# Using esc() and html()

**URL:** https://forum.getkirby.com/t/using-esc-and-html/29412
**Category:** Questions
**Created:** [August 31, 2023, 9:53pm UTC](https://forum.getkirby.com/t/using-esc-and-html/29412 "2023-08-31T21:53:16Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Dawidasam](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Dawidasam](https://forum.getkirby.com/u/Dawidasam)
#### Post date: [August 31, 2023, 9:53pm UTC](https://forum.getkirby.com/t/using-esc-and-html/29412/1 "2023-08-31T21:53:16Z")

</div>

hi can someone explain to me when to use esc() and html().

Is it worth adding esc() always to texts entered in HTML tags using kirby?

---

<div class="post-metadata">

### Author: ![lukasbestle](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/lukasbestle/32/11437_2.png) [@lukasbestle](https://forum.getkirby.com/u/lukasbestle)
#### Post date: [September 1, 2023, 5:20am UTC](https://forum.getkirby.com/t/using-esc-and-html/29412/2 "2023-09-01T05:20:34Z")

</div>

I depends on your threat model. If you cannot fully trust the value (for example because it comes from user input or because there might be attackers under the authenticated Panel users), we definitely recommend to use `esc()`.

You can read more in the guide:

> **[Escaping content](https://getkirby.com/docs/guide/templates/escaping)**
>
> Not all content you render in your templates or snippets can be trusted. For example, it may come from user-generated content like a registration or comment form. Or you might use content from …

---

<div class="post-metadata">

### Author: ![Dawidasam](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Dawidasam](https://forum.getkirby.com/u/Dawidasam)
#### Post date: [September 1, 2023, 7:40am UTC](https://forum.getkirby.com/t/using-esc-and-html/29412/3 "2023-09-01T07:40:56Z")

</div>

Ok thanks
