Check for encoding values passed to add_query_arg()

[westonruter]

This is something suitable both for WordPress-VIP and WordPress-Extra:

add_query_arg() is a really useful function, but it might not work as intended.
The values passed to it are not encoded meaning that passing

$m_yurl = 'admin.php?action=delete&post_id=321';
$my_url = add_query_arg( 'my_arg', 'somevalue&post_id=123', $my_url );

You would expect the url to be: admin.php?action=delete&post_id=321&somevalue%26post_id%3D123

But in fact it becomes: admin.php?action=delete&post_id=321&somevalue&post_id=123

Using rawurlencode() on the values passed to it prevents this.
https://vip.wordpress.com/documentation/encode-values-passed-to-add_query_arg/

See https://vip.wordpress.com/documentation/code-review-what-we-look-for/#encoding-values-passed-to-add_query_arg

[johnbillion]

+1