> %s', bayleaf_get_icon( [ 'icon' => 'tags' ] ) ); // WPCS xss ok. 'bayleaf_get_icon' returns escaped value. echo $bayleaf_tags_list; // WPCS xss ok. Contains HTML, other values escaped. ?>