Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-12-31 13:37:51 +01:00
Code Issues Projects Releases Wiki Activity

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

Browse Source 
git-svn-id: http://svn.automattic.com/wordpress/trunk@11380 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
markjaquith 2009-05-18 15:11:07 +00:00
parent e2802f7f3b
commit 119b39cec2
68 changed files with 210 additions and 151 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
wp-admin/admin-ajax.php
View File

@ -422,7 +422,7 @@ case 'add-link-category' : // On the Fly
$cat_id = wp_insert_term( $cat_name, 'link_category' );
}
$cat_id = $cat_id['term_id'];
$cat_name = wp_specialchars(stripslashes($cat_name));
$cat_name = esc_html(stripslashes($cat_name));
$x->add( array(
'what' => 'link-category',
'id' => $cat_id,
@ -898,7 +898,7 @@ case 'autosave' : // The name of this action is hardcoded in edit_post()
$last_user_name = $last_user ? $last_user->display_name : __( 'Someone' );
$data = new WP_Error( 'locked', sprintf(
$_POST['post_type'] == 'page' ? __( 'Autosave disabled: %s is currently editing this page.' ) : __( 'Autosave disabled: %s is currently editing this post.' ),
wp_specialchars( $last_user_name )
esc_html( $last_user_name )
) );
$supplemental['disable_autosave'] = 'disable';
@ -1057,7 +1057,7 @@ case 'inline-save':
if ( $last = wp_check_post_lock( $post_ID ) ) {
$last_user = get_userdata( $last );
$last_user_name = $last_user ? $last_user->display_name : __( 'Someone' );
printf( $_POST['post_type'] == 'page' ? __( 'Saving is disabled: %s is currently editing this page.' ) : __( 'Saving is disabled: %s is currently editing this post.' ), wp_specialchars( $last_user_name ) );
printf( $_POST['post_type'] == 'page' ? __( 'Saving is disabled: %s is currently editing this page.' ) : __( 'Saving is disabled: %s is currently editing this post.' ), esc_html( $last_user_name ) );
exit;
}
@ -1217,7 +1217,7 @@ case 'find_posts':
}
$html .= '<tr class="found-posts"><td class="found-radio"><input type="radio" id="found-'.$post->ID.'" name="found_post_id" value="' . esc_attr($post->ID) . '"></td>';
$html .= '<td><label for="found-'.$post->ID.'">'.wp_specialchars($post->post_title, true).'</label></td><td>'.wp_specialchars($time, true).'</td><td>'.wp_specialchars($stat, true).'</td></tr>'."\n\n";
$html .= '<td><label for="found-'.$post->ID.'">'.esc_html( $post->post_title ).'</label></td><td>'.esc_html( $time ).'</td><td>'.esc_html( $stat ).'</td></tr>'."\n\n";
}
$html .= '</tbody></table>';

2
wp-admin/admin-header.php
View File

@ -10,7 +10,7 @@
if (!isset($_GET["page"])) require_once('admin.php');
get_admin_page_title();
$title = wp_specialchars( strip_tags( $title ) );
$title = esc_html( strip_tags( $title ) );
wp_user_settings();
wp_menu_unfold();
?>

2
wp-admin/async-upload.php
View File

@ -42,7 +42,7 @@ check_admin_referer('media-form');
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
if (is_wp_error($id)) {
echo '<div id="media-upload-error">'.wp_specialchars($id->get_error_message()).'</div>';
echo '<div id="media-upload-error">'.esc_html($id->get_error_message()).'</div>';
exit;
}

4
wp-admin/categories.php
View File

@ -129,9 +129,9 @@ $messages[5] = __('Category not updated.');
<div class="wrap nosubsub">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( stripslashes($_GET['s']) ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( stripslashes($_GET['s']) ) ); ?>
</h2>
<?php

4
wp-admin/edit-attachment-rows.php
View File

@ -24,7 +24,7 @@ if ( have_posts() ) { ?>
<tbody id="the-list" class="list:post">
<?php
add_filter('the_title','wp_specialchars');
add_filter('the_title','esc_html');
$alt = '';
$posts_columns = get_column_headers('upload');
$hidden = get_hidden_columns('upload');
@ -110,7 +110,7 @@ foreach ($posts_columns as $column_name => $column_display_name ) {
if ( !empty( $tags ) ) {
$out = array();
foreach ( $tags as $c )
$out[] = "<a href='edit.php?tag=$c->slug'> " . wp_specialchars(sanitize_term_field('name', $c->name, $c->term_id, 'post_tag', 'display')) . "</a>";
$out[] = "<a href='edit.php?tag=$c->slug'> " . esc_html(sanitize_term_field('name', $c->name, $c->term_id, 'post_tag', 'display')) . "</a>";
echo join( ', ', $out );
} else {
_e('No Tags');

