I know about the XSS issue related to add_query_arg()function. That is why I am wrapping it with esc_url().

Problem is...this is not working with wp_remote_get().

If I go:

$url = add_query_arg( array( 'email' => 'myadress@mail.com', 
'token' => '899A762614F6C49809A374FB955EC8C15'),
'https://example.com/v3/transactions/notifications/3FF732-68B436B43622-3664083FB82B-CFB043' );
$response = wp_remote_get( $url );

I am getting a valid body response.

But if I use esc_url on the $url:

$url = esc_url(add_query_arg( array( 'email' => 'myadress@mail.com', 
'token' => '899A762614F6C49809A374FB955EC8C15'),
'https://example.com/v3/transactions/notifications/3FF732-68B436B43622-3664083FB82B-CFB043' ));
$response = wp_remote_get( $url );

The body response is "Unauthorized".

And the strange part: both codes echo the same string for $url!!!

Now what?


And the strange part: both codes echo the same string for $url!!!

No, they don't. Look at the page source. esc_url() is encoding the & control character. You can't do that and expect the HTTP request to work correctly.

Use esc_url_raw() instead. Note the description in the Codex concerning that function:

The esc_url_raw() function is similar to esc_url() (and actually uses it), but unlike esc_url() it does not replace entities for display. The resulting URL is safe to use in database queries, redirects and HTTP requests.

| improve this answer | |
  • Yes, the source code showed that, in fact. And I didn't know about esc_url_raw(). Thanks for that! – Luis Rock May 5 '15 at 0:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.