I see (with grep) that the value of
$element['#title'] in a render element is sometimes sanitized with
check_plain(), and sometimes printed unfiltered.
Which one is correct? Is the value considered safe to print? Or does it depend on the theme hook?
Examples from core:
modules/field/field.form.inc 314: 'data' => '<label>' . t('!title !required', array('!title' => $element['#title'], '!required' => $required)) . "</label>",
(notice the "!" in the placeholder, this means that
format_string() will not escape the placeholder value)
modules/field/field.module 1052: $variables['label'] = $variables['label_hidden'] ? NULL : check_plain($element['#title']);
This question applies in both ways:
- When setting
$element['#title']in a render element.
- When printing the value of
- When printing a
$variables['title']value that was extracted from a render element property.
Note: Very often the
$element['#title'] property comes directly from a