On my site, I need to redirect my js script back to my backend running PHP. Is the below considered safe to do? Safe as in safe from XSS or any other issues.
window.location.href = '<?php echo get_payment_receipt_page_link( $order_id ) . '?currency_code='. urlencode($currency); ?>' + '&user_wallet=' + encodeURIComponent(walletAddress) + '&txn_hash=' + encodeURIComponent(result);
If any of $order, $currency, walletAddress or result is comes from user input, it's not. Otherwise, it is.