Skip to content

Commit 43b55b4

Browse files
General: Restore (un-deprecate) the sanitize_url() function.
A general security rule is "Sanitize when you save, escape when you echo", and for the most part WordPress has well-named functions like `sanitize_email()` and others, with `esc_url_raw()` being a single exception that does not follow the naming. This commit restores the previously deprecated `sanitize_url()` function as a valid alias of `esc_url_raw()`. This better aligns with the naming with other `sanitize_*()` functions: * `sanitize_bookmark()` * `sanitize_bookmark_field()` * `sanitize_category()` * `sanitize_category_field()` * `sanitize_comment_cookies()` * `sanitize_email()` * `sanitize_file_name()` * `sanitize_hex_color()` * `sanitize_hex_color_no_hash()` * `sanitize_html_class()` * `sanitize_key()` * `sanitize_meta()` * `sanitize_mime_type()` * `sanitize_option()` * `sanitize_post()` * `sanitize_post_field()` * `sanitize_sql_orderby()` * `sanitize_term()` * `sanitize_term_field()` * `sanitize_text_field()` * `sanitize_textarea_field()` * `sanitize_title()` * `sanitize_title_for_query()` * `sanitize_title_with_dashes()` * `sanitize_trackback_urls()` * `sanitize_user()` * `sanitize_user_field()` Follow-up to [11383], [13096]. Props Ipstenu, aadilali. Fixes #53876. git-svn-id: https://develop.svn.wordpress.org/trunk@51597 602fd350-edb4-49c9-b593-d223f7449a82
1 parent c550a59 commit 43b55b4

File tree

2 files changed

+21
-17
lines changed

2 files changed

+21
-17
lines changed

src/wp-includes/deprecated.php

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2023,22 +2023,6 @@ function get_link( $bookmark_id, $output = OBJECT, $filter = 'raw' ) {
20232023
return get_bookmark($bookmark_id, $output, $filter);
20242024
}
20252025

2026-
/**
2027-
* Performs esc_url() for database or redirect usage.
2028-
*
2029-
* @since 2.3.1
2030-
* @deprecated 2.8.0 Use esc_url_raw()
2031-
* @see esc_url_raw()
2032-
*
2033-
* @param string $url The URL to be cleaned.
2034-
* @param array $protocols An array of acceptable protocols.
2035-
* @return string The cleaned URL.
2036-
*/
2037-
function sanitize_url( $url, $protocols = null ) {
2038-
_deprecated_function( __FUNCTION__, '2.8.0', 'esc_url_raw()' );
2039-
return esc_url_raw( $url, $protocols );
2040-
}
2041-
20422026
/**
20432027
* Checks and cleans a URL.
20442028
*

src/wp-includes/formatting.php

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4404,7 +4404,7 @@ function esc_url( $url, $protocols = null, $_context = 'display' ) {
44044404
}
44054405

44064406
/**
4407-
* Performs esc_url() for database usage.
4407+
* Performs esc_url() for database or redirect usage.
44084408
*
44094409
* @since 2.8.0
44104410
*
@@ -4419,6 +4419,26 @@ function esc_url_raw( $url, $protocols = null ) {
44194419
return esc_url( $url, $protocols, 'db' );
44204420
}
44214421

4422+
/**
4423+
* Performs esc_url() for database or redirect usage.
4424+
*
4425+
* This function is an alias for esc_url_raw().
4426+
*
4427+
* @since 2.3.1
4428+
* @since 2.8.0 Deprecated in favor of esc_url_raw().
4429+
* @since 5.9.0 Restored (un-deprecated).
4430+
*
4431+
* @see esc_url_raw()
4432+
*
4433+
* @param string $url The URL to be cleaned.
4434+
* @param string[] $protocols Optional. An array of acceptable protocols.
4435+
* Defaults to return value of wp_allowed_protocols().
4436+
* @return string The cleaned URL after esc_url() is run with the 'db' context.
4437+
*/
4438+
function sanitize_url( $url, $protocols = null ) {
4439+
return esc_url_raw( $url, $protocols );
4440+
}
4441+
44224442
/**
44234443
* Convert entities, while preserving already-encoded entities.
44244444
*

0 commit comments

Comments
 (0)