Changeset 62497

Timestamp:

06/12/2026 11:42:27 PM (7 hours ago)

Author:

SergeyBiryukov

Message:

Docs: Correct the DocBlock for build_query().

This updates the @param and @return descriptions to state that build_query() does not URL-encode, unlike PHP's native http_build_query(), and that callers are responsible for encoding the values beforehand or late-escaping the output with esc_url().

Follow-up to [8215].

Props nimeshatxecurify, johnbillion.
Fixes #65453.

File:

• trunk/src/wp-includes/functions.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -1032 +1032 @@
  * It sets the separator to '&' and uses the _http_build_query() function.
  *
+ * Unlike PHP's native http_build_query(), this function does NOT URL-encode
+ * the keys or values. Callers are responsible for encoding values beforehand
+ * with urlencode() or rawurlencode(), or late-escaping the output with
+ * esc_url() before use.
+ *
  * @since 2.3.0
  *
- * @see _http_build_query() Used to build the query
+ * @see _http_build_query() Used to build the query.
  * @link https://www.php.net/manual/en/function.http-build-query.php for more on what
  *       http_build_query() does.
  *
- * @param array $data URL-encode key/value pairs.
- * @return string URL-encoded string.
+ * @param array $data Array of key/value pairs to build the query from.
+ * @return string Query string, without URL encoding applied.
  */
 function build_query( $data ) {