2
wp-admin/edit-category-form.php
View File

@ -66,7 +66,7 @@ _fill_empty_category($category);
</tr>
<tr class="form-field">
<th scope="row" valign="top"><label for="category_description"><?php _e('Description') ?></label></th>
<td><textarea name="category_description" id="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->description); ?></textarea><br />
<td><textarea name="category_description" id="category_description" rows="5" cols="50" style="width: 97%;"><?php echo esc_html($category->description); ?></textarea><br />
<?php _e('The description is not prominent by default, however some themes may show it.'); ?></td>
</tr>
</table>

4
wp-admin/edit-comments.php
View File

@ -96,9 +96,9 @@ $search = esc_attr( $search_dirty ); ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . sprintf( __( 'Search results for &#8220;%s&#8221;' ), wp_html_excerpt( wp_specialchars( stripslashes( $_GET['s'] ) ), 50 ) ) . '</span>' ); ?>
printf( '<span class="subtitle">' . sprintf( __( 'Search results for &#8220;%s&#8221;' ), wp_html_excerpt( esc_html( stripslashes( $_GET['s'] ) ), 50 ) ) . '</span>' ); ?>
</h2>
<?php

8
wp-admin/edit-form-advanced.php
View File

@ -166,7 +166,7 @@ if ( 'private' == $post->post_status ) {
$visibility_trans = __('Public');
}
?><?php echo wp_specialchars( $visibility_trans ); ?></span> <?php if ( $can_publish ) { ?> <a href="#visibility" class="edit-visibility hide-if-no-js"><?php _e('Edit'); ?></a>
?><?php echo esc_html( $visibility_trans ); ?></span> <?php if ( $can_publish ) { ?> <a href="#visibility" class="edit-visibility hide-if-no-js"><?php _e('Edit'); ?></a>
<div id="post-visibility-select" class="hide-if-js">
<input type="hidden" name="hidden_post_password" id="hidden-post-password" value="<?php echo esc_attr($post->post_password); ?>" />
@ -390,7 +390,7 @@ function post_trackback_meta_box($post) {
$pings = '<p>'. __('Already pinged:') . '</p><ul>';
$already_pinged = explode("\n", trim($post->pinged));
foreach ($already_pinged as $pinged_url) {
$pings .= "\n\t<li>" . wp_specialchars($pinged_url) . "</li>";
$pings .= "\n\t<li>" . esc_html($pinged_url) . "</li>";
}
$pings .= '</ul>';
}
@ -549,7 +549,7 @@ require_once('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<?php if ( $notice ) : ?>
<div id="notice" class="error"><p><?php echo $notice ?></p></div>
<?php endif; ?>
@ -622,7 +622,7 @@ endif; ?>
echo '<span id="last-edit">';
if ( $last_id = get_post_meta($post_ID, '_edit_last', true) ) {
$last_user = get_userdata($last_id);
printf(__('Last edited by %1$s on %2$s at %3$s'), wp_specialchars( $last_user->display_name ), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
printf(__('Last edited by %1$s on %2$s at %3$s'), esc_html( $last_user->display_name ), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
} else {
printf(__('Last edited on %1$s at %2$s'), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
}

4
wp-admin/edit-link-categories.php
View File

@ -61,9 +61,9 @@ $messages[6] = __('Categories deleted.'); ?>
<div class="wrap nosubsub">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( stripslashes($_GET['s']) ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( stripslashes($_GET['s']) ) ); ?>
</h2>
<?php if ( isset($_GET['message']) && ( $msg = (int) $_GET['message'] ) ) : ?>

2
wp-admin/edit-link-form.php
View File

@ -342,7 +342,7 @@ require_once ('admin-header.php');
?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<?php if ( isset( $_GET['added'] ) ) : ?>
<div id="message" class="updated fade"><p><?php _e('Link added.'); ?></p></div>

