wp-includes/formatting.php:4714Escape a value for use inside an HTML attribute with esc_attr(), encoding quotes and angle brackets so dynamic data cannot break out of the attribute. In core since 2.8.0; the escaped string is passed through the attribute_escape filter before it is returned.
Escaping for HTML attributes.
$textstringstringEvery example is editable and runs in a real WordPress booted in your browser by WordPress Playground. Press Run, then edit the code: clicking away re-runs it. Nothing is sent anywhere until you do.
Escape every dynamic value that ends up inside a quoted attribute, such as value, placeholder, or a class name pulled from settings.
$placeholder = get_option( 'myplugin_search_placeholder', 'Search products' );
printf(
'<input type="search" name="s" placeholder="%s" value="%s" />',
esc_attr( $placeholder ),
esc_attr( get_search_query() )
);esc_attr() only protects values inside quoted attributes; an unquoted attribute stays injectable no matter how you escape it. For href/src attributes use esc_url(), which also vets the protocol.
One hook fires while esc_attr() runs, in this order:
Filters a string cleaned and escaped for output in an HTML attribute.
function esc_attr( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES ); /** * Filters a string cleaned and escaped for output in an HTML attribute. * * Text passed to esc_attr() is stripped of invalid or special characters * before output. * * @since 2.0.6 * * @param string $safe_text The text after it has been escaped. * @param string $text The text prior to being escaped. */ return apply_filters( 'attribute_escape', $safe_text, $text );}Introduced in 2.8.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/formatting.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.