entire section, on purpose — go back and look at any of them again with this in mind, and the pattern (escape everything, choose the function by context) is already there, repeated dozens of times.
The one common exception: values that came from your own code, never from any kind of input — a hardcoded string, a number from count(). Escaping those isn't wrong, just unnecessary. When in doubt about where a value originated, escape it; the cost of an unneeded esc_html() call is nothing, and the cost of a missing one on real user input is a security bug.
With output secured, the next lesson collects a handful of smaller, genuinely useful functions.php utilities that come up in almost every real theme build.