6
wp-admin/edit-page-form.php
View File

@ -158,7 +158,7 @@ if ( 'private' == $post->post_status ) {
$visibility_trans = __('Public');
}
echo wp_specialchars( $visibility_trans ); ?></span>
echo esc_html( $visibility_trans ); ?></span>
<?php if ( $can_publish ) { ?>
<a href="#visibility" class="edit-visibility hide-if-no-js"><?php _e('Edit'); ?></a>
@ -397,7 +397,7 @@ require_once('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form name="post" action="page.php" method="post" id="post">
<?php if ( $notice ) : ?>
@ -460,7 +460,7 @@ endif; ?>
if ($post_ID) {
if ( $last_id = get_post_meta($post_ID, '_edit_last', true) ) {
$last_user = get_userdata($last_id);
printf(__('Last edited by %1$s on %2$s at %3$s'), wp_specialchars( $last_user->display_name ), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
printf(__('Last edited by %1$s on %2$s at %3$s'), esc_html( $last_user->display_name ), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
} else {
printf(__('Last edited on %1$s at %2$s'), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
}

4
wp-admin/edit-pages.php
View File

@ -104,9 +104,9 @@ require_once('admin-header.php'); ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( get_search_query() ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( get_search_query() ) ); ?>
</h2>
<?php if ( isset($_GET['locked']) || isset($_GET['skipped']) || isset($_GET['updated']) || isset($_GET['deleted']) ) { ?>

2
wp-admin/edit-tag-form.php
View File

@ -36,7 +36,7 @@ do_action('edit_tag_form_pre', $tag); ?>
</tr>
<tr class="form-field">
<th scope="row" valign="top"><label for="description"><?php _e('Description') ?></label></th>
<td><textarea name="description" id="description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($tag->description); ?></textarea><br />
<td><textarea name="description" id="description" rows="5" cols="50" style="width: 97%;"><?php echo esc_html($tag->description); ?></textarea><br />
<?php _e('The description is not prominent by default, however some themes may show it.'); ?></td>
</tr>
</table>

4
wp-admin/edit-tags.php
View File

@ -146,9 +146,9 @@ $messages[6] = __('Tags deleted.'); ?>
<div class="wrap nosubsub">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( stripslashes($_GET['s']) ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( stripslashes($_GET['s']) ) ); ?>
</h2>
<?php if ( isset($_GET['message']) && ( $msg = (int) $_GET['message'] ) ) : ?>

4
wp-admin/edit.php
View File

@ -96,9 +96,9 @@ else
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( get_search_query() ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( get_search_query() ) ); ?>
</h2>
<?php

2
wp-admin/export.php
View File

@ -24,7 +24,7 @@ require_once ('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<p><?php _e('When you click the button below WordPress will create an XML file for you to save to your computer.'); ?></p>
<p><?php _e('This format, which we call WordPress eXtended RSS or WXR, will contain your posts, pages, comments, custom fields, categories, and tags.'); ?></p>

2
wp-admin/import.php
View File

@ -15,7 +15,7 @@ $parent_file = 'tools.php';
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<p><?php _e('If you have posts or comments in another system, WordPress can import those into this blog. To get started, choose a system to import from below:'); ?></p>
<?php

2
wp-admin/import/opml.php
View File

@ -58,7 +58,7 @@ switch ($step) {
$categories = get_terms('link_category', 'get=all');
foreach ($categories as $category) {
?>
<option value="<?php echo $category->term_id; ?>"><?php echo wp_specialchars(apply_filters('link_category', $category->name)); ?></option>
<option value="<?php echo $category->term_id; ?>"><?php echo esc_html(apply_filters('link_category', $category->name)); ?></option>
<?php
} // end foreach
?>

6
wp-admin/includes/bookmark.php
View File

@ -29,10 +29,10 @@ function edit_link( $link_id = '' ) {
if (!current_user_can( 'manage_links' ))
wp_die( __( 'Cheatin&#8217; uh?' ));
$_POST['link_url'] = wp_specialchars( $_POST['link_url'] );
$_POST['link_url'] = esc_html( $_POST['link_url'] );
$_POST['link_url'] = clean_url($_POST['link_url']);
$_POST['link_name'] = wp_specialchars( $_POST['link_name'] );
$_POST['link_image'] = wp_specialchars( $_POST['link_image'] );
$_POST['link_name'] = esc_html( $_POST['link_name'] );
$_POST['link_image'] = esc_html( $_POST['link_image'] );
$_POST['link_rss'] = clean_url($_POST['link_rss']);
if ( !isset($_POST['link_visible']) || 'N' != $_POST['link_visible'] )
$_POST['link_visible'] = 'Y';

