This thing makes my coding difficult. Wordpress codex reasons the use of esc_url by talking vaguely about security. But is it really worth the trouble?

For example, what's the important, practical security benefit by using

<?php echo esc_url( home_url( '/' ) ); ?>

instead of

<?php echo home_url() ?>

PS: I am not talking about theme development, but about a specific site.

4 Answers 4


If you check the documentation on Data Validation it has following to say about the function:

Always use esc_url when sanitizing URLs (in text nodes, attribute nodes or anywhere else). Rejects URLs that do not have one of the provided whitelisted protocols [...], eliminates invalid characters, and removes dangerous characters.

There you have it — practical security benefit. Valid protocol, no murky characters.

The answer about necessity is firmly yes. Escaping output is the most basic security practice.

  • 4
    With all due respect, I can not see how the home link for example can pose a security risk. Maybe these guidelines are for theme creation and do not apply for "private" code? After all, it may be best to hardcode the home address and other links in html and not use php at all if there are security risks?
    – IXN
    Sep 12, 2015 at 21:23
  • 13
    It is vastly more productive to apply security practices consistently and universally, than debate if each and every case is worth it. :)
    – Rarst
    Sep 12, 2015 at 22:40
  • 8
    On the other hand a resource suggested by Codex establishes Rule No. 3: Trust WordPress. This seems to recommend against oversanitizing wp core functions like home_url(), if used in their proper context. According to this recommendation, I would have expected home_url to perform its own sanitization.
    – Franco
    Jun 11, 2017 at 9:37
  • Sry, I am quite new to this topic, but may anybody give an example, where home_url() or maybe get_permalink() (where as far as I know esc_url() should be used too) returns an invalid or unsanitized (?) url? I don't want to be lazy or stubborn, therefore an example might help me understand the usage.
    – SunnyRed
    Jul 25, 2022 at 19:01

Another things must be keep in your head about esc_url() is for something like <a href="SANITIZE_THIS_URL">your_text</a>.if you’re going to use the URL in your HTML output, like a href attribute for a link, or a src attribute for an image element, you should use esc_url().

esc_url_raw()is for other cases where you want a clean URL, but you don’t want HTML entities to be encoded. So any non-HTML usage (DB, redirect) would use this.

The esc_url_raw() function will do pretty much the same as esc_url(), but it will not decode entities, meaning it will not replace & with &#038 and so on. As Mark pointed out, it’s safe to use esc_url_raw() in database queries, redirects and HTTP functions, such as `wp_remote_get()' for more info about esc_url_raw()


well, all user input should be sanitized... If the url you inject is not user input (e.g. site setting by someone you fully trust, hardcoded values) then you may relief yourself from esc-url.

but if I could inject that url to your site, i could easily inject js code, or redirection code... or even server side code in some situations.

this can lead to session hijacking and your users accounts being stolen and other bad options.


In your example esc_url( home_url( '/' ) );
it operated on a semi-hardcoded value! therefore esc_url can be eliminated.
That said I still don't see why bother distinctions between when there is a threat and when there is not and generally would suggest to keep esc_url() for every value.

  • 3
    "Site setting by someone you trust" is still literally user input. :)
    – Rarst
    Sep 13, 2015 at 15:57
  • @Rarst yeah, I am with you, but he was so "disgusted" by using esc_url, I have been bit more forgiving.
    – Tomer W
    Sep 13, 2015 at 16:14

esc_url is used to produce a valid HTML (not to sanitize input). You should use this anytime you are not 100% sure that what you want to output is a valid HTML for that context.

  • All family of escaping functions are explicitly for sanitizing.
    – Rarst
    Sep 12, 2015 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.