This post has two halves: what "escape your output" actually means once the obvious answer stops working, and then a study of whether current AI assistants get that harder version right. It continues a series on what coding assistants actually produce when a non-expert asks them for WordPress code.

Start with a line that passes review and still leaves a hole:

echo '<a href="' . esc_html( $url ) . '">Visit</a>';

Enter fullscreen mode

Exit fullscreen mode