Built-in data validation function for URLs

Use esc_url( $url ) for URLs that should be displayed and esc_url_raw( $url ) if the URL should be sent to the database.

  • The first will replace bare ampersands & with &.
  • The second is a wrapper for the first; it will just suppress the escaping of ampersands.
  • Both functions will check the protocol. See wp_allowed_protocols() for the list:
    'http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet', 'mms', 'rtsp', 'svn', 'tel', 'fax', 'xmpp'
    So an URL like javascript:alert("Hacked!"); will not get through.

These functions are not exactly validators. They sanitize the value. But you should use them whenever you have an URL to save or to display.

There is also wp_validate_redirect( $location, $default ).

$location is an URL here and $default a fallback URL if the first value doesn’t validate. From its doc block:

Validates a URL for use in a redirect.

Checks whether the $location is using an allowed host, if it has an absolute
path. A plugin can therefore set or remove allowed host(s) to or from the list.

Note the allowed hosts do not include all (sub) domains of a multi-site installation. No idea why.

Related Posts:

  1. How to edit a user profile on the front end?
  2. How to display user registration form on front-end of the website?
  3. What is an easy way to display a front-end user registration form?
  4. Autocomplete for taxonomy input boxes on a front end form
  5. How to edit custom user meta information front end
  6. Adding a new user from the front end
  7. Saving frontend form data in wordpress
  8. Validating custom fields before post save
  9. WordPress Frontend Post Form (Bootstrap Modal) Not Creating Post
  10. Front end update_post_meta Help
  11. Headers already sent on a frontend post form using wp_redirect before get_header
  12. wp_nonce for Front-End submission form not working
  13. Update a string from the front-end
  14. How to reproduce the post format field in a front end form?
  15. How to handle form submission?
  16. Add error message on password protected page
  17. how to set from address according to the form input email address for wp_mail()?
  18. using update_user_meta in form to set and get custom meta
  19. Front End Post Save Child terms
  20. User registration problem in WordPress
  21. show image in mail contact form 7 [closed]
  22. Submitting post to database then redirecting to paypal
  23. Saving two categories from two dropdowns in front end posting form
  24. Registration form labels – add asterisk
  25. How to create and retrieve data from a special registration form?
  26. Contact form 7 Dynamic text – placeholder on GET field
  27. Settings API erases itself?
  28. Reason action hook won’t work with update_post_meta from frontend form? Alternative?
  29. How to send multipart form data to WordPress endpoint
  30. Wp_mail Returning False on Server
  31. How to update selective options on plugin settings page
  32. Loading scripts & styles from a meta box callback function
  33. Front-End Interfaces Without Shortcodes
  34. Help with verifying google recaptcha in a custom form
  35. Mail Form in a modal box without plugin
  36. How am I able to get the value out of cookie array when I push a button?
  37. How to Process Form Request
  38. Front End Registration Form Code – Password Field Not Saving
  39. How to implement post/redirect/get pattern on contact form
  40. limit characters when posting from form
  41. Adding data to an array in usermeta and displaying it in a loop
  42. WPForm, how to set date to tomorrow
  43. Create form on plugin options page that creates submenu pages for that plugin
  44. How can I create registration form for users which I can assign role and profile picture?
  45. Contact Form 7 – Add a Info Text to Checkboxes/Radiobuttons [closed]
  46. Show the submitted values in the form when validation fails
  47. How to make WordPress forms secure (HTTPS)
  48. Post submit using shortcode and init
  49. What form element names break wordpress?
  50. Remove field in the form : only works for “url”, not for “email”?
  51. I am trying to grab the title and put it in a paypal form select option
  52. Should I use wp_nonce_field on my contact form?
  53. Comparing formidable pro and gravity forms [closed]
  54. Programmatically populate form fields with data
  55. advanced custom fields and contact form 7
  56. Stop SPAM from custom form
  57. Custom tables and using wpdb to insert into DB from a html form
  58. Send value of PHP variable in template via hidden field in a form
  59. Saved emails at dashboard
  60. Custom form handling in WP.. the correct way?
  61. Custom Taxonomy Not Saving in Front End Post
  62. How to use HubSpot Forms API in WordPress pages?
  63. retrieve all emails as database in wordpress to view all sent emails
  64. How to stop direct HTTP POST to a PHP script?
  65. Embed IPB forums to wordpress page
  66. Unable to upload data to Media Libary
  67. Where this validating message come from?
  68. How to add custom regex validation to WPForms password field
  69. Form Post / Session Variables not Working in Query with Pagination
  70. Email form getting hacked
  71. Submit Multi-Part Form After Each Part
  72. Populate a custom form with user data [closed]
  73. Caldera Forms Manual formula
  74. Why is my contact form not working?
  75. Form element name – array type is not working
  76. Embedding Links to WPForms on a WP Page
  77. Scroll Form with page scrolling and add form on slider
  78. Reading POST over admin-ajax.php
  79. Back button not working after input / search submit
  80. I am trying to add checkbox for anonymous post on form post
  81. Auto Submit Contact Form 7
  82. Custom transactional emails on user signup with wp_add_user
  83. WordPress, Front-end send message to authors using plugin when their post is published
  84. Generating unique PDF download link after user input
  85. Why doesn’t a form need an ‘action’ with a plugin that uses the post data?
  86. How to set up an auto delete post?
  87. Update post meta without deleting the old entries
  88. How to creat form with get method and receive it
  89. How to know if a tag has been added within a taxonomy?
  90. Custom form values without plugin [closed]
  91. How to add contact form instead of checkout
  92. From contact form to paypal
  93. WordPress – custom user flow registration approval
  94. How do I register user without being authenticated
  95. How to add or double field?
  96. Custom form validation
  97. How to manage to submit WPForms at our webpage
  98. Adding default quicktags to textarea
  99. How can I get lost form data back? [closed]
  100. Forminator + Hubspot Workflows
error code: 523