Output escaping (XSS prevention)

When to use this skill

Use this skill whenever a dynamic value is sent to the browser:

• echo / print of any variable into HTML.
• Values placed into HTML attributes (value, href, src, class, data-*).
• URLs in href / src / redirects.
• Data injected into inline <script> or JS via wp_localize_script.
• Content rendered in templates, shortcodes, blocks, widgets, REST responses that return HTML.

Escape as late as possible, at the point of output, choosing the function that matches the context the value lands in. This is separate from input sanitization — do both.

Core principles (and why they matter)