Changeset 53455 for trunk/src/wp-includes/formatting.php

Timestamp:

06/01/2022 06:12:25 PM (3 years ago)

Author:

SergeyBiryukov

Message:

General: Replace all esc_url_raw() calls in core with sanitize_url().

This aims to improve performance by calling sanitize_url() directly, instead of the esc_url_raw() wrapper. As of WordPress 6.1, sanitize_url() is the recommended function for sanitizing a URL for database or redirect usage.

Follow-up to [11383], [13096], [51597], [53452].

Props benjgrolleau, peterwilsoncc, SergeyBiryukov.
Fixes #55852.

File:

• trunk/src/wp-includes/formatting.php (modified) (7 diffs)

trunk/src/wp-includes/formatting.php

@@ -4355 +4355 @@
  * @param string[] $protocols Optional. An array of acceptable protocols.
  *                            Defaults to return value of wp_allowed_protocols().
- * @param string   $_context  Private. Use esc_url_raw() for database usage.
+ * @param string   $_context  Private. Use sanitize_url() for database usage.
  * @return string The cleaned URL after the {@see 'clean_url'} filter is applied.
  *                An empty string is returned if `$url` specifies a protocol other than
@@ -4831 +4831 @@
             $value = explode( "\n", $value );
             $value = array_filter( array_map( 'trim', $value ) );
-            $value = array_filter( array_map( 'esc_url_raw', $value ) );
+            $value = array_filter( array_map( 'sanitize_url', $value ) );
             $value = implode( "\n", $value );
             break;
@@ -4845 +4845 @@
             } else {
                 if ( preg_match( '#http(s?)://(.+)#i', $value ) ) {
-                    $value = esc_url_raw( $value );
+                    $value = sanitize_url( $value );
                 } else {
                     $error = __( 'The WordPress address you entered did not appear to be a valid URL. Please enter a valid URL.' );
@@ -4858 +4858 @@
             } else {
                 if ( preg_match( '#http(s?)://(.+)#i', $value ) ) {
-                    $value = esc_url_raw( $value );
+                    $value = sanitize_url( $value );
                 } else {
                     $error = __( 'The Site address you entered did not appear to be a valid URL. Please enter a valid URL.' );
@@ -4930 +4930 @@
                 $error = $value->get_error_message();
             } else {
-                $value = esc_url_raw( $value );
+                $value = sanitize_url( $value );
                 $value = str_replace( 'http://', '', $value );
             }
@@ -5581 +5581 @@
         }
     }
-    $urls_to_ping = array_map( 'esc_url_raw', $urls_to_ping );
+    $urls_to_ping = array_map( 'sanitize_url', $urls_to_ping );
     $urls_to_ping = implode( "\n", $urls_to_ping );
     /**
@@ -5650 +5650 @@
 
     if ( preg_match( '/<a\s[^>]*?href=([\'"])(.+?)\1/is', $content, $matches ) ) {
-        return esc_url_raw( $matches[2] );
+        return sanitize_url( $matches[2] );
     }