esc_url() printed by the_permalink()

[mfields]

Using Mark Jaquith's rule of escaping output as late as possible, I believe that it would be correct to use esc_url() on the output of the_permalink. It may be helpful in correcting mistakes in plugins that use the "the_permalink" filter as well.

[mfields]

Filter output of the_permalink() through esc_url() before printing.

[scribu]

I can imagine this resulting in double-encoding in some cases.

[mfields]

I would be interested to learn more about these cases. I use this function pretty liberally in my projects and would love to know in which situations it would double encode.

[alexkingorg]

This seems like the right thing to do to me as well. the_permalink() is a template function, so having output be escaped properly by default seems correct to me.

I don't believe it should lead to double-encoding issues.

[markjaquith]

esc_url() doesn't encode HTML entities beyond escaping level 1.

• & - level 0
• & - level 1
• & - level 2

[nacin]

In themes I've recently worked on, I've been adding add_filter( 'the_permalink', 'esc_url' );. This is a pretty obvious change. Let's add this in 3.4-early.

Ultimately, it will cause some issues, but it will be rare: A) htmlspecialchars() is used, rather than esc_url() or nothing, and B) the URL actually has something to be encoded, which is not particularly common at least regarding ampersands.

[nacin]

In 23527:

Automatically esc_url() the URL echoed by the_permalink().

This makes the_permalink() useful, rather than needing to do echo esc_url( get_permalink() ) to get proper encoding of ampersands, etc. This will not double-encode when esc_url() has already been applied to the filter here, but that code can now be removed.

props mfields.
fixes #17562.

[nacin]

In 23528:

esc_url() when printing a URL into an attribute, even when it is known to be safe. (see #17562)