Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Discovered esc_url today while customizing an _s theme. I understand what the function does (sanitizes the URL inside), but what I'm unsure of is the scope of its use.

It makes sense to me that if I'm accepting a URL input from a user, that I'd use this. But when I was looking at a function that displayed the entry's meta info (see it here...line 129 at the moment), it used esc_url, which doesn't make sense to me.

If I'm working on a theme, do I need to be escaping ANY URL that I put in my template files?

share|improve this question

1 Answer 1

Those function are used to produce a valid HTML and not to sanitize input. You should use them anytime you are not 100% sure that what you want to output is a valid HTML for that context.

Should you escape everything? I guess the _s theme people decided that it is better to be safe then sorry, and there is some logic to that.

share|improve this answer
    
Thanks for your response! The documentation says that it should always be used when sanitizing URLs; that's why I thought it was for sanitizing. –  Brendan Mar 4 '13 at 16:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.