WordPress Output Escaping Cheat Sheet

// HTML context — use for any text displayed in HTML.
echo esc_html( $user_input );

// Attribute context — use inside HTML attributes.
echo '';

// URL context — use for href, src, action attributes.
echo '';

// JavaScript context — use inside inline JS.
echo '';

// Rich HTML — allows safe tags (p, br, strong, em, a, etc.).
echo wp_kses_post( $editor_content );

// Custom allowed HTML tags.
echo wp_kses( $content, array(
    'a'      => array( 'href' => true, 'title' => true, 'rel' => true ),
    'strong' => array(),
    'em'     => array(),
) );

// Translation + escape in one call.
esc_html_e( 'Settings saved.', 'theme-domain' );
echo esc_html__( 'Hello, %s', 'theme-domain' );