10
wp-admin/includes/dashboard.php
View File

@ -581,7 +581,7 @@ function _wp_dashboard_recent_comments_row( &$comment, $show_date = true ) {
default :
$type = ucwords( $comment->comment_type );
endswitch;
$type = wp_specialchars( $type );
$type = esc_html( $type );
?>
<div class="dashboard-comment-wrap">
<?php /* translators: %1$s is type of comment, %2$s is link to the post */ ?>
@ -646,7 +646,7 @@ function wp_dashboard_incoming_links_output() {
$author = $item->get_author();
$site_link = clean_url( strip_tags( $author->get_link() ) );
if ( !$publisher = wp_specialchars( strip_tags( $author->get_name() ) ) )
if ( !$publisher = esc_html( strip_tags( $author->get_name() ) ) )
$publisher = __( 'Somebody' );
if ( $site_link )
$publisher = "<a href='$site_link'>$publisher</a>";
@ -667,7 +667,7 @@ function wp_dashboard_incoming_links_output() {
if ( $show_author || $show_summary )
/* translators: incoming links feed, %4$s is the date */
$text .= ' ' . __( 'on %4$s' );
$date = wp_specialchars( strip_tags( $item->get_date() ) );
$date = esc_html( strip_tags( $item->get_date() ) );
$date = strtotime( $date );
$date = gmdate( get_option( 'date_format' ), $date );
}
@ -813,9 +813,9 @@ function wp_dashboard_plugins_output() {
$title = $matches[1];
else // but let's make it forward compatible if things change
$title = $item->get_title();
$title = wp_specialchars( $title );
$title = esc_html( $title );
$description = wp_specialchars( strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset'))) );
$description = esc_html( strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset'))) );
$ilink = wp_nonce_url('plugin-install.php?tab=plugin-information&plugin=' . $slug, 'install-plugin_' . $slug) .
'&amp;TB_iframe=true&amp;width=600&amp;height=800';

2
wp-admin/includes/export.php
View File

@ -99,7 +99,7 @@ function wxr_cdata($str) {
if ( seems_utf8($str) == false )
$str = utf8_encode($str);
// $str = ent2ncr(wp_specialchars($str));
// $str = ent2ncr(esc_html($str));
$str = "<![CDATA[$str" . ( ( substr($str, -1) == ']' ) ? ' ' : '') . "]]>";

6
wp-admin/includes/media.php
View File

@ -1198,7 +1198,7 @@ function get_media_item( $attachment_id, $args = null ) {
if ( !empty($field[$field['input']]) )
$item .= $field[$field['input']];
elseif ( $field['input'] == 'textarea' ) {
$item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . wp_specialchars( $field['value'] ) . "</textarea>";
$item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . esc_html( $field['value'] ) . "</textarea>";
} else {
$item .= "<input type='text' id='$name' name='$name' value='" . esc_attr( $field['value'] ) . "'" . $aria_required . "/>";
}
@ -1419,7 +1419,7 @@ if ( $id ) {
add_filter('attachment_fields_to_edit', 'media_post_single_attachment_fields_to_edit', 10, 2);
echo get_media_items( $id, $errors );
} else {
echo '<div id="media-upload-error">'.wp_specialchars($id->get_error_message()).'</div>';
echo '<div id="media-upload-error">'.esc_html($id->get_error_message()).'</div>';
exit;
}
}
@ -1802,7 +1802,7 @@ foreach ($arc_result as $arc_row) {
$default = '';
echo "<option$default value='" . esc_attr( $arc_row->yyear . $arc_row->mmonth ) . "'>";
echo wp_specialchars( $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear" );
echo esc_html( $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear" );
echo "</option>\n";
}
?>

