Is it necessary to escape data when storing it in the user's meta-data? I'm not sure if WP does this automatically, or if it is even necessary. Also, if it is necessary, should I use mysql_real_escape_string via sanatize_meta?

I'm storing a URL.

1 Answer 1


Yes, it's a good practice to sanitize input and escape output. It's important to use the correct function, though, so that you don't inadvertently mess up your data.

Since it's for a URL, use esc_url_raw() (it is specifically for db usage).

(Note: it may seem odd using a function with the "esc_" stem for sanitizing, since I just stated sanitize input, escape output, but this particular function specifically the deprecated sanitize_url() function.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.