coding-standards
coding-standards copied to clipboard
Unescaped translations are not flagged by 'HM' standards
Unescaped output from WordPress translation functions is not being flagged by the full HM standards checks.
The HM-Minimum standard allows the use of unescaped translation functions (see HM-Minimum/ruleset.xml#L57-L66). The minimum standards are then imported into HM standards (HM/ruleset.xml#L12-L13), but there are no other rules in the HM standard that check the output of these functions is escaped.
The following code should pass HM-Minimum, but fail HM. Currently, it passes both.
echo __( 'This should error', 'err' );