I understand when using certain WP functions like site_url(); you should escape these with the esc_html(); function in the following manner:

<?php esc_html(site_url()) ?>

My question is, if I have inputted the site url manually in a template file such as front-page.php like this:

<a href="//mysite.com">My Site</a>

Do I still need to use the esc_html() function? It doesn't mention anything about this use-case in the docs. And if so how do I go about this?

Many thanks

  • 2
    esc_html() wouldn't be the correct function for links. You'd use esc_url(), but you don't need to for hard-coded links. – Jacob Peattie Jan 5 '18 at 5:54

Nope, you don't need to escape hard-coded URLs.

  • 4
    A note on why you don't need to escape hardcoded static strings would be great :) – Tom J Nowell Jan 4 '18 at 23:27
  • But you would need to escape links which are not hardcoded, but populated from backend via an admin? – D. Dan Jan 5 '18 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.