If I register a post type then which escaping should I use for escaping label?

function book_setup_post_type() {
    $args = array(
        'public'    => true,
        'label'     => __( 'Books', 'textdomain' ),
        'menu_icon' => 'dashicons-book',
    );
    register_post_type( 'book', $args );
}
add_action( 'init', 'book_setup_post_type' );

If I register a post type then which escaping should I use for escaping label?

function book_setup_post_type() {
    $args = array(
        'public'    => true,
        'label'     => __( 'Books', 'textdomain' ),
        'menu_icon' => 'dashicons-book',
    );
    register_post_type( 'book', $args );
}
add_action( 'init', 'book_setup_post_type' );

• custom-post-types
• translation

Share Improve this question edited Feb 24, 2020 at 11:26 fuxia♦ 107k3939 gold badges255255 silver badges459459 bronze badges asked Feb 24, 2020 at 10:55 Akhtarujjaman ShuvoAkhtarujjaman Shuvo 20811 silver badge66 bronze badges 1

• For securing output you should just do alright with esc_html() and if it's gonna be translation ready you would be better off using esc_html_e() or esc_html__(). For your ref: developer.wordpress/themes/theme-security/… – Kumar Commented Feb 24, 2020 at 12:23

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 1

None. Escaping should happen late, on output. This is just registering the strings for later use, so it's too early to escape. All the places in WordPress where the post type label is used automatically, WordPress should already be escaping it.

If you're outputting any of the labels yourself, you would probably use esc_html():

$post_type_object = get_post_type_object( 'book' );
$post_type_labels = get_post_type_labels( $post_type_object );

echo esc_html( $post_type_labels->singular_name );