Yup.

p() => print encoded to prevent XSS
print_unescaped => print as is

If youre not using characters which will get encoded always use p(). You
can easily test this using echo(htmlentities("blah"));

Sent from mobile device