esc_url( string $url, string[] $protocols = null, string $_context = 'display' ): string

Description

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$urlstring

The URL to be cleaned.

$protocolsstring[]optional

An array of acceptable protocols.
Defaults to return value of wp_allowed_protocols().Default: null

$_contextstringoptional

Private. Use sanitize_url() for database usage.Default: 'display'

Return value

string

The cleaned URL after the 'clean_url' filter is applied.
An empty string is returned if $url specifies a protocol other than those in $protocols, or if $url contains an empty string.

Code examples

Every example is editable and runs in a real WordPress booted in your browser by WordPress Playground. Press Run, then edit the code: clicking away re-runs it. Nothing is sent anywhere until you do.

update_post_meta( 2, 'author_website', 'https://example.com/profile?id=7&ref="x' );

$website = get_post_meta( 2, 'author_website', true );

echo "raw:     ", $website, "\n";
echo "escaped: ", esc_url( $website ), "\n\n";
echo 'javascript: URL becomes: ', var_export( esc_url( 'javascript:alert(1)' ), true );

$promo_video = get_theme_mod( 'promo_video_url', '' );
$safe_src    = esc_url( $promo_video, array( 'https' ) );

if ( '' !== $safe_src ) {
	echo '<iframe class="promo-video" src="' . $safe_src . '" loading="lazy"></iframe>';
}

Performance profile

How much work a call to esc_url() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Trivial

Touches nothing outside its own arguments.

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

46–113

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 135.

Plugin surface

1 hook

Third-party callbacks on 'clean_url' run inside this call, and their cost is not bounded by anything here.

Called by

50

50 places in core call this, so the cost is paid more often than your own code shows.

What it touches

• hookthird-party callbacksapply_filters()called directly

What one call costs · 20 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost esc_url() can have, taken from its control-flow graph on PHP 8.5.

This body has more branch combinations than are worth enumerating, so the table covers the outcomes found first rather than every one that exists.

Hooks and filters fired · 1

One hook fires while esc_url() runs, in this order:

1. 1
   apply_filters( clean_url )filterline 4556 (+96 into the body)

   Filters a string cleaned and escaped for output as a URL.

Uses · 8

• stripos()
• _deep_replace()Performs a deep string replace operation to ensure the values in $search are no longer present.
• str_contains()Polyfill for `str_contains()` function added in PHP 8.0.
• wp_kses_normalize_entities()Converts and fixes HTML entities.
• wp_parse_url()A wrapper for PHP's parse_url() function that handles consistency in the return values across PHP versions.
• wp_allowed_protocols()Retrieves a list of protocols to allow in HTML attributes.
• wp_kses_bad_protocol()Sanitizes a string and removed disallowed URL protocols.
• apply_filters()Calls the callback functions that have been added to a filter hook.

Used by · 50

• Custom_Background::admin_page()Displays the custom background page.
• Custom_Image_Header::show_header_selector()Displays UI for selecting one of several default headers.
• Custom_Image_Header::step_1()Displays first step of custom header image page.
• Custom_Image_Header::step_2()Displays second step of custom header image page.
• Featured_Content::customize_register()Add settings to the Customizer.
• Theme_Installer_Skin::after()Performs an action following a single theme install.
• Theme_Upgrader_Skin::after()Performs an action following a single theme update.
• TwentyNineteen_Walker_Comment::html5_comment()Outputs a comment in the HTML5 format.
• TwentyTwenty_Walker_Comment::html5_comment()Outputs a comment in the HTML5 format.
• TwentyTwenty_Walker_Page::start_el()Outputs the beginning of the current element in the tree.
• Twenty_Eleven_Ephemera_Widget::widget()Outputs the HTML for this widget.
• Twenty_Fourteen_Ephemera_Widget::widget()Output the HTML for this widget.

Source code

View on Trac ↗View on GitHub ↗

4460function esc_url( $url, $protocols = null, $_context = 'display' ) {4461	$original_url = $url;4462 4463	if ( '' === $url ) {4464		return $url;4465	}4466 4467	$url = str_replace( ' ', '%20', ltrim( $url ) );4468	$url = preg_replace( '|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\\x80-\\xff]|i', '', $url );4469 4470	if ( '' === $url ) {4471		return $url;4472	}4473 4474	if ( 0 !== stripos( $url, 'mailto:' ) ) {4475		$strip = array( '%0d', '%0a', '%0D', '%0A' );4476		$url   = _deep_replace( $strip, $url );4477	}4478 4479	$url = str_replace( ';//', '://', $url );4480	/*4481	 * If the URL doesn't appear to contain a scheme, we presume4482	 * it needs http:// prepended (unless it's a relative link4483	 * starting with /, # or ?, or a PHP file).4484	 */4485	if ( ! str_contains( $url, ':' ) && ! in_array( $url[0], array( '/', '#', '?' ), true ) &&4486		! preg_match( '/^[a-z0-9-]+?\.php/i', $url )4487	) {4488		$url = 'http://' . $url;4489	}4490 4491	// Replace ampersands and single quotes only when displaying.4492	if ( 'display' === $_context ) {4493		$url = wp_kses_normalize_entities( $url );4494		$url = str_replace( '&', '&', $url );4495		$url = str_replace( "'", ''', $url );4496	}4497 4498	if ( str_contains( $url, '[' ) || str_contains( $url, ']' ) ) {4499 4500		$parsed = wp_parse_url( $url );4501		$front  = '';4502 4503		if ( isset( $parsed['scheme'] ) ) {4504			$front .= $parsed['scheme'] . '://';4505		} elseif ( '/' === $url[0] ) {4506			$front .= '//';4507		}4508 4509		if ( isset( $parsed['user'] ) ) {4510			$front .= $parsed['user'];4511		}4512 4513		if ( isset( $parsed['pass'] ) ) {4514			$front .= ':' . $parsed['pass'];4515		}4516 4517		if ( isset( $parsed['user'] ) || isset( $parsed['pass'] ) ) {4518			$front .= '@';4519		}4520 4521		if ( isset( $parsed['host'] ) ) {4522			$front .= $parsed['host'];4523		}4524 4525		if ( isset( $parsed['port'] ) ) {4526			$front .= ':' . $parsed['port'];4527		}4528 4529		$end_dirty = str_replace( $front, '', $url );4530		$end_clean = str_replace( array( '[', ']' ), array( '%5B', '%5D' ), $end_dirty );4531		$url       = str_replace( $end_dirty, $end_clean, $url );4532 4533	}4534 4535	if ( '/' === $url[0] ) {4536		$good_protocol_url = $url;4537	} else {4538		if ( ! is_array( $protocols ) ) {4539			$protocols = wp_allowed_protocols();

Changelog

Introduced in 2.8.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 6.7.7 tag, from src/wp-includes/formatting.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.