2

I'm making a meta box for a custom post and this meta box will contain a href value. I don't need any validation as this is a valid href value but I would like to do this in a way that's secure.

I have built my meta box with this tutorial.

In the part where to sanitize the input I have used esc_url_raw() and it seems to work just fine, but the Codex says on esc_url_raw():

This function is not safe to use for displaying the URL, use esc_url() instead

So should I use esc_url() or is there something else that I should be using and if so, why should I not use esc_url_raw() in this case?

My Code:

/* Get the posted data and sanitize it */
$new_meta_value = ( isset( $_POST['mod-modbox-link'] ) ? esc_url_raw( $_POST['mod-modbox-link'] ) : '' );

I get the URLs to pages with this:

$my_link = get_post_meta( $post->ID, 'mod_modbox_link', true );
2

Choice between esc_url and esc_url_raw depends on the use you have to do with the url.

If you have to use the url to display inside html use esc_url, E.g.:

$my_link = get_post_meta( $post->ID, 'mod_modbox_link', true );
echo '<a href="' . esc_url($my_link) . '">Open link</a>'

esc_url_raw should be used for any other use, where the url should be treated as a valid url, e.g. redirect:

$my_link = get_post_meta( $post->ID, 'mod_modbox_link', true );
wp_redirect( esc_url_raw($my_link) );

or HTTP API functions:

$my_link = get_post_meta( $post->ID, 'mod_modbox_link', true );
$response = wp_remote_get( esc_url_raw($my_link) );

This is because esc_url converts special htmlentities in their encoded versions, esc_url_raw doesn't. E.g. if your url is something like http://example.com/index.php?foo=bar&bar=baz that is a full valid url, when you use esc_url the & is converted in &#038 not when you use esc_url_raw.

Codex say to use esc_url_raw also to save url in db, and in your case the post meta is saved in database, so you should use esc_url_raw when you set the meta:

$link = isset($_POST['meta']) ? esc_url_raw($_POST['meta']) : '';
update_post_meta( $post_id, 'mod_modbox_link', $link );

Then when you retrieve it, use esc_url_raw or esc_url according to your needs: if you have to print in the html use esc_url otherwise use esc_url_raw.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.