Yes, it’s a good practice to sanitize input and escape output. It’s important to use the correct function, though, so that you don’t inadvertently mess up your data.
Since it’s for a URL, use esc_url_raw() (it is specifically for db usage).
(Note: it may seem odd using a function with the “esc_” stem for sanitizing, since I just stated sanitize input, escape output, but this particular function specifically the deprecated sanitize_url() function.)
Related Posts:
- How safe / sanitized is wp_insert_posts()?
- When to use esc_html and when to use sanitize_text_field?
- What’s the difference between esc_* functions?
- is_email() VS sanitize_email()
- Which KSES should be used and when?
- How to escape custom css?
- Do Cookies Need to be Sanatized Before Being Saved?
- Is default functions like update_post_meta safe to use user inputs?
- vs WordPress Security
- How Could I sanitize the receive data from this code
- Is wp_kses the right approach in sanitizing this string?
- Is it sensible to worry about sanitizing admin input in plugin custom CSS?
- Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
- Do we need to escape data that we receive from theme options?
- How WordPress sanitizes post content on save? Or it doesn’t?
- how to sanitizing $_POST with the correct way?
- When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
- Why does the URL http://a/%%30%30 crash Google Chrome?
- When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site?
- Can an attacker use inspect element harmfully?
- Where does Internet Explorer store saved passwords?
- Infected Files – what to do [closed]
- WordPress 4.7.1 REST API still exposing users
- Should I escape wordpress functions like the_title, the_excerpt, the_content
- Why does WordPress have more than one salt?
- What is the ideal setup to address security concerns?
- Will there be security updates for 3.1 once 3.2 is released?
- WordPress it’s cleaning a custom query_var to avoid sql injections?
- Tips for finding SPAM links injected into the_content
- Close a wordpress blog – keep site as it is but prevent hacks
- Is WordPress vulnerable to the httpoxy?
- Does WordPress sanitize arguments to WP_Query?
- Prevent setup-config.php page from appearing when host blocks database
- wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability
- WordPress and Security
- Is there a security risk giving someone temporary access to my blog’s code?
- How to properly sanitize/secure a WP Query coming from the front end
- brute force attack even though it is limited by IP
- What should I do about hacked server?
- How do I authenticate WP users from a chrome extension?
- Is there any point setting the keys and salts in wp-config.php?
- Auth cookie value security risk?
- Where to store OAuth 2.0 client id and secret?
- Registration Plugin – Recaptcha integration
- How can I safely use $_SERVER[‘REQUEST_URI’] to avoid XSS?
- Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?
- Changing Table Prefixes – once done, am I good to go going forward?
- Should I disable directory listing for wp-includes?
- Should I encrypt the response that triggers an Ajax action? Is nonce sufficient?
- Safety side of storing emoji into database
- How can I safely hide the fact that my website runs on WordPress? [closed]
- Is there value in using a wp_nonce for POST requests?
- What is the safe way to print tracking code / pixel code before tag or tag
- How to hide easy access to my website temporarily?
- Can I Remove xmlrpc.php completely?
- Secure WordPress: Change admin
- Changing the default header name
- Is it safe to use a global wp nonce per user instead of a nonce per action?
- What’s the proper way to sanitize checkbox value sent to the database
- Wordfence detects change in wp-admin/includes/upgrade.php
- Any any insecure http:// URLs left in wordpress?
- White screen of death on admin pages after moving wp-config up two levels for security
- .htaccess password protection bypassed
- Session Cookie security questions
- Storing FTP details in wp-config.php
- Can a WordPress administrator see other users’ passwords?
- Why my plugins are updating automatically?
- Spam injected in w3 total cache page cache [closed]
- Privilege escalation bugs in 2.9?
- Content-Security-Policy blocks WordPress check boxes from being activated
- Display the line breaks in user bio without using html
- How to distinguish between a hack and an encoding error?
- How to change location of wp-config.php to folder or 2 folders up?
- wordpress admin security
- Remove hacked code – out of ideas! [closed]
- Why do people use “admin” username by default? [closed]
- WordPress Database Re-installed (Hacked)
- WordPress Security tools
- Robots.txt file not updating
- Security: Critical backend outside of wordpress
- Advice On How to Backup WordPress
- How can I stop other plugins from using my class’ sensitive methods?
- What are WordPress Current Security Issues in 2017?
- wp-config.php moved above root results in no plugin updates
- Password-protect feed and make it usable in major aggregators
- Should I change the default file and folder permissions?
- How to rewrite rules for WP-security in Nginx?
- how to find the way they hacked my WP site
- Is it a bad idea to CHMOD 777 all the files on your site?
- How to stop repeated hack on header.php of custom theme? [closed]
- is this code properly secured
- nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast? [closed]
- How to get real password (before encrypt) when register a user?
- Directory to store secure file
- How can I give someone server access to only duplicate and modify a site?
- WP-JSON: Cross Origin Resource Sharing Vulnerability?
- How can I implement ansible with per-host passwords, securely?
- Why should I firewall servers?
- Does drilling a hole into a hard drive suffice to make its data unrecoverable?
- Can you alter the default wordpress strong password requirements?