This function displays or returns the unescaped title of the current post. This tag may only be used within The Loop, to get the title of a post outside of the loop use get_the_title. If the post is protected or private, this will be noted by the words “Protected: ” or “Private: ” prepended to the title.
Security considerations
Like the_content() , the output of the_title() is unescaped. This is considered a feature and not a bug, see the FAQ “Why are some users allowed to post unfiltered HTML?” . If the post title is , then that JavaScript code will be run wherever the_title() is used. For this reason, do not write code that allows untrusted users to create post titles.