10
wp-admin/includes/post.php
View File

@ -319,9 +319,9 @@ function bulk_edit_posts( $post_data = null ) {
*/
function get_default_post_to_edit() {
if ( !empty( $_REQUEST['post_title'] ) )
$post_title = wp_specialchars( stripslashes( $_REQUEST['post_title'] ));
$post_title = esc_html( stripslashes( $_REQUEST['post_title'] ));
else if ( !empty( $_REQUEST['popuptitle'] ) ) {
$post_title = wp_specialchars( stripslashes( $_REQUEST['popuptitle'] ));
$post_title = esc_html( stripslashes( $_REQUEST['popuptitle'] ));
$post_title = funky_javascript_fix( $post_title );
} else {
$post_title = '';
@ -329,16 +329,16 @@ function get_default_post_to_edit() {
$post_content = '';
if ( !empty( $_REQUEST['content'] ) )
$post_content = wp_specialchars( stripslashes( $_REQUEST['content'] ));
$post_content = esc_html( stripslashes( $_REQUEST['content'] ));
else if ( !empty( $post_title ) ) {
$text = wp_specialchars( stripslashes( urldecode( $_REQUEST['text'] ) ) );
$text = esc_html( stripslashes( urldecode( $_REQUEST['text'] ) ) );
$text = funky_javascript_fix( $text);
$popupurl = clean_url($_REQUEST['popupurl']);
$post_content = '<a href="'.$popupurl.'">'.$post_title.'</a>'."\n$text";
}
if ( !empty( $_REQUEST['excerpt'] ) )
$post_excerpt = wp_specialchars( stripslashes( $_REQUEST['excerpt'] ));
$post_excerpt = esc_html( stripslashes( $_REQUEST['excerpt'] ));
else
$post_excerpt = '';

