esc_url( string $url, string[] $protocols = null, string $_context = 'display' ): string

Description

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$urlstring

The URL to be cleaned.

$protocolsstring[]optional

An array of acceptable protocols.
Defaults to return value of wp_allowed_protocols().Default: null

$_contextstringoptional

Private. Use sanitize_url() for database usage.Default: 'display'

Return value

string

The cleaned URL after the 'clean_url' filter is applied.
An empty string is returned if $url specifies a protocol other than those in $protocols, or if $url contains an empty string.

Code examples

Every example is editable and runs in a real WordPress booted in your browser by WordPress Playground. Press Run, then edit the code: clicking away re-runs it. Nothing is sent anywhere until you do.

update_post_meta( 2, 'author_website', 'https://example.com/profile?id=7&ref="x' );

$website = get_post_meta( 2, 'author_website', true );

echo "raw:     ", $website, "\n";
echo "escaped: ", esc_url( $website ), "\n\n";
echo 'javascript: URL becomes: ', var_export( esc_url( 'javascript:alert(1)' ), true );

$promo_video = get_theme_mod( 'promo_video_url', '' );
$safe_src    = esc_url( $promo_video, array( 'https' ) );

if ( '' !== $safe_src ) {
	echo '<iframe class="promo-video" src="' . $safe_src . '" loading="lazy"></iframe>';
}

Performance profile

How much work a call to esc_url() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Trivial

Touches nothing outside its own arguments.

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

46–113

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 146.

Plugin surface

1 hook

Third-party callbacks on 'clean_url' run inside this call, and their cost is not bounded by anything here.

Called by

50

50 places in core call this, so the cost is paid more often than your own code shows.

What it touches

• hookthird-party callbacksapply_filters()called directly

What one call costs · 20 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost esc_url() can have, taken from its control-flow graph on PHP 8.5.

This body has more branch combinations than are worth enumerating, so the table covers the outcomes found first rather than every one that exists.

Hooks and filters fired · 1

One hook fires while esc_url() runs, in this order:

1. 1
   apply_filters( clean_url )filterline 4578 (+98 into the body)

   Filters a string cleaned and escaped for output as a URL.

Uses · 9

• stripos()
• _deep_replace()Performs a deep string replace operation to ensure the values in $search are no longer present.
• str_contains()Polyfill for `str_contains()` function added in PHP 8.0.
• array_first()Polyfill for `array_first()` function added in PHP 8.5.
• wp_kses_normalize_entities()Converts and fixes HTML entities.
• wp_parse_url()A wrapper for PHP's parse_url() function that handles consistency in the return values across PHP versions.
• wp_allowed_protocols()Retrieves a list of protocols to allow in HTML attributes.
• wp_kses_bad_protocol()Sanitizes a string and removed disallowed URL protocols.
• apply_filters()Calls the callback functions that have been added to a filter hook.

Used by · 50

• Custom_Background::admin_page()Displays the custom background page.
• Custom_Image_Header::show_header_selector()Displays UI for selecting one of several default headers.
• Custom_Image_Header::step_1()Displays first step of custom header image page.
• Custom_Image_Header::step_2()Displays second step of custom header image page.
• Featured_Content::customize_register()Adds settings to the Customizer.
• Theme_Installer_Skin::after()Performs an action following a single theme install.
• Theme_Upgrader_Skin::after()Performs an action following a single theme update.
• TwentyNineteen_Walker_Comment::html5_comment()Outputs a comment in the HTML5 format.
• TwentyTwenty_Walker_Comment::html5_comment()Outputs a comment in the HTML5 format.
• TwentyTwenty_Walker_Page::start_el()Outputs the beginning of the current element in the tree.
• Twenty_Eleven_Ephemera_Widget::widget()Outputs the HTML for this widget.
• Twenty_Fourteen_Ephemera_Widget::widget()Outputs the HTML for this widget.

Source code

View on Trac ↗View on GitHub ↗

4480function esc_url( $url, $protocols = null, $_context = 'display' ) {4481	$original_url = $url;4482 4483	if ( '' === $url ) {4484		return $url;4485	}4486 4487	$url = str_replace( ' ', '%20', ltrim( $url ) );4488	$url = preg_replace( '|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\\x80-\\xff]|i', '', $url );4489 4490	if ( '' === $url ) {4491		return $url;4492	}4493 4494	if ( 0 !== stripos( $url, 'mailto:' ) ) {4495		$strip = array( '%0d', '%0a', '%0D', '%0A' );4496		$url   = _deep_replace( $strip, $url );4497	}4498 4499	$url = str_replace( ';//', '://', $url );4500	/*4501	 * If the URL doesn't appear to contain a scheme, we presume4502	 * it needs http:// prepended (unless it's a relative link4503	 * starting with /, # or ?, or a PHP file). If the first item4504	 * in $protocols is 'https', then https:// is prepended.4505	 */4506	if ( ! str_contains( $url, ':' ) && ! in_array( $url[0], array( '/', '#', '?' ), true ) &&4507		! preg_match( '/^[a-z0-9-]+?\.php/i', $url )4508	) {4509		$scheme = ( is_array( $protocols ) && 'https' === array_first( $protocols ) ) ? 'https://' : 'http://';4510		$url    = $scheme . $url;4511	}4512 4513	// Replace ampersands and single quotes only when displaying.4514	if ( 'display' === $_context ) {4515		$url = wp_kses_normalize_entities( $url );4516		$url = str_replace( '&', '&', $url );4517		$url = str_replace( "'", ''', $url );4518	}4519 4520	if ( str_contains( $url, '[' ) || str_contains( $url, ']' ) ) {4521 4522		$parsed = wp_parse_url( $url );4523		$front  = '';4524 4525		if ( isset( $parsed['scheme'] ) ) {4526			$front .= $parsed['scheme'] . '://';4527		} elseif ( '/' === $url[0] ) {4528			$front .= '//';4529		}4530 4531		if ( isset( $parsed['user'] ) ) {4532			$front .= $parsed['user'];4533		}4534 4535		if ( isset( $parsed['pass'] ) ) {4536			$front .= ':' . $parsed['pass'];4537		}4538 4539		if ( isset( $parsed['user'] ) || isset( $parsed['pass'] ) ) {4540			$front .= '@';4541		}4542 4543		if ( isset( $parsed['host'] ) ) {4544			$front .= $parsed['host'];4545		}4546 4547		if ( isset( $parsed['port'] ) ) {4548			$front .= ':' . $parsed['port'];4549		}4550 4551		$end_dirty = str_replace( $front, '', $url );4552		$end_clean = str_replace( array( '[', ']' ), array( '%5B', '%5D' ), $end_dirty );4553		$url       = str_replace( $end_dirty, $end_clean, $url );4554 4555	}4556 4557	if ( '/' === $url[0] ) {4558		$good_protocol_url = $url;4559	} else {

Changelog

Introduced in 2.8.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.0.4 tag, from src/wp-includes/formatting.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.