{"action":"created","issue":{"url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/677","repository_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards","labels_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/677/labels{/name}","comments_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/677/comments","events_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/677/events","html_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/677","id":174454250,"number":677,"title":"Expected next thing to be sanitization explanation","user":{"login":"dingo-d","id":8638515,"avatar_url":"https://avatars.githubusercontent.com/u/8638515?v=3","gravatar_id":"","url":"https://api.github.com/users/dingo-d","html_url":"https://github.com/dingo-d","followers_url":"https://api.github.com/users/dingo-d/followers","following_url":"https://api.github.com/users/dingo-d/following{/other_user}","gists_url":"https://api.github.com/users/dingo-d/gists{/gist_id}","starred_url":"https://api.github.com/users/dingo-d/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dingo-d/subscriptions","organizations_url":"https://api.github.com/users/dingo-d/orgs","repos_url":"https://api.github.com/users/dingo-d/repos","events_url":"https://api.github.com/users/dingo-d/events{/privacy}","received_events_url":"https://api.github.com/users/dingo-d/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-01T07:24:13Z","updated_at":"2016-09-01T13:36:51Z","closed_at":null,"body":"I need a bit of clarification on this one. I have, in my theme, an input field for a breadcrumbs title that I can set in my page metabox, and I am outputting it like this\r\n\r\n```\r\n<?php echo ( ! empty( $my_bc_title ) ) ? wp_kses( $my_bc_title, allowed_tags() ) : get_the_title(); ?>\r\n```\r\n\r\nThe `allowed_tags()` is just a function with allowed tags array. Now, the issue is probably in the fact that after `echo` everything should be sanitized, but I'm just checking if the variable is empty, and then basically sanitize it with `wp_kses()`, and `get_the_title()` function should be safe. \r\n\r\nAlso what If I sanitize it beforehand with `esc_html()`, when pulling it out of post custom field?\r\n\r\nShould I ignore these kind of errors or?\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/comments/244080596","html_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/677#issuecomment-244080596","issue_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/677","id":244080596,"user":{"login":"JDGrimes","id":4005415,"avatar_url":"https://avatars.githubusercontent.com/u/4005415?v=3","gravatar_id":"","url":"https://api.github.com/users/JDGrimes","html_url":"https://github.com/JDGrimes","followers_url":"https://api.github.com/users/JDGrimes/followers","following_url":"https://api.github.com/users/JDGrimes/following{/other_user}","gists_url":"https://api.github.com/users/JDGrimes/gists{/gist_id}","starred_url":"https://api.github.com/users/JDGrimes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JDGrimes/subscriptions","organizations_url":"https://api.github.com/users/JDGrimes/orgs","repos_url":"https://api.github.com/users/JDGrimes/repos","events_url":"https://api.github.com/users/JDGrimes/events{/privacy}","received_events_url":"https://api.github.com/users/JDGrimes/received_events","type":"User","site_admin":false},"created_at":"2016-09-01T13:36:51Z","updated_at":"2016-09-01T13:36:51Z","body":"Can you post the actual error that you are getting? I'm not sure why this would be flagged for sanitization, since it is generating output, not working with direct user input. Any error would be about *escaping*, I'd expect, not sanitization. \r\n\r\n\r\n\r\n> Also what If I sanitize it beforehand with esc_html(), when pulling it out of post custom field?\r\n\r\nAnd what if you didn't? Just by looking at that line of code, there is no way to know. The sniff is based on the principle of late escaping, which means that you escape the value just before you use it. That way there is never any question about whether the value is safe or not. A developer can look at the code and see at a glance that the value has been escaped, and automated tools like WPCS can also see this more easily as well.\r\n\r\n\r\n\r\n> Should I ignore these kind of errors or?\r\n\r\nNo. But if you don't understand why a particular line of code is getting flagged, you are right to ask us about it, because maybe it is a bug. :-)"}}
{"actor":{"display_login":"JDGrimes"}}