esc_url() printed by the_permalink()

[mfields]

Using Mark Jaquith's rule of escaping output as late as possible, I believe that it would be correct to use esc_url() on the output of the_permalink. It may be helpful in correcting mistakes in plugins that use the "the_permalink" filter as well.

Filter output of the_permalink() through esc_url() before printing.

I can imagine this resulting in double-encoding in some cases.

I would be interested to learn more about these cases. I use this function pretty liberally in my projects and would love to know in which situations it would double encode.

This seems like the right thing to do to me as well. the_permalink() is a template function, so having output be escaped properly by default seems correct to me.

I don't believe it should lead to double-encoding issues.

esc_url() doesn't encode HTML entities beyond escaping level 1.

• & - level 0
• & - level 1
• & - level 2

In themes I've recently worked on, I've been adding add_filter( 'the_permalink', 'esc_url' );. This is a pretty obvious change. Let's add this in 3.4-early.

Ultimately, it will cause some issues, but it will be rare: A) htmlspecialchars() is used, rather than esc_url() or nothing, and B) the URL actually has something to be encoded, which is not particularly common at least regarding ampersands.

In 23527:

Automatically esc_url() the URL echoed by the_permalink().

This makes the_permalink() useful, rather than needing to do echo esc_url( get_permalink() ) to get proper encoding of ampersands, etc. This will not double-encode when esc_url() has already been applied to the filter here, but that code can now be removed.

props mfields.
fixes #17562.

In 23528:

esc_url() when printing a URL into an attribute, even when it is known to be safe. (see #17562)