8

This thing makes my coding difficult. Wordpress codex reasons the use of esc_url by talking vaguely about security. But is it really worth the trouble?

For example, what's the important, practical security benefit by using

<?php echo esc_url( home_url( '/' ) ); ?>

instead of

<?php echo home_url() ?>

PS: I am not talking about theme development, but about a specific site.

10

If you check the documentation on Data Validation it has following to say about the function:

Always use esc_url when sanitizing URLs (in text nodes, attribute nodes or anywhere else). Rejects URLs that do not have one of the provided whitelisted protocols [...], eliminates invalid characters, and removes dangerous characters.

There you have it — practical security benefit. Valid protocol, no murky characters.

The answer about necessity is firmly yes. Escaping output is the most basic security practice.

  • 2
    With all due respect, I can not see how the home link for example can pose a security risk. Maybe these guidelines are for theme creation and do not apply for "private" code? After all, it may be best to hardcode the home address and other links in html and not use php at all if there are security risks? – IXN Sep 12 '15 at 21:23
  • 9
    It is vastly more productive to apply security practices consistently and universally, than debate if each and every case is worth it. :) – Rarst Sep 12 '15 at 22:40
  • 5
    On the other hand a resource suggested by Codex establishes Rule No. 3: Trust WordPress. This seems to recommend against oversanitizing wp core functions like home_url(), if used in their proper context. According to this recommendation, I would have expected home_url to perform its own sanitization. – Franco Jun 11 '17 at 9:37
2

Another things must be keep in your head about esc_url() is for something like <a href="SANITIZE_THIS_URL">your_text</a>.if you’re going to use the URL in your HTML output, like a href attribute for a link, or a src attribute for an image element, you should use esc_url().

esc_url_raw()is for other cases where you want a clean URL, but you don’t want HTML entities to be encoded. So any non-HTML usage (DB, redirect) would use this.

The esc_url_raw() function will do pretty much the same as esc_url(), but it will not decode entities, meaning it will not replace & with &#038 and so on. As Mark pointed out, it’s safe to use esc_url_raw() in database queries, redirects and HTTP functions, such as `wp_remote_get()' for more info about esc_url_raw()

1

esc_url is used to produce a valid HTML (not to sanitize input). You should use this anytime you are not 100% sure that what you want to output is a valid HTML for that context.

  • All family of escaping functions are explicitly for sanitizing. – Rarst Sep 12 '15 at 20:29
1

well, all user input should be sanitized... If the url you inject is not user input (e.g. site setting, by someone you trust!) then you may relief yourself from esc-url.

but if I could inject that url to your site, i could easily inject js code, or redirection code... or even server side code in some situations.

this can lead to session hijacking and your users accounts being stolen.

please reformat my post.

  • 2
    "Site setting by someone you trust" is still literally user input. :) – Rarst Sep 13 '15 at 15:57
  • @Rarst yeah, I am with you, but he was so "disgusted" by using esc_url, I have been bit more forgiving. – Tomer W Sep 13 '15 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.