In the docs of built-in function home_url, it is said to be used with esc_url. Are there any security threats without using home_url? Can someone spoof it with fake request?


1 Answer 1


The codex states:

Always use esc_url when sanitizing URLs (in text nodes, attribute nodes or anywhere else). Rejects URLs that do not have one of the provided whitelisted protocols (defaulting to http, https, ftp, ftps, mailto, news, irc, gopher, nntp, feed, and telnet), eliminates invalid characters, and removes dangerous characters. Replaces clean_url() which was deprecated in 3.0.

Also the power behind this little helper function is the

get_option( 'home' );

This will be user input and you always don't trust user inputs. Also this helps output a valid markup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.