Added escaping function to p element attribute for 'dynamic' create-block template.

[ghost]

What?

This PR simply uses the wp_kses_data(); function to escape the data, as per the Phpcs WordPress Coding Standards instruction within the IDE. Probably not essential, but I was confused.

[github-actions]

👋 Thanks for your first Pull Request and for helping build the future of Gutenberg and WordPress, @lewis-elborn! In case you missed it, we'd love to have you join us in our Slack community, where we hold regularly weekly meetings open to anyone to coordinate with each other.

If you want to learn more about WordPress development in general, check out the Core Handbook full of helpful information.

[ryanwelcher]

This is a great addition! Thanks for taking the time to put it together.

[gziolo]

I’m not sure it’s necessary here. We should double-check at which stage wp_kses_data gets applied to all blocks.

[gziolo]

See:

https://github.com/WordPress/wordpress-develop/blob/9d4750abd0e72b77b015701b98f31ae77ced880b/src/wp-includes/blocks.php#L794

All blocks get automatically sanitized.

[ghost]

@gziolo, this doesn't appear to be strictly true. See #2085 in the WPCS Repo.

[Mamaduka]

I think per discussion in WordPress/WordPress-Coding-Standards#2085, the hardening should happen in get_block_wrapper_attributes.

The current assumption is that the get_block_wrapper_attributes doesn't need escaping.

[jordesign]

@lewis-elborn - just looping back to this stale PR to see if it is something you're still pursuing or if it can be closed?