Usually, you would use esc_url()
to escape a URL before displaying it. If that 'URL' is a data URI (eg. 'data:image/svg+xml;base64,...'
), it will be trimmed blank by esc_url()
.
The Codex page on Data Validation has this to say about escaping URLs:
Always use esc_url when sanitizing URLs (in text nodes, attribute nodes or anywhere else). Rejects URLs that do not have one of the provided whitelisted protocols (defaulting to http, https, ftp, ftps, mailto, news, irc, gopher, nntp, feed, and telnet), eliminates invalid characters, and removes dangerous characters. Replaces clean_url() which was deprecated in 3.0.
Data URIs aren't covered by this function and don't appear to be covered by any of the other standard WP escaping functions.
Is there an established best practice in WordPress for escaping data URIs?