Fix: webhook URL lost percent-encoded characters on form save

[saurab018]

All Submissions:

• Have you followed the Everest Forms Contributing guideline?
• Does your code follow the WordPress' coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

Closes themegrill/everest-forms-pro#1247.

Problem. Saving a form strips every percent-encoded octet (%2F, %3D, …) from the Pro webhook Request URL. Signed URLs break as a result. A Microsoft Power Automate HTTP trigger URL with sp=%2Ftriggers%2Fmanual%2Frun is stored as sp=triggersmanualrun, the signature no longer matches, and Power Automate answers every submission with 401 AuthorizationFailed.

Root cause. evf_sanitize_builder() gives esc_url_raw() only to settings[external_url]. Every other plain-text setting falls through to sanitize_text_field(). That includes settings[webhooks][<id>][webhook_url], and core's _sanitize_text_fields() removes all /%[a-f0-9]{2}/i matches.

Fix. Webhook URL settings (any name ending in [webhook_url], which covers the multi-webhook and legacy single-webhook names) now take the same esc_url_raw() branch as the redirect URL. That is a one-line change in includes/evf-core-functions.php. esc_url_raw() is the correct sanitizer for a URL stored in the database, and it keeps encoded octets.

Notes

• The check sits in the same elseif chain, after the HTML check, so a value containing tags still goes through wp_kses_post() first, exactly as before.
• Forms saved before this fix already hold the stripped URL. Affected users have to re-enter the webhook URL once.
• The companion Pro PR fixes two bugs in the webhook sending code. It is independent of this PR, and neither needs the other to merge first. After this PR merges, Pro needs the usual everest-forms submodule pointer bump to pick it up.

Verified on a local site (WP + free 3.6.2 + Pro 1.9.21), in the real form builder with Playwright:

URL saved in the builder	Before	After
…?api-version=1&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=abc	…&sp=triggersmanualrun&…	unchanged
https://webhook.site/plain-hook	unchanged	unchanged
…?q="><script>alert(1)</script>	tags stripped	tags stripped (same branch as before)

The outgoing webhook request was also captured after the fix, and it carries the encoded URL byte for byte.

PHPCS: the changed line is clean against the repo's phpcs.xml.dist. The file's total violation count is the same before and after (pre-existing, untouched).

How to test the changes in this Pull Request:

Preconditions: Everest Forms Pro active, any form.

1. Open the form in the builder and go to Settings → Webhook. Enable Webhook, click Add New Webhook, enter any title, and click Continue.
2. Set Request URL to https://webhook.site/<your-id>?api-version=1&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=abc and Save.
3. Reload the builder and open Settings → Webhook again.
   • Expected: the Request URL still shows sp=%2Ftriggers%2Fmanual%2Frun. On develop it shows sp=triggersmanualrun.
4. Submit the form on the front end. On webhook.site, the request URL keeps sp=%2Ftriggers%2Fmanual%2Frun.
5. Regression: change the Request URL to a plain URL with no query string, save, reload, and submit. The URL is unchanged and the request arrives.
6. Regression: in Settings → General, set a redirect to a custom URL with an encoded query (e.g. ?a=%2Fx). Save and reload. It is unchanged, as before.

Types of changes:

• Bug fix (non-breaking change which fixes an issue)
• Enhancement (modification of the currently available functionality)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you successfully ran tests with your changes locally?
• Have you updated the documentation accordingly? (No documentation change needed.)

Changelog entry

Fix - Webhook URLs lost percent-encoded characters when the form was saved.

[github-actions]

QA suite — refused, no regression spec

This PR changes product source but adds no spec, so the suite was
refused before booting WordPress — running it just to report the same
thing at the end costs runner minutes for nothing. Run
/claudegrill:verify-fix locally and let write-spec add the guard
to this branch, then push again.

Source files changed with no matching spec

includes/evf-core-functions.php

[Copilot]

Copilot review overview

🟢 Approval recommended

The only outstanding feedback is a non-blocking test-coverage nit.

Review effort: Lite
Findings: 1

Open (1)

• Add regression test for evf_sanitize_builder URL encoding · New

What changed in this PR

Fixes form-save sanitization so webhook URLs retain percent-encoded characters.

Changes:

• Routes webhook URL settings through esc_url_raw().
• Preserves existing HTML sanitization behavior.

File	Summary
includes/​evf-core-functions.php	Preserves encoded webhook URL characters; a PHPUnit regression test was suggested as a minor nit (2 votes).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tg-autopilot]

Build for e0c08d0f is ready 🛎️

⬇️ Download everest-forms.zip (11M)

Installs directly via Plugins → Add New → Upload Plugin.
Link expires in 30 days · updated Oct 7, 2026 3:29 PM +0545

_{A later push only rebuilds this if its commit message includes #build-zip.}

[deepench]

LGTM 👍