Can I trust user input in wp_redirect()?
You can never trust user input. Always prepare a value that you want use in your own code. Example: $path = filter_input( INPUT_SERVER, ‘REQUEST_URI’, FILTER_SANITIZE_URL ); if ( $path ) { $url=”http://old.example.com” . $path; $url_escaped = esc_url( $url ); $status = 301; $message = “Moved to <a href=”https://wordpress.stackexchange.com/questions/233824/$url_escaped”>$url_escaped</a>.”; wp_redirect( ‘http://old.example.com’. $path, $status ); wp_die( $message, … Read more