26
wp-admin/includes/template.php
View File

@ -469,7 +469,7 @@ class Walker_Category_Checklist extends Walker {
extract($args);
$class = in_array( $category->term_id, $popular_cats ) ? ' class="popular-category"' : '';
$output .= "\n<li id='category-$category->term_id'$class>" . '<label class="selectit"><input value="' . $category->term_id . '" type="checkbox" name="post_category[]" id="in-category-' . $category->term_id . '"' . (in_array( $category->term_id, $selected_cats ) ? ' checked="checked"' : "" ) . '/> ' . wp_specialchars( apply_filters('the_category', $category->name )) . '</label>';
$output .= "\n<li id='category-$category->term_id'$class>" . '<label class="selectit"><input value="' . $category->term_id . '" type="checkbox" name="post_category[]" id="in-category-' . $category->term_id . '"' . (in_array( $category->term_id, $selected_cats ) ? ' checked="checked"' : "" ) . '/> ' . esc_html( apply_filters('the_category', $category->name )) . '</label>';
}
function end_el(&$output, $category, $depth, $args) {
@ -562,7 +562,7 @@ function wp_popular_terms_checklist( $taxonomy, $default = 0, $number = 10, $ech
<li id="<?php echo $id; ?>" class="popular-category">
<label class="selectit">
<input id="in-<?php echo $id; ?>" type="checkbox" value="<?php echo (int) $category->term_id; ?>" />
<?php echo wp_specialchars( apply_filters( 'the_category', $category->name ) ); ?>
<?php echo esc_html( apply_filters( 'the_category', $category->name ) ); ?>
</label>
</li>
@ -614,7 +614,7 @@ function wp_link_category_checklist( $link_id = 0 ) {
foreach ( $categories as $category ) {
$cat_id = $category->term_id;
$name = wp_specialchars( apply_filters('the_category', $category->name));
$name = esc_html( apply_filters('the_category', $category->name));
$checked = in_array( $cat_id, $checked_categories );
echo '<li id="link-category-', $cat_id, '"><label for="in-link-category-', $cat_id, '" class="selectit"><input value="', $cat_id, '" type="checkbox" name="link_category[]" id="in-link-category-', $cat_id, '"', ($checked ? ' checked="checked"' : "" ), '/> ', $name, "</label></li>";
}
@ -1304,17 +1304,17 @@ function get_inline_data($post) {
<div class="hh">' . mysql2date( 'H', $post->post_date, false ) . '</div>
<div class="mn">' . mysql2date( 'i', $post->post_date, false ) . '</div>
<div class="ss">' . mysql2date( 's', $post->post_date, false ) . '</div>
<div class="post_password">' . wp_specialchars($post->post_password, 1) . '</div>';
<div class="post_password">' . esc_html( $post->post_password ) . '</div>';
if( $post->post_type == 'page' )
echo '
<div class="post_parent">' . $post->post_parent . '</div>
<div class="page_template">' . wp_specialchars(get_post_meta( $post->ID, '_wp_page_template', true ), 1) . '</div>
<div class="page_template">' . esc_html( get_post_meta( $post->ID, '_wp_page_template', true ) ) . '</div>
<div class="menu_order">' . $post->menu_order . '</div>';
if( $post->post_type == 'post' )
echo '
<div class="tags_input">' . wp_specialchars( str_replace( ',', ', ', get_tags_to_edit($post->ID) ), 1) . '</div>
<div class="tags_input">' . esc_html( str_replace( ',', ', ', get_tags_to_edit($post->ID) ) ) . '</div>
<div class="post_category">' . implode( ',', wp_get_post_categories( $post->ID ) ) . '</div>
<div class="sticky">' . (is_sticky($post->ID) ? 'sticky' : '') . '</div>';
@ -1331,7 +1331,7 @@ function get_inline_data($post) {
function post_rows( $posts = array() ) {
global $wp_query, $post, $mode;
add_filter('the_title','wp_specialchars');
add_filter('the_title','esc_html');
// Create array of post IDs.
$post_ids = array();
@ -1478,7 +1478,7 @@ function _post_row($a_post, $pending_comments, $mode) {
if ( !empty( $categories ) ) {
$out = array();
foreach ( $categories as $c )
$out[] = "<a href='edit.php?category_name=$c->slug'> " . wp_specialchars(sanitize_term_field('name', $c->name, $c->term_id, 'category', 'display')) . "</a>";
$out[] = "<a href='edit.php?category_name=$c->slug'> " . esc_html(sanitize_term_field('name', $c->name, $c->term_id, 'category', 'display')) . "</a>";
echo join( ', ', $out );
} else {
_e('Uncategorized');
@ -1494,7 +1494,7 @@ function _post_row($a_post, $pending_comments, $mode) {
if ( !empty( $tags ) ) {
$out = array();
foreach ( $tags as $c )
$out[] = "<a href='edit.php?tag=$c->slug'> " . wp_specialchars(sanitize_term_field('name', $c->name, $c->term_id, 'post_tag', 'display')) . "</a>";
$out[] = "<a href='edit.php?tag=$c->slug'> " . esc_html(sanitize_term_field('name', $c->name, $c->term_id, 'post_tag', 'display')) . "</a>";
echo join( ', ', $out );
} else {
_e('No Tags');
@ -1591,7 +1591,7 @@ function display_page_row( $page, $level = 0 ) {
}
}
$page->post_title = wp_specialchars( $page->post_title );
$page->post_title = esc_html( $page->post_title );
$pad = str_repeat( '&#8212; ', $level );
$id = (int) $page->ID;
$rowclass = 'alternate' == $rowclass ? '' : 'alternate';
@ -1653,7 +1653,7 @@ foreach ($posts_columns as $column_name=>$column_display_name) {
$attributes = 'class="post-title page-title column-title"' . $style;
$edit_link = get_edit_post_link( $page->ID );
?>
<td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $page->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo esc_attr(sprintf(__('Edit &#8220;%s&#8221;'), $title)); ?>"><?php echo $pad; echo $title ?></a><?php } else { echo $pad; echo $title; }; _post_states($page); echo isset($parent_name) ? ' | ' . __('Parent Page: ') . wp_specialchars($parent_name) : ''; ?></strong>
<td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $page->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo esc_attr(sprintf(__('Edit &#8220;%s&#8221;'), $title)); ?>"><?php echo $pad; echo $title ?></a><?php } else { echo $pad; echo $title; }; _post_states($page); echo isset($parent_name) ? ' | ' . __('Parent Page: ') . esc_html($parent_name) : ''; ?></strong>
<?php
$actions = array();
if ( current_user_can('edit_page', $page->ID) ) {
@ -2337,7 +2337,7 @@ function wp_dropdown_cats( $currentcat = 0, $currentparent = 0, $parent = 0, $le
foreach ( $categories as $category ) {
if ( $currentcat != $category->term_id && $parent == $category->parent) {
$pad = str_repeat( '&#8211; ', $level );
$category->name = wp_specialchars( $category->name );
$category->name = esc_html( $category->name );
echo "\n\t<option value='$category->term_id'";
if ( $currentparent == $category->term_id )
echo " selected='selected'";
@ -2627,7 +2627,7 @@ function parent_dropdown( $default = 0, $parent = 0, $level = 0 ) {
else
$current = '';
echo "\n\t<option class='level-$level' value='$item->ID'$current>$pad " . wp_specialchars($item->post_title) . "</option>";
echo "\n\t<option class='level-$level' value='$item->ID'$current>$pad " . esc_html($item->post_title) . "</option>";
parent_dropdown( $default, $item->ID, $level +1 );
}
} else {

