Changeset 53455 for trunk/src/wp-includes/formatting.php

Timestamp:

06/01/2022 06:12:25 PM (4 years ago)

Author:

SergeyBiryukov

Message:

General: Replace all esc_url_raw() calls in core with sanitize_url().

This aims to improve performance by calling sanitize_url() directly, instead of the esc_url_raw() wrapper. As of WordPress 6.1, sanitize_url() is the recommended function for sanitizing a URL for database or redirect usage.

Follow-up to [11383], [13096], [51597], [53452].

Props benjgrolleau, peterwilsoncc, SergeyBiryukov.
Fixes #55852.

File:

• trunk/src/wp-includes/formatting.php (modified) (7 diffs)

trunk/src/wp-includes/formatting.php

@@ -4355 +4355 @@
  * @param string[] $protocols Optional. An array of acceptable protocols.
  *                            Defaults to return value of wp_allowed_protocols().
- * @param string   $_context  Private. Use esc_url_raw() for database usage.
+ * @param string   $_context  Private. Use sanitize_url() for database usage.
  * @return string The cleaned URL after the {@see 'clean_url'} filter is applied.
  *                An empty string is returned if `$url` specifies a protocol other than
@@ -4831 +4831 @@
                         $value = explode( "\n", $value );
                         $value = array_filter( array_map( 'trim', $value ) );
-                        $value = array_filter( array_map( 'esc_url_raw', $value ) );
+                        $value = array_filter( array_map( 'sanitize_url', $value ) );
                         $value = implode( "\n", $value );
                         break;
@@ -4845 +4845 @@
                         } else {
                                 if ( preg_match( '#http(s?)://(.+)#i', $value ) ) {
-                                        $value = esc_url_raw( $value );
+                                        $value = sanitize_url( $value );
                                 } else {
                                         $error = __( 'The WordPress address you entered did not appear to be a valid URL. Please enter a valid URL.' );
@@ -4858 +4858 @@
                         } else {
                                 if ( preg_match( '#http(s?)://(.+)#i', $value ) ) {
-                                        $value = esc_url_raw( $value );
+                                        $value = sanitize_url( $value );
                                 } else {
                                         $error = __( 'The Site address you entered did not appear to be a valid URL. Please enter a valid URL.' );
@@ -4930 +4930 @@
                                 $error = $value->get_error_message();
                         } else {
-                                $value = esc_url_raw( $value );
+                                $value = sanitize_url( $value );
                                 $value = str_replace( 'http://', '', $value );
                         }
@@ -5581 +5581 @@
                 }
         }
-        $urls_to_ping = array_map( 'esc_url_raw', $urls_to_ping );
+        $urls_to_ping = array_map( 'sanitize_url', $urls_to_ping );
         $urls_to_ping = implode( "\n", $urls_to_ping );
         /**
@@ -5650 +5650 @@
 
         if ( preg_match( '/<a\s[^>]*?href=([\'"])(.+?)\1/is', $content, $matches ) ) {
-                return esc_url_raw( $matches[2] );
+                return sanitize_url( $matches[2] );
         }