I’m looking through _s (underscores) starter theme and see that they’re using esc_html for nearly everything. Just an example from functions.php
register_nav_menus( array(
'primary' => esc_html__( 'Primary', '_s' ),
) );
register_sidebar( array(
'name' => esc_html__( 'Sidebar', '_s' ),
'id' => 'sidebar-1',
'description' => esc_html__( 'Add widgets here.', '_s' ),
'before_widget' => '<section id="%1$s" class="widget %2$s">',
'after_widget' => '</section>',
'before_title' => '<h2 class="widget-title">',
'after_title' => '</h2>',
) );
My current understanding of esc_html is to use it when we output either data from the database or user input.
Why escape the names of the menu and sidebar?
It’s only available to people that have access to the php files and it doesn’t appear to be put into the db. I looked through the db and couldn’t find anything related to the names, please correct me if I’m wrong.
Is the underscores theme just being overly cautious about everything?
Thanks