{"action":"created","issue":{"url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/379","labels_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/379/labels{/name}","comments_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/379/comments","events_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/379/events","html_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/379","id":73467023,"number":379,"title":"Question: Escaping when string is HTML attributes and values string?","user":{"login":"GaryJones","id":88371,"avatar_url":"https://avatars.githubusercontent.com/u/88371?v=3","gravatar_id":"","url":"https://api.github.com/users/GaryJones","html_url":"https://github.com/GaryJones","followers_url":"https://api.github.com/users/GaryJones/followers","following_url":"https://api.github.com/users/GaryJones/following{/other_user}","gists_url":"https://api.github.com/users/GaryJones/gists{/gist_id}","starred_url":"https://api.github.com/users/GaryJones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GaryJones/subscriptions","organizations_url":"https://api.github.com/users/GaryJones/orgs","repos_url":"https://api.github.com/users/GaryJones/repos","events_url":"https://api.github.com/users/GaryJones/events{/privacy}","received_events_url":"https://api.github.com/users/GaryJones/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":{"login":"JDGrimes","id":4005415,"avatar_url":"https://avatars.githubusercontent.com/u/4005415?v=3","gravatar_id":"","url":"https://api.github.com/users/JDGrimes","html_url":"https://github.com/JDGrimes","followers_url":"https://api.github.com/users/JDGrimes/followers","following_url":"https://api.github.com/users/JDGrimes/following{/other_user}","gists_url":"https://api.github.com/users/JDGrimes/gists{/gist_id}","starred_url":"https://api.github.com/users/JDGrimes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JDGrimes/subscriptions","organizations_url":"https://api.github.com/users/JDGrimes/orgs","repos_url":"https://api.github.com/users/JDGrimes/repos","events_url":"https://api.github.com/users/JDGrimes/events{/privacy}","received_events_url":"https://api.github.com/users/JDGrimes/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-05-05T23:59:15Z","updated_at":"2015-05-06T03:57:59Z","closed_at":null,"body":"The Genesis Framework has a `genesis_attr()` function which outputs ultimately outputs a string of HTML attribute and values. It is used like:\r\n\r\n~~~php\r\nprintf( '<div %>', genesis_attr( 'some-context' ) );\r\n~~~\r\n\r\nThat is currently flagged as `WordPress.XSS.EscapeOutput.OutputNotSanitized`.\r\n\r\nGoing on the assumption that this is NOT a false positive, how should the second arg be escaped?"},"comment":{"url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/comments/99314315","html_url":"https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/379#issuecomment-99314315","issue_url":"https://api.github.com/repos/WordPress-Coding-Standards/WordPress-Coding-Standards/issues/379","id":99314315,"user":{"login":"westonruter","id":134745,"avatar_url":"https://avatars.githubusercontent.com/u/134745?v=3","gravatar_id":"","url":"https://api.github.com/users/westonruter","html_url":"https://github.com/westonruter","followers_url":"https://api.github.com/users/westonruter/followers","following_url":"https://api.github.com/users/westonruter/following{/other_user}","gists_url":"https://api.github.com/users/westonruter/gists{/gist_id}","starred_url":"https://api.github.com/users/westonruter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/westonruter/subscriptions","organizations_url":"https://api.github.com/users/westonruter/orgs","repos_url":"https://api.github.com/users/westonruter/repos","events_url":"https://api.github.com/users/westonruter/events{/privacy}","received_events_url":"https://api.github.com/users/westonruter/received_events","type":"User","site_admin":false},"created_at":"2015-05-06T03:57:59Z","updated_at":"2015-05-06T03:57:59Z","body":"Add it to your project's PHPCS XML noting that `genesis_attr` is an `autoEscapedFunctions` function? Ref: https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/blob/develop/WordPress/Sniffs/XSS/EscapeOutputSniff.php#L29"}}