If you check the documentation on Data Validation it has following to say about the function:
Always use esc_url when sanitizing URLs (in text nodes, attribute nodes or anywhere else). Rejects URLs that do not have one of the provided whitelisted protocols […], eliminates invalid characters, and removes dangerous characters.
There you have it — practical security benefit. Valid protocol, no murky characters.
The answer about necessity is firmly yes. Escaping output is the most basic security practice.
Related Posts:
- SSL Error: unable to get local issuer certificate
- When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
- When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
- How to redirect all HTTP requests to HTTPS
- What is the difference between a cer, pvk, and pfx file?
- How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
- What’s the best approach for generating a new API key?
- Is it possible to decrypt SHA1
- Simplest two-way encryption using PHP
- Why does the URL http://a/%%30%30 crash Google Chrome?
- what is a auth_user_file.txt?
- When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site?
- How does the SQL injection from the “Bobby Tables” XKCD comic work?
- Error `sec_error_revoked_certificate` when viewed in Firefox only
- How to view PHP on live site
- Convert .pfx to .cer
- how fix “this certificate cannot be verified up to a trusted certification authority”
- Can an attacker use inspect element harmfully?
- Where does Internet Explorer store saved passwords?
- How can bcrypt have built-in salts?
- Is moving wp-config outside the web root really beneficial?
- Hide the fact a site is using WordPress?
- Verifying that I have fully removed a WordPress hack?
- Infected Files – what to do [closed]
- Getting a List of Currently Available Roles on a WordPress Site?
- WordPress 4.7.1 REST API still exposing users
- Can I Prevent Enumeration of Usernames?
- Best way to eliminate xmlrpc.php?
- What’s the easiest way to stop WP from ever logging me out
- If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
- Should I escape wordpress functions like the_title, the_excerpt, the_content
- Should I remove install.php and install-helper.php?
- Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
- How safe / sanitized is wp_insert_posts()?
- Why does WordPress need my private ssh key to update?
- When to use esc_html and when to use sanitize_text_field?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- Where to securely store API keys and passwords in WordPress?
- Are Nonces Useless?
- What is the difference between esc_html filter vs attribute_escape filter?
- Why escape if the_content isnt?
- Why does WordPress have more than one salt?
- Why are passwords exportable as plain text in WordPress?
- What is the ideal setup to address security concerns?
- Will there be security updates for 3.1 once 3.2 is released?
- What’s the difference between esc_* functions?
- Full path disclosure on rss-functions.php
- What to use instead of wp_kses() in user output
- How to set up fail2ban with WordFence?
- How do I technically prove that WordPress is secure?
- Are the default salts secure?
- is_email() VS sanitize_email()
- WordPress it’s cleaning a custom query_var to avoid sql injections?
- Which KSES should be used and when?
- Can someone explain the use cases of esc_html?
- Is there a way to force ssl on certain pages
- How do WordPress Nonces Work?
- Tips for finding SPAM links injected into the_content
- Subscribe to email for security fixes?
- Close a wordpress blog – keep site as it is but prevent hacks
- Is WordPress vulnerable to the httpoxy?
- What is the purpose of having a token in cookies?
- How to escape custom css?
- How to remove “Connection Information” requirement on localhost install of WP on MACOSX
- Understanding SVG vulnerabilities in WordPress related to a specific fix
- How is password strength calculated?
- Moving wp-config.php: Can this be done after site launch?
- How to secure or disable the RSS feeds?
- Regular security checks – what steps should be included?
- What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
- How can I easily verify a core or plugin update has not broken anything?
- Disable comment windows for all existing posts (pages/blogposts)
- WordPress “Site Health Status” trust it or myself for its security advice?
- Generate WordPress salt
- Prevent setup-config.php page from appearing when host blocks database
- Vanilla WordPress install, what can/should I put in disable_functions?
- Stop wordpress automatically escaping $_POST data
- Do Cookies Need to be Sanatized Before Being Saved?
- Is WP vulnerable when updating plugins or themes?
- Disable external access to REST API Endpoint
- Make password invalid once logged out of password-protected page
- wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability
- How to get WordPress to save upload file beyond web root [closed]
- WordPress and Security
- Is security a problem in WordPress?
- What is the wp-includes/certificates/ca-bundle.crt used for?
- Secure my “add_settings_field” translation?
- how can i embed wordpress backend in iframe
- Do you need to escape hard coded plain text?
- Moving wordpress out of the public directory
- Encrypt emails?
- Is there a security risk giving someone temporary access to my blog’s code?
- Is /wp-login.php?redirect_to[] exploitable?
- Garbage in beginning of wp-config.php – was this WP installation compromised?
- WordPress salts set in config and database
- Handling nonces for actions from guests to logged-in users
- How to properly sanitize/secure a WP Query coming from the front end
- Logout via Subdomain, non-wordpress page on a different server?
- WordPress Logout Only If User Click Logout or If User Delete Browser History
- Can I force a password change?