Title: Encode values passed to `add_query_arg`
Author: WordPress VIP Documentation
Published: November 19, 2020
Last modified: August 20, 2025

---

 1. [Security](https://docs.wpvip.com/security/)
 2. Encode values passed to `add_query_arg`

#  Encode values passed to `add_query_arg`

VIP recommends checking the [WordPress Codex](https://codex.wordpress.org/Main_Page)
when using an unfamiliar or less frequently used function. The usage description
and user-supplied notes can help show “gotchas”, identify possible unexpected results,
or clarify whether the function returns output-safe results or if further escaping
is needed.

For example, the description for `[add_query_arg()](http://developer.wordpress.org/reference/functions/add_query_arg/)`
includes an important reminder:

> Values are expected to be encoded appropriately with `urlencode()` or `rawurlencode()`.

In the following code, imagine that a value from user input or a global input var
contains a complex string:

    ```lang-php
    $my_url = 'admin.php?action=delete&post_id=321';
    $my_url = add_query_arg( 'my_arg', 'somevalue&post_id=123', $my_url );
    ```

You may expect the resulting URL to be `admin.php?action=delete&post_id=123&my_arg
=somevalue%26post_id%3D123`
But, without encoding the value, the result is `admin.
php?action=delete&post_id=321&my_arg=somevalue&post_id=123`

The URL has now been hijacked, and if used, post 123 would be deleted instead of
321.

To protect against accidental or intentional exploits, use [`rawurlencode()`](http://php.net/manual/en/function.rawurlencode.php)
as the Developer Resource page recommends, so that `somevalue&post_id=123` is safely
encoded into `somevalue%26post_id%3D123`, protecting the intent of the URL.

This can be equally troublesome when attempting to intentionally pass a set of arguments
to a URL, such as a redirect after an action.

You can either convert every single argument:

    ```lang-php
    add_query_arg( 'my_arg', rawurlencode( 'somevalue&post_id=123' ), $myurl );
    ```

Or update all the arguments at once:

    ```lang-php
    $args = array(
    	'my_arg' => 'somevalue&post_id=123',
    	'my_second_arg' => $my_second_arg,
    );
    $args = array_map( 'rawurlencode', $args );
    $my_url = add_query_arg( $args, $my_url);
    ```

Using `rawurlencode` on any variable used as part of the query string, either by
using `add_query_arg()` or directly by string concatenation, will prevent parameter
hijacking.

Last updated: August 20, 2025