WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my wordpress site I have a hack that looks at the uri and does a redirect to a subdomain. The problem is wp_redirect calls wp_sanitize_redirect which will strip out @ signs, so when a user tries to load something like


The page that gets loaded should be


but instead it's

prefix.oursite.com?email=foobar.com (i.e. - no @ sign)

The problem is easy to work around - I just manually encode @ signs as %40 before calling wp_redirect.

Question: why does wp_sanitize_redirect strip out @ signs, exactly? Anybody could anyway try to load a url with an @ sign in it - is there some security issue I'm not thinking about?

EDIT: The function I'm talking about is wp_sanitize_redirect

share|improve this question
I've never seen a function called wp_sanitize_url(). Could you please point to the core file, where it is defined? Thanks. – kaiser Sep 11 '12 at 14:06
My bad, I mean wp_sanitize_redirect. – PapaFreud Sep 11 '12 at 16:26
up vote 1 down vote accepted

Question why does wp_sanitize_redirect strip out @ signs, exactly? Anybody could anyway try to load a url with an @ sign in it - is there some security issue I'm not thinking about?

Just take a look at the source:

function wp_sanitize_redirect($location) {
    $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!]|i', '', $location);
    $location = wp_kses_no_null($location);

    // remove %0d and %0a from location
    $strip = array('%0d', '%0a', '%0D', '%0A');
    $location = _deep_replace($strip, $location);
    return $location;

So the only characters, the preg_replace allows are

  • lower case a-z
  • numbers
  • and ~+_.?#=&;,/:%!.

What does that mean for URIs and URLs?

The php function urlencode() replaces all no alpha-numeric chararcters, except -_. with a % (percent) character followed by two hexdecimal values and spaces with a +. If you use rawurlencode(), it also strips the +. As you can see from the preg_replace(), it allows all URL encoded/prepared characters, so it's safe to throw such encoded characters/URL parts into the game.

share|improve this answer
Right, I see what the regexp is doing, I was wondering why. I mean, why does it not url encode characters rather than strip them out? And is it safe to just url encode @ signs as %40 and then call wp_redirect? Maybe this was a silly question. – PapaFreud Sep 12 '12 at 5:28
Yes, it works - see edit. – kaiser Sep 12 '12 at 10:38
Well I know it works, I mean... oh, never mind. Accepted. Thanks for the trouble. – PapaFreud Sep 12 '12 at 11:58

Just wanted to follow up on my own findings. This happened to me if I was leaving out the last / in my URLs. Doing so caused WP to call func:redirect_canonical which stripped out the @ symbols. When I added the last / it did not call this function and the @ symbol remained.

A good plugin for debugging redirects is: Debug WP Redirect

Example 1 which fails:

Original URL: www.domain.com/somepage?email=me@me.com

Final URL : www.domain.com/somepage/?email=meme.com

Example 2 which works:

Original URL: www.domain.com/somepage/?email=me@me.com

Final URL : www.domain.com/somepage/?email=me@me.com

share|improve this answer
Is this an actual answer that helps the OP to solve the problem? – kaiser Nov 4 '14 at 14:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.