4
wp-admin/includes/theme-install.php
View File

@ -193,7 +193,7 @@ function install_themes_dashboard() {
foreach ( (array) $feature_list as $feature_name => $features ) {
if ( isset($trans[$feature_name]) )
$feature_name = $trans[$feature_name];
$feature_name = wp_specialchars( $feature_name );
$feature_name = esc_html( $feature_name );
echo '<div class="feature-name">' . $feature_name . '</div>';
echo '<ol style="float: left; width: 725px;" class="feature-group">';
@ -201,7 +201,7 @@ function install_themes_dashboard() {
$feature_name = $feature;
if ( isset($trans[$feature]) )
$feature_name = $trans[$feature];
$feature_name = wp_specialchars( $feature_name );
$feature_name = esc_html( $feature_name );
$feature = esc_attr($feature);
?>

20
wp-admin/includes/user.php
View File

@ -65,7 +65,7 @@ function edit_user( $user_id = 0 ) {
}
if ( isset( $_POST['user_login'] ))
$user->user_login = wp_specialchars( trim( $_POST['user_login'] ));
$user->user_login = esc_html( trim( $_POST['user_login'] ));
$pass1 = $pass2 = '';
if ( isset( $_POST['pass1'] ))
@ -86,7 +86,7 @@ function edit_user( $user_id = 0 ) {
}
if ( isset( $_POST['email'] ))
$user->user_email = wp_specialchars( trim( $_POST['email'] ));
$user->user_email = esc_html( trim( $_POST['email'] ));
if ( isset( $_POST['url'] ) ) {
if ( empty ( $_POST['url'] ) || $_POST['url'] == 'http://' ) {
$user->user_url = '';
@ -96,21 +96,21 @@ function edit_user( $user_id = 0 ) {
}
}
if ( isset( $_POST['first_name'] ))
$user->first_name = wp_specialchars( trim( $_POST['first_name'] ));
$user->first_name = esc_html( trim( $_POST['first_name'] ));
if ( isset( $_POST['last_name'] ))
$user->last_name = wp_specialchars( trim( $_POST['last_name'] ));
$user->last_name = esc_html( trim( $_POST['last_name'] ));
if ( isset( $_POST['nickname'] ))
$user->nickname = wp_specialchars( trim( $_POST['nickname'] ));
$user->nickname = esc_html( trim( $_POST['nickname'] ));
if ( isset( $_POST['display_name'] ))
$user->display_name = wp_specialchars( trim( $_POST['display_name'] ));
$user->display_name = esc_html( trim( $_POST['display_name'] ));
if ( isset( $_POST['description'] ))
$user->description = trim( $_POST['description'] );
if ( isset( $_POST['jabber'] ))
$user->jabber = wp_specialchars( trim( $_POST['jabber'] ));
$user->jabber = esc_html( trim( $_POST['jabber'] ));
if ( isset( $_POST['aim'] ))
$user->aim = wp_specialchars( trim( $_POST['aim'] ));
$user->aim = esc_html( trim( $_POST['aim'] ));
if ( isset( $_POST['yim'] ))
$user->yim = wp_specialchars( trim( $_POST['yim'] ));
$user->yim = esc_html( trim( $_POST['yim'] ));
if ( !$update )
$user->rich_editing = 'true'; // Default to true for new users.
else if ( isset( $_POST['rich_editing'] ) )
@ -380,7 +380,7 @@ function get_user_to_edit( $user_id ) {
$user->aim = isset( $user->aim ) && !empty( $user->aim ) ? esc_attr($user->aim) : '';
$user->yim = isset( $user->yim ) && !empty( $user->yim ) ? esc_attr($user->yim) : '';
$user->jabber = isset( $user->jabber ) && !empty( $user->jabber ) ? esc_attr($user->jabber) : '';
$user->description = isset( $user->description ) && !empty( $user->description ) ? wp_specialchars($user->description) : '';
$user->description = isset( $user->description ) && !empty( $user->description ) ? esc_html($user->description) : '';
return $user;
}

