Do I need to escape get_theme_mod(‘url’) / (‘mail’) with esc_url?

Yes, you do. Even if you have sanitised the value when saving it, you should always escape on output.

<a href="https://wordpress.stackexchange.com/questions/355618/<?php echo esc_url( get_theme_mod("url' ) ); ?>">

If you’re outputting a mailto: link to an email address, you also need to escape this with esc_url(), just make sure that the mailto: part is included in the escaped value, so that it’s a valid URL:

<a href="https://wordpress.stackexchange.com/questions/355618/<?php echo esc_url("mailto:' . get_theme_mod( 'mail' ) ); ?>">

Related Posts:

  1. What characters do I need to escape in XML documents?
  2. What characters must be escaped in HTML 5?
  3. How can I selectively escape percent (%) in Python strings?
  4. How do I escape a single quote in jQuery?
  5. Escape Character in SQL Server
  6. How to escape apostrophe (‘) in MySql?
  7. Should HTML output be passed through esc_html() AND wp_kses()?
  8. How to prevent escaping when saving HTML code in an option value?
  9. How to correctly escape query variables to be used in WP_Query
  10. esc_attr / esc_html / esc_url in echos
  11. When do I need to use esc_html()? [duplicate]
  12. what’s different between esc_attr, htmlspecialchars and htmlentities
  13. Allow all attributes in $allowedposttags tags
  14. When outputting a static string to the page, is it necessary to escape the output?
  15. How Flexible are the WordPress Coding Standards for PHPCS?
  16. why is esc_html() returning nothing given a string containing a high-bit character?
  17. How to properly escape a translated string?
  18. Translate a Constant while appeasing WordPress PHPCS
  19. Using esc_url() on a url more than once
  20. How to allow &nbsp with wp_kses()?
  21. Using esc_attr_e
  22. Why esc_html_() is not used on every text that has a translation (on Twenty Twenty One)?
  23. Escaping crashes my output
  24. How to safely escape the title attribute
  25. How to safely escape data that contains HTML attributes
  26. Can wp_strip_all_tags be used as a substitute for esc_url, esc_attr & esc_html?
  27. Echoing a URL to a link
  28. wp_kses_post escaping doesn’t appear to work as described?
  29. file_get_contents | escaping doesnt show the page
  30. Help about Escaping
  31. How to keep specific tag from an html string?
  32. Escaping Issues
  33. Escaping and Special Characters (e.g. &)
  34. Escaping get_option( ‘time_format’ ) is nesserary?
  35. How to Git stash pop specific stash in 1.8.3?
  36. What are all the escape characters?
  37. Illegal Escape Character “\”
  38. Which characters need to be escaped when using Bash?
  39. What does it mean to escape a string?
  40. Invalid escape sequence (valid ones are \b \t \n \f \r \” \’ \\ )
  41. Escaping HTML strings with jQuery
  42. How do I escape ampersands in XML so they are rendered as entities in HTML?
  43. Should I escape wordpress functions like the_title, the_excerpt, the_content
  44. Best Practice for PHP
  45. Escaping and sanitizing SVGs in metabox textarea
  46. Sanitize and data validation with apply_filters() function
  47. Difference between esc_url() and esc_url_raw()
  48. What to use instead of wp_kses() in user output
  49. How to escape custom css?
  50. How to Use Wildcards in $wpdb Queries Using $wpdb->get_results & $wpdb->prepare?
  51. Escaping WP_Query tax_query when term has special character(s)
  52. Do I need to escape data passed to wp_localize_script()?
  53. Should messages in WP_Error already be html escaped?
  54. Escaping built-in WP function return strings
  55. How do I stop HTML entities in a custom meta box from being un-htmlentitied?
  56. Why should I escape translatable strings? and how shall i do that?
  57. esc_url not working within add_settings_field callback
  58. Do I need to use the esc_html() function on hard coded links?
  59. Prevent add_shortcode from escaping a tag
  60. Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?
  61. wp_specialchars and wp_specialchars_decode in a shortcode plugin
  62. Sanitizing comments or escaping comment_text()
  63. Prevent escaping javascript in visual editor
  64. Sanitizing, Validating and Escaping in WordPress (Plugin)
  65. How Could I sanitize the receive data from this code
  66. Quotes being escaped inside wp_editor when saved with wp_kses_post
  67. When I re-save a post with [code] sections, the entities are double-escaped (> becomes > etc)
  68. wp_query not searching with apostrophe
  69. Is it safe and good practice to use do_shortcode to escape?
  70. Post Content, Special Characters and Filters
  71. Something is unescaping all html entities before output to browser [closed]
  72. Securing/Escaping Output of file content – reading via fread() in PHP
  73. WordPress stripping away backslashes from HTML
  74. Updating post data on save (save_post vs wp_insert_post_data)
  75. What is the safe way to print tracking code / pixel code before tag or tag
  76. mysql_real_escape_string() vs. esc_sql() in WordPress
  77. Unexpected esc_html and esc_attr behaviour
  78. How to escape html generate by a loop
  79. HTML escaping data with ajax requests
  80. Add HTML to Term Description
  81. should I escape a literal url added in functions.php
  82. Is there any solution, ide/tool etc., for automatic escaping for WordPress?
  83. How to allow single quote with esc_html__() without sprintf()
  84. Proper way to use esc_html__ and esc_attr__ etc for escaping value for translation
  85. Wrapping add_query_arg with esc_url not working
  86. ACF Unexpected T_CONSTANT_ENCAPSED_STRING [closed]
  87. How to pass an array as attribute of shortcode to work properly shortcode parser?
  88. wordpress post not showing my “” text>?
  89. How to correctly escape an echo
  90. Escaping a WPDB Object in One Shot
  91. How to make MySQL search queries with quotes
  92. Escaping WP_Query tax_query when term has special character(s)
  93. Escape html structure in php
  94. site_url() returns with additional backslashes
  95. Code auto escaping is not working when using short codes
  96. Allow iframe in custom meta box
  97. problem with quotes on new post
  98. Escaping data from database (users table) is necessary?
  99. esc_url, esc_url_raw or sanitize_url?
  100. how to sanitizing $_POST with the correct way?