esc_url

Checks and cleans a URL.

Description

(string) esc_url( (string) $url, (constant) $protocols = null, (string) $_context = 'display' ); 

A number of characters are removed from the URL. If the URL is for displaying (the default behaviour) ampersands are also replaced. The filter is applied to the returned cleaned URL.

Returns (string)

The cleaned $url after the {@see 'clean_url'} filter is applied.

Parameters (3)

0. $url (string)
The URL to be cleaned.
1. $protocols — Optional. (constant) => null
An array of acceptable protocols. Defaults to return value of wp_allowed_protocols(…)
2. $context (string)
Private. Use esc_url_raw(…) for database usage.

Usage

  1. if ( !function_exists( 'esc_url' ) ) { 
  2.     require_once ABSPATH . WPINC . '/formatting.php'; 
  3. } 
  4.   
  5. // The URL to be cleaned. 
  6. $url = ''; 
  7.   
  8. // Optional. An array of acceptable protocols. 
  9. // Defaults to return value of wp_allowed_protocols() 
  10. $protocols = null; 
  11.   
  12. // Private. Use esc_url_raw() for database usage. 
  13. $context = ''; 
  14.   
  15. // NOTICE! Understand what this does before running. 
  16. $result = esc_url($url, $protocols, $context); 
  17.     

Defined (1)

The function is defined in the following location(s).

/wp-includes/formatting.php  
  1. function esc_url( $url, $protocols = null, $_context = 'display' ) { 
  2.     $original_url = $url; 
  3.  
  4.     if ( '' == $url ) 
  5.         return $url; 
  6.  
  7.     $url = str_replace( ' ', '%20', $url ); 
  8.     $url = preg_replace('|[^a-z0-9-~+_.?#=!&;, /:%@$\|*\'()\[\]\\x80-\\xff]|i', '', $url); 
  9.  
  10.     if ( '' === $url ) { 
  11.         return $url; 
  12.     } 
  13.  
  14.     if ( 0 !== stripos( $url, 'mailto:' ) ) { 
  15.         $strip = array('%0d', '%0a', '%0D', '%0A'); 
  16.         $url = _deep_replace($strip, $url); 
  17.     } 
  18.  
  19.     $url = str_replace(';//', '://', $url); 
  20.     /** If the URL doesn't appear to contain a scheme, we 
  21.      * presume it needs http:// prepended (unless a relative 
  22.      * link starting with /, # or ? or a php file). 
  23.      */ 
  24.     if ( strpos($url, ':') === false && ! in_array( $url[0], array( '/', '#', '?' ) ) && 
  25.         ! preg_match('/^[a-z0-9-]+?\.php/i', $url) ) 
  26.         $url = 'http://' . $url; 
  27.  
  28.     // Replace ampersands and single quotes only when displaying. 
  29.     if ( 'display' == $_context ) { 
  30.         $url = wp_kses_normalize_entities( $url ); 
  31.         $url = str_replace( '&', '&', $url ); 
  32.         $url = str_replace( "'", ''', $url ); 
  33.     } 
  34.  
  35.     if ( ( false !== strpos( $url, '[' ) ) || ( false !== strpos( $url, ']' ) ) ) { 
  36.  
  37.         $parsed = wp_parse_url( $url ); 
  38.         $front = ''; 
  39.  
  40.         if ( isset( $parsed['scheme'] ) ) { 
  41.             $front .= $parsed['scheme'] . '://'; 
  42.         } elseif ( '/' === $url[0] ) { 
  43.             $front .= '//'; 
  44.         } 
  45.  
  46.         if ( isset( $parsed['user'] ) ) { 
  47.             $front .= $parsed['user']; 
  48.         } 
  49.  
  50.         if ( isset( $parsed['pass'] ) ) { 
  51.             $front .= ':' . $parsed['pass']; 
  52.         } 
  53.  
  54.         if ( isset( $parsed['user'] ) || isset( $parsed['pass'] ) ) { 
  55.             $front .= '@'; 
  56.         } 
  57.  
  58.         if ( isset( $parsed['host'] ) ) { 
  59.             $front .= $parsed['host']; 
  60.         } 
  61.  
  62.         if ( isset( $parsed['port'] ) ) { 
  63.             $front .= ':' . $parsed['port']; 
  64.         } 
  65.  
  66.         $end_dirty = str_replace( $front, '', $url ); 
  67.         $end_clean = str_replace( array( '[', ']' ), array( '%5B', '%5D' ), $end_dirty ); 
  68.         $url = str_replace( $end_dirty, $end_clean, $url ); 
  69.  
  70.     } 
  71.  
  72.     if ( '/' === $url[0] ) { 
  73.         $good_protocol_url = $url; 
  74.     } else { 
  75.         if ( ! is_array( $protocols ) ) 
  76.             $protocols = wp_allowed_protocols(); 
  77.         $good_protocol_url = wp_kses_bad_protocol( $url, $protocols ); 
  78.         if ( strtolower( $good_protocol_url ) != strtolower( $url ) ) 
  79.             return ''; 
  80.     } 
  81.  
  82.     /** 
  83.      * Filters a string cleaned and escaped for output as a URL. 
  84.      * 
  85.      * @since 2.3.0 
  86.      * 
  87.      * @param string $good_protocol_url The cleaned URL to be returned. 
  88.      * @param string $original_url      The URL prior to cleaning. 
  89.      * @param string $_context          If 'display', replace ampersands and single quotes only. 
  90.      */ 
  91.     return apply_filters( 'clean_url', $good_protocol_url, $original_url, $_context ); 
  92. }