Should you escape hardcoded URLs?

I'm writing a very simple social share plugin for a client. I'm using these two functions to display the share buttons at the bottom of each post:

?php
/**
 * Social buttons
 */
function zss_share_buttons() {
?
    div class=zss
        
        div id=fb-root/div
        script
            (function(d, s, id) {
                var js, fjs = d.getElementsByTagName(s)[0];
                if (d.getElementById(id)) return;
                js = d.createElement(s); js.id = id;
                js.src = https://connect.facebook.net/en_US/sdk.js#xfbml=1version=v3.0;
                fjs.parentNode.insertBefore(js, fjs);
            }
            (document, 'script', 'facebook-jssdk'));
        /script
        div class=fb-share-button data-href=?php the_permalink(); ? data-layout=button_count data-lazy=true/div
        
        a href=https://twitter.com/share?url=?php the_permalink(); ?amp;text=?php echo urlencode( get_the_title() ); ? title=Share on Twitter target=_blank rel=nofollow noopener noreferrer class=zss-button zss-button--twitterTwitter/a
        
        a class=zss-button zss-button--linkedin href=http://www.linkedin.com/shareArticle?mini=trueamp;url=?php the_permalink(); ? title=Share on LinkedIn target=_blank rel=nofollow noopener noreferrerLinkedIn/a
    
    /div
?php }

/**
 * Insert share button
 */ 
function zss_insert_share_buttons( $content ) {
    if ( is_single()  'post' == get_post_type() ) {
        ob_start();
        zss_share_buttons();
        $content .= ob_get_clean();
    }
    return $content;
}
add_filter( 'the_content', 'zss_insert_share_buttons' );

Is it necessary to escape the hardcoded social media URLs with esc_url()? As I understand it, if the URL doesn't have an input via admin, it should be okay.

Topic escaping security plugins Wordpress

Category Web


No, you don't need to escape hardcoded values.

As I understand it, if the URL doesn't have an input via admin, it should be okay.

Not necessarily. There's many more potential sources of potentially malicious (or just accidentally broken) output that need to be accounted for, such as:

  • Translations.
  • Query strings ($_GET)
  • Cookies.
  • WordPress filters.

So generally you should escape any values output from most, if not all, functions and variables.

About

Geeks Mental is a community that publishes articles and tutorials about Web, Android, Data Science, new techniques and Linux security.