Code Improvement Suggestion

[ramswarup]

Code Improvement Suggestion for admin footer \wp-admin\admin-footer.php line No. 35

$text = sprintf(
        /* translators: %s: https://wordpress.org/ */
        __( 'Thank you for creating with <a href="%s">WordPress</a>.' ),
        __( 'https://wordpress.org/' )
);

Should we use esc_url() here instead of __ (underscore) to ensure that the URL is valid and protected from cross-site scripting?

$text = sprintf(
        /* translators: %s: https://wordpress.org/ */
        __('Thank you for creating with <a href="%s">WordPress</a>.'),
        esc_url( 'https://wordpress.org/' )
);

Thanks!

[swissspidy]

Hi there and welcome to Trac!

instead of

Definitely not instead of. __() is important as it allows for the URL to be translated.

To be honest we're pretty inconsistent in core with escaping the URLs in cases like this. On one hand we do trust translations to be correct, on the other hand it can't hurt to add it.

Trac ticket: https://core.trac.wordpress.org/ticket/62118

[ramswarup]

@swissspidy Thanks!

[SergeyBiryukov]

Hi there, thanks for the ticket!

It appears that we do escape WordPress.org URLs most of the time, so this brings some more consistency.

[SergeyBiryukov]

In 59096:

Administration: Escape the WordPress.org URL in wp-admin/admin-footer.php.

Follow-up to [5892], [5955], [10976], [17879], [21366], [27469], [45927].

Props ramswarup, narenin, swissspidy.
Fixes #62118.

Thanks for the PR! Merged in r59096.