Purpose of using esc_url

user_19507498 0
Viewed 35

I don't understand why we need to use the esc_url if I myself am the one who actually wrote the URL like:

echo get_template_directory_url . '/someText'

Although the /someText is hardcoded but I know it's clean and safe because I wrote it. What are the circumstances that this will be unsafe (like how do bad guys do bad things when I don't use the esc_url in this case? Do they hack into the server? If they can really hack into the server, they won't even bother the esc_url already?

I have referred to https://stackoverflow.com/a/30583251/19507498 , but he just explain how we use it without explaining why we need it.

wordpress php
1 Answers

The purpose of this function is to replace spaces and special characters with their encoded url pendants. For example will be replace with %20. This is needed, because spaces and some other special characters like umlauts or ß are not allowed in urls.

EDIT: Furthermore ? and & need to be encoded, because those have special meanings in urls.

user_54548520
Related