Is it necessary to use esc_url with template tags such as get_permalink?

sanitizing have nothing to do with escaping, and escaping is not a cure to everything.

The role of escaping is to convert a string to a proper HTML. What is a proper HTML representation of a string might depend upon the context and that is the reason you have several escaping functions esc_html,esc_url and esc_attr.

Unlike escaping which have to preserve the meaning of the string sanitizing might remove/change parts of it. For example a user in an author role can add iframes ia the “test” tab of the editor but they will be removed from the content when it will be saved as part of sanitizing it.

Sanitizing should be done when escaping will not be done. For example think of a widget in which you input the embed code of some youtube video. This code is supposed to get as it is into the HTML generated by the site and escaping it will ruin it, therefor you need to sanitize the content before displaying it to make sure that it indeed contains a valid youtube embed code and nothing more.

Related Posts:

  1. what is a auth_user_file.txt?
  2. How to view PHP on live site
  3. Is moving wp-config outside the web root really beneficial?
  4. Hide the fact a site is using WordPress?
  5. Verifying that I have fully removed a WordPress hack?
  6. Can I Prevent Enumeration of Usernames?
  7. Best way to eliminate xmlrpc.php?
  8. If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
  9. Should I remove install.php and install-helper.php?
  10. Are Nonces Useless?
  11. What is the difference between esc_html filter vs attribute_escape filter?
  12. Will there be security updates for 3.1 once 3.2 is released?
  13. How do I technically prove that WordPress is secure?
  14. Which KSES should be used and when?
  15. How do WordPress Nonces Work?
  16. How can I easily verify a core or plugin update has not broken anything?
  17. Disable comment windows for all existing posts (pages/blogposts)
  18. Generate WordPress salt
  19. Vanilla WordPress install, what can/should I put in disable_functions?
  20. Stop wordpress automatically escaping $_POST data
  21. Secure my “add_settings_field” translation?
  22. how can i embed wordpress backend in iframe
  23. Handling nonces for actions from guests to logged-in users
  24. WordPress Logout Only If User Click Logout or If User Delete Browser History
  25. Can I force a password change?
  26. How brute-forcer knows that the password is cracked for target username?
  27. wp_insert_post disable HTML filter
  28. Can someone (Support of my themeprovider) get access to my server If I send them my admin login?
  29. Completely remove the author url
  30. Restricting access to content
  31. About WordPress site security
  32. Relative security of different releases of WordPress
  33. Is there any point setting the keys and salts in wp-config.php?
  34. Where to store OAuth 2.0 client id and secret?
  35. How can I safely use $_SERVER[‘REQUEST_URI’] to avoid XSS?
  36. Using HTACCESS for Secret Access
  37. Definitive wordpress directory ownership and permissions on linux
  38. Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?
  39. Changing Table Prefixes – once done, am I good to go going forward?
  40. Should I disable directory listing for wp-includes?
  41. Safety side of storing emoji into database
  42. How can I safely hide the fact that my website runs on WordPress? [closed]
  43. wordpress website host price and security [closed]
  44. Are there security risks in working directly in the themes folder that builds into a theme folder?
  45. Can I Remove xmlrpc.php completely?
  46. Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
  47. Secure WordPress: Change admin
  48. Changing the default header name
  49. how much information can we hide when using wordpress cms?
  50. Is it safe to use a global wp nonce per user instead of a nonce per action?
  51. Wordfence detects change in wp-admin/includes/upgrade.php
  52. Basic password protection without using users and roles
  53. System setting changed by system user
  54. Does meta-data need to be sanitized?
  55. Will there be security updates for WordPress 4.9.9
  56. Any known bugs that could cause disappearance of the wp_users table?
  57. On new server, site got hacked, permissions a bit strange? Please help
  58. 404/500 error on content images if Referer header is from another domain [closed]
  59. Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
  60. Restrict Access without Creating Users
  61. Switching between security plugins is a risk?
  62. How to obfuscate wp-config.php or code
  63. Security issue with ‘paged’ and ‘posts_per_page’ parameters taken directly from a POST request?
  64. How to prevent to direct access of my custom plugin folder/files
  65. Checking for origin of a xmlrpc request
  66. RESTRICT EDIT of PHP files?
  67. wp-content – permissions for files/folders created by apache
  68. How can I restrict access to specific parts of a page, not just the page itself?
  69. wordpress admin security
  70. Why do people use “admin” username by default? [closed]
  71. User generated content and security
  72. Are major WordPress updates mandatory for security?
  73. i moved wp-config.php outside of public html and this broke my website
  74. Monitor wordpress all external calls
  75. Is it safe to use the basic administration with reduced rights for private member space
  76. Securing WordPress running on Azure platform
  77. Verifying that I have fully removed a WordPress hack?
  78. Spam Registrations
  79. Robots.txt file not updating
  80. How can I have more confidence that WP plugins aren’t getting and storing user data?
  81. Standard Method for Securing a WordPress Site
  82. wordpress security (only one part of the site)
  83. Avoid ‘uploads’ 777 permissions: Potential threat or clean solution?
  84. Any way to disable /wp-login.php redirecting to the site folder?
  85. Folder Permissions + Security Concerns
  86. Malware/Permission bug removal?
  87. Could a user account with a stolen password compromised entire WP site?
  88. Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users
  89. Secure a WordPress website in 2019: one plugin or a combinations of them?
  90. What are the different types of firewall protections available for a WordPress website?
  91. is this code properly secured
  92. Run a security scan on WordPress site that has .htaccess password [closed]
  93. Is this a WordPress security bug?
  94. Competitor is somehow accessing MetaData on a hidden WordPress site
  95. WordPress Hacks/Defacing [closed]
  96. Move data from wp-config to another file
  97. Heartbleed: What is it and what are options to mitigate it?
  98. OpenVPN vs. IPsec – Pros and cons, what to use?
  99. How to test if my server is vulnerable to the ShellShock bug?
  100. How to address security vulnerabilities: LUCKY13, BEAST, and BREACH