fix: wrap get_permalink() with esc_url() in excerpt_more filter

[thisismyurl]

The excerpt_more filter in app/filters.php places the result of get_permalink() directly into an href attribute without passing it through esc_url() first.

// Before
return sprintf(' &hellip; <a href="%s">%s</a>', get_permalink(), __('Continued', 'sage'));

// After
return sprintf(' &hellip; <a href="%s">%s</a>', esc_url( get_permalink() ), __('Continued', 'sage'));

get_permalink() does not sanitize or escape its output. While get_permalink() constructs from trusted data in most cases, WordPress coding standards require all URLs placed into href attributes to pass through esc_url() — both for correctness and because a filter on post_link (or a malformed custom permalink structure) could introduce unescaped characters that esc_url() would catch and neutralize.

This is a one-line, safe change with no functional impact on normal output.

---

AI disclosure: I use Claude Code as part of my development workflow. It helped me identify and verify this issue. I reviewed the code and the fix before opening this PR.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the WordPress excerpt “more” link to use a properly escaped permalink URL.

Changes:

• Escape the permalink output in the excerpt_more filter using esc_url().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[thisismyurl]

Good catch — pushed a follow-up that removes the extra spaces to match the file's existing style:

esc_url(get_permalink())