Should you escape hardcoded URLs?
I'm writing a very simple social share plugin for a client. I'm using these two functions to display the share buttons at the bottom of each post:
?php
/**
* Social buttons
*/
function zss_share_buttons() {
?
div class=zss
div id=fb-root/div
script
(function(d, s, id) {
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) return;
js = d.createElement(s); js.id = id;
js.src = https://connect.facebook.net/en_US/sdk.js#xfbml=1version=v3.0;
fjs.parentNode.insertBefore(js, fjs);
}
(document, 'script', 'facebook-jssdk'));
/script
div class=fb-share-button data-href=?php the_permalink(); ? data-layout=button_count data-lazy=true/div
a href=https://twitter.com/share?url=?php the_permalink(); ?amp;text=?php echo urlencode( get_the_title() ); ? title=Share on Twitter target=_blank rel=nofollow noopener noreferrer class=zss-button zss-button--twitterTwitter/a
a class=zss-button zss-button--linkedin href=http://www.linkedin.com/shareArticle?mini=trueamp;url=?php the_permalink(); ? title=Share on LinkedIn target=_blank rel=nofollow noopener noreferrerLinkedIn/a
/div
?php }
/**
* Insert share button
*/
function zss_insert_share_buttons( $content ) {
if ( is_single() 'post' == get_post_type() ) {
ob_start();
zss_share_buttons();
$content .= ob_get_clean();
}
return $content;
}
add_filter( 'the_content', 'zss_insert_share_buttons' );
Is it necessary to escape the hardcoded social media URLs with esc_url()
? As I understand it, if the URL doesn't have an input via admin, it should be okay.