<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>@Greg</div><div><br></div><div>It is good practice to escape url whether is trusted or not. But both codex and guidelines' code examples simply echos. </div><div><br></div><div>That's why I started this topic to clarify. We should always recommend authors to escape but not require. Otherwise, we should change the code example in guidelines.</div><div><br>Stephen Cui<div><br></div></div><div><br>On Jun 20, 2013, at 4:50 AM, Greg Priday <<a href="mailto:greg@siteorigin.com">greg@siteorigin.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">I thought this was already a requirement because of:<div><span style="color:rgb(0,0,0);font-family:sans-serif;font-size:13px;line-height:22px"><br></span></div><div>"<span style="color:rgb(0,0,0);font-family:sans-serif;font-size:13px;line-height:22px">Themes are </span><b style="color:rgb(0,0,0);font-family:sans-serif;font-size:13px;line-height:22px">required</b><span style="color:rgb(0,0,0);font-family:sans-serif;font-size:13px;line-height:22px"> </span><span style="color:rgb(0,0,0);font-family:sans-serif;font-size:13px;line-height:22px">to validate and sanitize all untrusted data before entering data into the database, and to escape all untrusted data before being output in the Settings form fields or in the Theme template files (see:</span><span style="color:rgb(0,0,0);font-family:sans-serif;font-size:13px;line-height:22px"> </span><a href="http://codex.wordpress.org/Data_Validation" title="Data Validation" style="font-family:sans-serif;font-size:13px;line-height:22px;text-decoration:none;color:rgb(76,166,207)">Data Validation</a><span style="color:rgb(0,0,0);font-family:sans-serif;font-size:13px;line-height:22px">)"</span></div>
<div><font color="#000000" face="sans-serif"><span style="line-height:22px"><br></span></font></div><div><font color="#000000" face="sans-serif"><span style="line-height:22px">I guess it depends on your definition of "untrusted", but I think if another plugin could change the value, it think it should be considered untrusted. <br>
</span></font><div><div><font color="#000000" face="sans-serif"><span style="line-height:22px"><br></span></font></div></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jun 19, 2013 at 9:58 PM, Otto <span dir="ltr"><<a href="mailto:otto@ottodestruct.com" target="_blank">otto@ottodestruct.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On Wed, Jun 19, 2013 at 2:53 PM, Chip Bennett <<a href="mailto:chip@chipbennett.net">chip@chipbennett.net</a>> wrote:<br>
> Well now, don't even get started on why get_home_url() and home_url() both<br>
> *return* output, and core has no function to *echo* that output. ;)<br>
<br>
</div>I know. Legacy reasons there.<br>
<br>
But the bottom line is that adding escaping to home_url *will break<br>
existing things*. Quite a lot of them, in fact. So it ain't going to<br>
happen. Just saying.<br>
<br>
Getting a new function created to do what you think it should do is a<br>
better approach to take. But even then it's an uphill road.<br>
<div class="HOEnZb"><div class="h5"><br>
-Otto<br>
_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>I make free WordPress themes<br><a href="http://siteorigin.com" target="_blank">http://siteorigin.com</a>
</div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>theme-reviewers mailing list</span><br><span><a href="mailto:theme-reviewers@lists.wordpress.org">theme-reviewers@lists.wordpress.org</a></span><br><span><a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a></span><br></div></blockquote></body></html>