Question: I have this code:

```
the_content( sprintf(
                __( 'Continue reading %s', 'twentyfifteen' ),
                the_title( '<span class="screen-reader-text">', '</span>', false )
            ) );

```

How to escape the code above for security issue? I have been using the code below to fix issues:

```
<?php echo esc_html(get_the_title()) ; ?>

```

Answer: 
`the_title()`, `the_excerpt()` and `the_content()` are not escaped (`the_content()` does a little string replacing) and this can cause security issues for example when an editor has installed malicious browser extensions.

The correct approach is to wrap the `get_*` versions of these functions into `esc_html_e()` (which runs esc\_html(), translates through the text domain, and echo's the result), so in your case:

`<?php esc_html_e(get_the_content($more_link_text, $strip_teaser)); ?>`
From the [WP Codex](https://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data):

> 
> It's important to note that most WordPress functions properly prepare the data for output, and you don't need to escape again.
> 
> 
> 

So for this function you don't have to escape `the_title()` again because this function does it already by itself.

For all other Escaping/Sanitizing needs, look [here](https://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data).