WordPress has a number of built-in validation/sanitization functions. However, as we see, there are two kinds of such group:
My Question: Are
esc_* functions enough safe in WordPress?
I mean, in such cases:
echo '<input type="hidden" name="orderby" value="' . esc_attr( $_REQUEST['search_term'] ) . '" />';
is that safe enough, or we should still use extra sanitization, like:
sanitize_title(esc_attr( $_REQUEST['search_term'] ))