Need to use esc_url escaping function instead of esc_attr.

[vishitshah]

Need to use esc_url escaping function instead of esc_attr in user-new.php file.

[audrasjb]

Hello,

I'm not sure about this one. I'm not opposed to this change, but given it's a user generated content, I guess it doesn't hurt if something else than a correct URL is used here (as soon as it can be used as an attribute), and we could break some edge cases/unintended purposes. We only need to make sure that it is correctly escaped for the value attribute, don't we?

[costdev]

The docs for esc_url() state:

Always use esc_url when sanitizing URLs (in text nodes, attribute nodes or anywhere else). ​Ref

This URL is being displayed and is in an attribute node, so esc_url() is appropriate. When submitted, it should go through sanitize_url()* prior to being sent to the database.

*sanitize_url() is the preferred function for sanitizing a URL for the database and redirection as of 6.1 in changeset [53452].

I am unaware of edge cases that may exist. As the field is intended for a URL, I'm having difficulty envisaging an alternative yet valid use case.

[SergeyBiryukov]

Replying to audrasjb:

We only need to make sure that it is correctly escaped for the value attribute, don't we?

Yes, I think esc_attr() is correct here. It's not unlikely that someone might want to put "Website: none", "in progress", or something else that's not a valid URL in their profile.

Requiring a valid URL and sanitizing it as such, with appropriate error messages, could be a separate enhancement.

[ocean90]

I agree that esc_attr() is the proper function here since the primary use case is to escape the value for an attribute, which isn't href, src or similar.

[sabernhardt]

Related: #59337