' . __( 'Welcome, %s', 'my-plugin' ) . '
';\n```\n\n```php\n// ✅ Secure: escape the translated output.\nprintf( '%s
', esc_html__( 'Welcome back', 'my-plugin' ) );\n```\n\n### Mistake 7 — Redirect target not validated\n\n```php\n// ❌ Insecure: open redirect to an attacker-controlled site.\n$redirect = $_GET['redirect_to'];\nwp_redirect( $redirect );\nexit;\n```\n\n```php\n// ✅ Secure: the \"escape\" for a Location target is validation + wp_safe_redirect.\n$redirect = isset( $_GET['redirect_to'] ) ? esc_url_raw( wp_unslash( $_GET['redirect_to'] ) ) : '';\n$redirect = wp_validate_redirect( $redirect, admin_url() );\nwp_safe_redirect( $redirect );\nexit;\n```\n\n### Mistake 8 — Using wp_kses_post where a tighter allowlist is needed\n\n```php\n// ❌ Risky: wp_kses_post allows many tags you may not want in a caption.\necho wp_kses_post( $caption );\n```\n\n```php\n// ✅ Secure: define a custom allowlist when the context is narrower.\n$allowed = array(\n 'a' => array( 'href' => array() ),\n 'em' => array(),\n 'strong' => array(),\n);\necho wp_kses( $caption, $allowed );\n```\n\nRelated: see the `input-sanitization-validation` skill for validating redirect URLs on\ninput and the `filesystem-security` skill for path escaping.\n\n## Correct code examples\n\nA complete context → function reference (with `esc_url` vs `esc_url_raw`, the i18n\nvariants, and `wp_kses` allowlist usage) is in\n[`references/escaping-cheatsheet.md`](references/escaping-cheatsheet.md).\n\n```php\n// A small template snippet that escapes every dynamic value in context.\n?>\n