wp-includes/formatting.php:4673Escape a string for HTML output with esc_html(), converting angle brackets, ampersands, and quotes to entities so untrusted text cannot inject markup. Available since WordPress 2.8.0, it validates the string as UTF-8 and passes the result through the esc_html filter before returning it.
Escaping for HTML blocks.
$textstringstringEvery example is editable and runs in a real WordPress booted in your browser by WordPress Playground. Press Run, then edit the code: clicking away re-runs it. Nothing is sent anywhere until you do.
Anything that came from a form, a URL or the database is untrusted at the point it is printed.
update_post_meta( 2, 'company_name', 'Acme <script>alert(1)</script> Ltd' );
$company = get_post_meta( 2, 'company_name', true );
echo "raw: ", $company, "\n";
echo "escaped: ", esc_html( $company );Escape at the point of output, not when saving, so the stored value stays intact.
Translations load from external files, so escape them like any other untrusted input (the esc_html__() shorthand combines both steps).
$heading = __( 'Recent projects', 'mytheme' );
echo '<h2>' . esc_html( $heading ) . '</h2>';
// Equivalent one-liner:
echo '<h2>' . esc_html__( 'Recent projects', 'mytheme' ) . '</h2>';esc_html() is for text between tags only; inside attribute values use esc_attr(), and for href/src values use esc_url().
One hook fires while esc_html() runs, in this order:
Filters a string cleaned and escaped for output in HTML.
function esc_html( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES ); /** * Filters a string cleaned and escaped for output in HTML. * * Text passed to esc_html() is stripped of invalid or special characters * before output. * * @since 2.8.0 * * @param string $safe_text The text after it has been escaped. * @param string $text The text prior to being escaped. */ return apply_filters( 'esc_html', $safe_text, $text );}Introduced in 2.8.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/formatting.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.