Automattic / Automattic/VIP-Coding-Standards

ProperEscapingFunction: flag printf() usages for placeholders being escaped incorrectly

Open
#674 5 comments 0 reactions 0 assignees View on GitHub
Type: Enhancement
Dominant language
PHP
Stars
261
Forks
44
Avg merge
19m
Merged PRs (30d)
1

Description

## Describe the solution you'd like

When `printf()` is used, we should ensure that the content in the placeholders are correctly escaped.

## What code should be reported as a violation?

```php
printf(
'%s',
esc_url( $class ), // Error.
esc_attr( $url ), // Error.
esc_attr( $content ), // Error.
);
```

```php
printf(
'%s',
esc_html__( $class, 'domain' ), // Error.
esc_url( $url ),
esc_attr_x( $content, $context, 'domain' ), // Error.
);
```

## What code should *not* be reported as a violation?

Correct usages of escaping:

```php
printf(
'%s',
esc_attr( $class ),
esc_url( $url ),
esc_html( $content )
);
```

Correct usages of escaping with translation functions:

```php
printf(
'%s',
esc_attr_x( $class, $context, 'domain' ),
esc_url( $url ),
esc_html__( $content, 'domain' )
);
```

## Additional context

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.