1

I'm writing a very simple social share plugin for a client. I'm using these two functions to display the share buttons at the bottom of each post:

<?php
/**
 * Social buttons
 */
function zss_share_buttons() {
?>
    <div class="zss">
        
        <div id="fb-root"></div>
        <script>
            (function(d, s, id) {
                var js, fjs = d.getElementsByTagName(s)[0];
                if (d.getElementById(id)) return;
                js = d.createElement(s); js.id = id;
                js.src = "https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v3.0";
                fjs.parentNode.insertBefore(js, fjs);
            }
            (document, 'script', 'facebook-jssdk'));
        </script>
        <div class="fb-share-button" data-href="<?php the_permalink(); ?>" data-layout="button_count" data-lazy="true"></div>
        
        <a href="https://twitter.com/share?url=<?php the_permalink(); ?>&amp;text=<?php echo urlencode( get_the_title() ); ?>" title="Share on Twitter" target="_blank" rel="nofollow noopener noreferrer" class="zss-button zss-button--twitter">Twitter</a>
        
        <a class="zss-button zss-button--linkedin" href="http://www.linkedin.com/shareArticle?mini=true&amp;url=<?php the_permalink(); ?>" title="Share on LinkedIn" target="_blank" rel="nofollow noopener noreferrer">LinkedIn</a>
    
    </div>
<?php }

/**
 * Insert share button
 */ 
function zss_insert_share_buttons( $content ) {
    if ( is_single() && 'post' == get_post_type() ) {
        ob_start();
        zss_share_buttons();
        $content .= ob_get_clean();
    }
    return $content;
}
add_filter( 'the_content', 'zss_insert_share_buttons' );

Is it necessary to escape the hardcoded social media URLs with esc_url()? As I understand it, if the URL doesn't have an input via admin, it should be okay.

9
  • but it does have input, the_permalink and get_the_title are not hardcoded – Tom J Nowell Apr 21 at 11:05
  • Are these functions not already escaped by WordPress? – Sam Apr 21 at 11:06
  • 2
    the_permalink() is. get_the_permalink() and get_the_title() are not. – Jacob Peattie Apr 21 at 11:16
  • 2
    You should escape URLs, not fragments of URLs. Escape the entire URL as a whole. If the entire URL is hardcoded then you're fine, but if it has portions with non-hardcoded values then the entire thing needs to be escaped as one single unit. Your the_permalink calls are also problematic because they don't encode their output – Tom J Nowell Apr 21 at 13:56
  • 2
    If any of your permalinks contain a query string they'll break, there are other cases but that's the most obvious. It also means you have multiple escaping attempts for 1 URL. Escaping is all about enforcing expectations and assumptions. Why chance that it "should" be a URL? You can guarantee it with esc_url and say that it is "always" a URL. Enforce it! Remove all doubt! Use that cast iron guarantee – Tom J Nowell Apr 21 at 15:11
3

No, you don't need to escape hardcoded values.

As I understand it, if the URL doesn't have an input via admin, it should be okay.

Not necessarily. There's many more potential sources of potentially malicious (or just accidentally broken) output that need to be accounted for, such as:

  • Translations.
  • Query strings ($_GET)
  • Cookies.
  • WordPress filters.

So generally you should escape any values output from most, if not all, functions and variables.

3
  • Ok. In some blogs I have seen that in order to follow the best practice, you have to escape all outputs without considering whether it is a hardcoded string or not. Do we really need that ? – melvin yesterday
  • I don't have anything to add other than what's in my answer. Do you have an example of anyone advising escaping hard-coded strings? – Jacob Peattie yesterday
  • I don't have link to that with me now. I have seen such comments while searching for this topic the past few months (in Stack Overflow i think). But your answer is what most of the WordPress experts stick to. So i guess i will go with this answer. – melvin yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.