David Biňovec

@rmccue thank you for ticketing this. I was just about to look into this issue but can not reproduce it. (I was testing it agains random themes). Could you, pls,...

@gudmdharalds could you look into this?

@gudmdharalds could you look into this?

I have a patch for review & testing in D69021-code . Would appreciate some eyes and testing on it, before deploying.

We could check via sniff whether there is an open HTML attribute prior `esc_js`, and if not, it's in 99% of cases wrongly used function.

Some more context also containing code examples can be found here: https://vip.wordpress.com/documentation/vip-go/vip-code-review/javascript-security-best-practices/#escaping-dynamic-javascript-values Some other examples can be found in comments in the WordPress documentation for the `esc_js` function: https://developer.wordpress.org/reference/functions/esc_js/ `esc_js`...

> There is another sniff - which IIRC is included in WPCS - which checks the closing brace. Oh, it does not seem to kick-in then :) Also, I might...

Thank you for following up!

Good point @westonruter , thanks ! I'll poke around more before acting on this.

Hey @GaryJones ! Again, sorry for not being clear. I meant that we should be catching stuff like this: ```