[wp-trac] [WordPress Trac] #62118: Code Improvement Suggestion

[WordPress Trac]

#62118: Code Improvement Suggestion
----------------------------+------------------------------
 Reporter:  ramswarup       |       Owner:  (none)
     Type:  enhancement     |      Status:  new
 Priority:  low             |   Milestone:  Awaiting Review
Component:  Administration  |     Version:  6.6.2
 Severity:  minor           |  Resolution:
 Keywords:                  |     Focuses:
----------------------------+------------------------------
Changes (by swissspidy):

 * focuses:  coding-standards =>
 * component:  General => Administration
 * priority:  normal => low
 * keywords:  needs-testing changes-requested =>
 * type:  feature request => enhancement
 * severity:  normal => minor


Old description:

> Code Improvement Suggestion for admin footer \wp-admin\admin-footer.php
> line No. 35
>
> $text = sprintf(
>         /* translators: %s: https://wordpress.org/ */
>         __( 'Thank you for creating with <a href="%s">WordPress</a>.' ),
>         __( 'https://wordpress.org/' )
> );
>

>
> Should we use esc_url() here instead of __ (underscore) to ensure that
> the URL is valid and protected from cross-site scripting?
>

> $text = sprintf(
>         /* translators: %s: https://wordpress.org/ */
>         __('Thank you for creating with <a href="%s">WordPress</a>.'),
>         esc_url('https://wordpress.org/')
> );
>
> Thanks!

New description:

 Code Improvement Suggestion for admin footer \wp-admin\admin-footer.php
 line No. 35

 {{{#!php

 $text = sprintf(
         /* translators: %s: https://wordpress.org/ */
         __( 'Thank you for creating with <a href="%s">WordPress</a>.' ),
         __( 'https://wordpress.org/' )
 );
 }}}


 Should we use `esc_url()` here instead of `__` (underscore) to ensure that
 the URL is valid and protected from cross-site scripting?


 {{{#!php
 $text = sprintf(
         /* translators: %s: https://wordpress.org/ */
         __('Thank you for creating with <a href="%s">WordPress</a>.'),
         esc_url( 'https://wordpress.org/' )
 );
 }}}

 Thanks!

--

Comment:

 Hi there and welcome to Trac!

 > instead of

 Definitely not ''instead of''. `__()` is important as it allows for the
 URL to be translated.

 To be honest we're pretty inconsistent in core with escaping the URLs in
 cases like this. On one hand we do trust translations to be correct, on
 the other hand it can't hurt to add it.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/62118#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform