Make WordPress Core

Opened 3 years ago

Closed 3 years ago

#18818 closed defect (bug) (invalid)

wp_sanitize_redirect() kills "@" in URL's

Reported by: theandystratton Owned by: theandystratton
Milestone: Priority: normal
Severity: normal Version: 3.2.1
Component: General Keywords:
Focuses: Cc:


We had a URL like:


WP 301's to


But wp_redirect()'s call to wp_sanitize_redirect() kills the "@" symbol. The reason for this being that a theme/plugin could be using query string arguments for something (i.e. form that accepts pre-populated input via query string, like an email address or arbitrary text).

This could have been an oversight OR it could be on purpose, if so, would like to know (I'd assume a security reason).

Attachments (1)

18818.diff (536 bytes) - added by theandystratton 3 years ago.
Allows @ symbol in wp_sanitize_redirect

Download all attachments as: .zip

Change History (4)

@theandystratton3 years ago

Allows @ symbol in wp_sanitize_redirect

comment:1 @nacin3 years ago

The @ symbol is a reserved character in URLs. It's for separating the username from the host. You need to encode it.

As stated in #18814, it may be possible to encode it in query strings only, but I don't think we should.

comment:2 follow-up: @theandystratton3 years ago

Gotcha, makes sense. For some reason I was getting a similar behavior with encoding (%40) but not now. I figured there was probably something I was overlooking in terms of URL structure as reason for why it wasn't there. Thankyasir.

At least I'm 1 step closer to being able to submit a true patch that gets accepted ;]

comment:3 in reply to: ↑ 2 @nacin3 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to invalid
  • Status changed from new to closed

Replying to theandystratton:

At least I'm 1 step closer to being able to submit a true patch that gets accepted ;]

Indeed! :)

Note: See TracTickets for help on using tickets.