Skip to content

ProperEscapingFunctionSniff doesn't catch misuse of wp_json_encode #876

@iandunn

Description

@iandunn

Bug Description

ProperEscapingFunctionSniff is a great addition to WPCS. It isn't comprehensive, though.

One specific example that I ran into is that it won't catch improper use of wp_json_encode() like it does with other functions.

Minimal Code Snippet

<!-- correctly flags esc_html as the wrong escaping function in this context -->
<img src=a onerror="<?php echo esc_html( $foo ); ?>" />

<!-- fails to catch that this is the wrong escaping function -->
<img src=a onerror="<?php echo wp_json_encode( $foo ); ?>" />

Error Code

WordPressVIPMinimum.Security.ProperEscapingFunction

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions