Is there any other way to create more secure link in a drupal_set_message??
$loglink = l("bla bla", 'admin/config/services/blabla');
drupal_set_message(t("You should not have empty or the default fields in $loglink. You have to fill your own information."), 'error');
No, there isn't a more secure way, especially when you are not outputting input coming from the user. Still, you should be using t()-placeholders.
Drupal core uses the following code, when outputting an URL.
// system_requirements()
$requirements ['php'] = array(
'title' => $t('PHP'),
'value' => $phpversion,
'description' => $t('The phpinfo() function has been disabled for security reasons. To see your server\'s phpinfo() information, change your PHP settings or contact your server administrator. For more information, <a href="@phpinfo">Enabling and disabling phpinfo()</a> handbook page.', array('@phpinfo' => 'http://drupal.org/node/243993')),
'severity' => REQUIREMENT_INFO,
);
// action_synchronize()
$link = l(t('Remove orphaned actions'), 'admin/config/system/actions/orphan');
$count = count($actions_in_db);
$orphans = implode(', ', $orphaned);
watchdog('actions', '@count orphaned actions (%orphans) exist in the actions table. !link', array('@count' => $count, '%orphans' => $orphans, '!link' => $link), WATCHDOG_INFO);
The only difference is that, in the first case, the code is outputting an external URL while, in the other case, the URL is internal to the website.
