The function for the pre_get_posts action uses a WP_Query object (http://codex.wordpress.org/Plugin_API/Action_Reference/pre_get_posts)
When using functions such as get_posts or classes such as WP_Query and WP_User_Query, WordPress takes care of the necessary sanitization in querying the database. However, when retrieving data from a custom table, or otherwise performing a direct SQL query on the database – proper sanitization is then up to you.
— Code Tuts+: Data Sanitization and Validation With WordPress
So in this case, you do not have to escape the query vars.
Related Posts:
- What characters do I need to escape in XML documents?
- What characters must be escaped in HTML 5?
- How can I selectively escape percent (%) in Python strings?
- How do I escape a single quote in jQuery?
- Escape Character in SQL Server
- How to escape apostrophe (‘) in MySql?
- Should HTML output be passed through esc_html() AND wp_kses()?
- How to prevent escaping when saving HTML code in an option value?
- esc_attr / esc_html / esc_url in echos
- When do I need to use esc_html()? [duplicate]
- what’s different between esc_attr, htmlspecialchars and htmlentities
- Allow all attributes in $allowedposttags tags
- When outputting a static string to the page, is it necessary to escape the output?
- How Flexible are the WordPress Coding Standards for PHPCS?
- why is esc_html() returning nothing given a string containing a high-bit character?
- How to properly escape a translated string?
- Translate a Constant while appeasing WordPress PHPCS
- Using esc_url() on a url more than once
- Do I need to escape get_theme_mod(‘url’) / (‘mail’) with esc_url?
- How to allow   with wp_kses()?
- Using esc_attr_e
- Why esc_html_() is not used on every text that has a translation (on Twenty Twenty One)?
- Escaping crashes my output
- How to safely escape the title attribute
- How to safely escape data that contains HTML attributes
- Can wp_strip_all_tags be used as a substitute for esc_url, esc_attr & esc_html?
- Echoing a URL to a link
- wp_kses_post escaping doesn’t appear to work as described?
- file_get_contents | escaping doesnt show the page
- Help about Escaping
- How to keep specific tag from an html string?
- Escaping Issues
- Escaping and Special Characters (e.g. &)
- Escaping get_option( ‘time_format’ ) is nesserary?
- How should esc_url be combined with trailingslashit?
- Correct way of using esc_attr() and esc_html()
- Illegal Escape Character “\”
- What does it mean to escape a string?
- Invalid escape sequence (valid ones are \b \t \n \f \r \” \’ \\ )
- Best Practice for PHP
- Difference between esc_url() and esc_url_raw()
- How to escape custom css?
- How to Use Wildcards in $wpdb Queries Using $wpdb->get_results & $wpdb->prepare?
- Should messages in WP_Error already be html escaped?
- Escaping built-in WP function return strings
- Passing Variable as URL Parameter — Security concerns?
- Rewrite Rule for Custom Page with Query Vars in URL
- WordPress query through Products variation stock [closed]
- set_query_var doesn’t seem to work on init hook
- Why should I escape translatable strings? and how shall i do that?
- esc_url not working within add_settings_field callback
- Do I need to use the esc_html() function on hard coded links?
- Determine WP_Query parameters from URL
- Rewrite rules and query for virtual page
- Passing array of strings to a SQL statement in a WordPress plugin
- Rewrite URL Parameter And Force ‘Pretty’ Permalink
- Taxonomy page template changing when using query variables
- Is it safe to use $_POST directly in my plugin instead of using admin-ajax.php to receive data from ajax?
- How Could I sanitize the receive data from this code
- Quotes being escaped inside wp_editor when saved with wp_kses_post
- When I re-save a post with [code] sections, the entities are double-escaped (> becomes > etc)
- wp_query not searching with apostrophe
- Rewriting get_next_posts_link() for custom loop
- Securing/Escaping Output of file content – reading via fread() in PHP
- add_filter(‘query_vars’) not working in custom template
- WordPress stripping away backslashes from HTML
- How to: wordpress job listing and candidates details
- Query arg not available on init
- Unexpected esc_html and esc_attr behaviour
- Integer based rewrite isn’t recognized for value of 1
- HTML escaping data with ajax requests
- should I escape a literal url added in functions.php
- Query_vars support in Rest API
- How to pass a variable to get_template_part that’s updated every time the template part is called?
- How to allow single quote with esc_html__() without sprintf()
- Redirect old query string URLs to new add_rewrite_rule URL
- Pass form input via url variable
- Add pagination to a template loaded by query variable
- Wrapping add_query_arg with esc_url not working
- wordpress post not showing my “” text>?
- WordPress add a rewrite rule to a page to accept a GET variable
- Custom query_var to get URL paramater not working
- Custom permalink question
- CPT year wise archive based on custom date Field
- Single Post (CPT) in two pages – Normal and Extended
- How to make MySQL search queries with quotes
- Escaping WP_Query tax_query when term has special character(s)
- Escape html structure in php
- site_url() returns with additional backslashes
- Rewrite URL to plugin file
- Allow iframe in custom meta box
- Need help with regex
- query_vars doesn’t return query string (trying to get data from $wpdb)
- esc_url, esc_url_raw or sanitize_url?
- how to escape alert/window.location.replace with variable
- Unable to Retrieve Query Parameters Passed in URL
- What is best practice when escaping the_title()?
- If necessary, how should wp_get_attachment_image() and its parameters be escaped?
- How can I use an alternate header when a query var is present
- Is it necessary to use escape functions on everything or is it only necessary if you’re taking input from a 3rd party? (End Users, APIs, Etc.)