I understand when using certain WP functions like site_url(); you should escape these with the esc_html(); function in the following manner:

<?php esc_html(site_url()) ?>

My question is, if I have inputted the site url manually in a template file such as front-page.php like this:

<a href="//mysite.com">My Site</a>

Do I still need to use the esc_html() function? It doesn't mention anything about this use-case in the docs. And if so how do I go about this?

Many thanks

  • 2
    esc_html() wouldn't be the correct function for links. You'd use esc_url(), but you don't need to for hard-coded links. Jan 5, 2018 at 5:54

1 Answer 1


Nope, you don't need to escape hard-coded URLs.

  • 4
    A note on why you don't need to escape hardcoded static strings would be great :)
    – Tom J Nowell
    Jan 4, 2018 at 23:27
  • But you would need to escape links which are not hardcoded, but populated from backend via an admin?
    – D. Dan
    Jan 5, 2018 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.