Iconbox shortcode why use esc_attr instead sanitize_text_field ?

Hi Enfold’s team !

I use and adapt your trick found in your forum, for change the code of the shortcode in a child theme of Enfold.

add_filter(‘avia_load_shortcodes’, ‘avia_include_shortcode_template’, 15, 1);
function avia_include_shortcode_template($paths) {
$template_url = get_stylesheet_directory();
$paths[] = $template_url.’/shortcodes/’; // for add my own shortcode
array_unshift($paths, $template_url.’/shortcodes/’); // for change iconbox.php by my custom iconbox.php
return $paths;
}

It works like a charm.

But I want to ask why in your shortcode “iconbox.php” , you have choosen the esc_attr() function for escape the attribute title, and not the sanitize_text_field() function ? Cause when you put HTML in the Title, it shows on the mouse over the title with HTML, not escaped.
I change the code with sanitize_text_field and it goes well now, the title on mouse over is escaped with no HTML tags.
I suggest you to change this in a future update.

Thx for your attention.