I'm making a meta box for a custom post and this meta box will contain a href value. I don't need any validation as this is a valid href value but I would like to do this in a way that's secure.
I have built my meta box with this tutorial.
In the part where to sanitize the input I have used
esc_url_raw() and it seems to work just fine, but the Codex says on
This function is not safe to use for displaying the URL, use
So should I use
esc_url() or is there something else that I should be using and if so, why should I not use
esc_url_raw() in this case?
/* Get the posted data and sanitize it */ $new_meta_value = ( isset( $_POST['mod-modbox-link'] ) ? esc_url_raw( $_POST['mod-modbox-link'] ) : '' );
I get the URLs to pages with this:
$my_link = get_post_meta( $post->ID, 'mod_modbox_link', true );