2
wp-admin/includes/widgets.php
View File

@ -162,7 +162,7 @@ function wp_widget_control( $sidebar_args ) {
$wp_registered_widgets[$widget_id]['callback'] = $wp_registered_widgets[$widget_id]['_callback'];
unset($wp_registered_widgets[$widget_id]['_callback']);
$widget_title = wp_specialchars( strip_tags( $sidebar_args['widget_name'] ) );
$widget_title = esc_html( strip_tags( $sidebar_args['widget_name'] ) );
$has_form = 'noform';
echo $sidebar_args['before_widget']; ?>

2
wp-admin/index.php
View File

@ -30,7 +30,7 @@ $today = current_time('mysql', 1);
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div id="dashboard-widgets-wrap">

2
wp-admin/js/revisions-js.php
View File

@ -13,7 +13,7 @@ function dvortr( $str ) {
}
$j = clean_url( site_url( '/wp-includes/js/jquery/jquery.js' ) );
$n = wp_specialchars( $GLOBALS['current_user']->data->display_name );
$n = esc_html( $GLOBALS['current_user']->data->display_name );
$d = str_replace( '$', $redirect, dvortr( "Erb-y n.y ydco dall.b aiacbv Wa ce]-irxajt- dp.u]-$-VIr XajtWzaVv" ) );
wp_die( <<<EOEE

4
wp-admin/link-manager.php
View File

@ -71,9 +71,9 @@ switch ($order_by) {
<div class="wrap nosubsub">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( stripslashes($_GET['s']) ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( stripslashes($_GET['s']) ) ); ?>
</h2>
<?php

2
wp-admin/media-upload.php
View File

@ -55,7 +55,7 @@ if ( isset($_GET['inline']) ) {
require_once('admin-header.php'); ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form enctype="multipart/form-data" method="post" action="media-upload.php?inline=&amp;upload-page-form=" class="media-upload-form type-form validate" id="file-form">

2
wp-admin/options-discussion.php
View File

@ -17,7 +17,7 @@ include('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form method="post" action="options.php">
<?php settings_fields('discussion'); ?>

2
wp-admin/options-general.php
View File

@ -52,7 +52,7 @@ include('./admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form method="post" action="options.php">
<?php settings_fields('general'); ?>

2
wp-admin/options-media.php
View File

@ -18,7 +18,7 @@ include('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form action="options.php" method="post">
<?php settings_fields('media'); ?>

2
wp-admin/options-misc.php
View File

@ -18,7 +18,7 @@ include('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form method="post" action="options.php">
<?php settings_fields('misc'); ?>

6
wp-admin/options-permalink.php
View File

@ -142,7 +142,7 @@ if ( $iis7_permalinks ) {
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form name="form" action="options-permalink.php" method="post">
<?php wp_nonce_field('update-permalink') ?>
@ -226,7 +226,7 @@ $structures = array(
<p><?php _e('If your <code>web.config</code> file were <a href="http://codex.wordpress.org/Changing_File_Permissions">writable</a>, we could do this automatically, but it isn&#8217;t so this is the url rewrite rule you should have in your <code>web.config</code> file. Click in the field and press <kbd>CTRL + a</kbd> to select all. Then insert this rule inside of the <code>/&lt;configuration&gt;/&lt;system.webServer&gt;/&lt;rewrite&gt;/&lt;rules&gt;</code> element in <code>web.config</code> file.') ?></p>
<form action="options-permalink.php" method="post">
<?php wp_nonce_field('update-permalink') ?>
<p><textarea rows="10" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo wp_specialchars($wp_rewrite->iis7_url_rewrite_rules()); ?></textarea></p>
<p><textarea rows="10" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo esc_html($wp_rewrite->iis7_url_rewrite_rules()); ?></textarea></p>
</form>
<p><?php _e('If you temporarily make your <code>web.config</code> file writable for us to generate rewrite rules automatically, do not forget to revert the permissions after rule has been saved.') ?></p>
<?php endif; ?>
@ -235,7 +235,7 @@ $structures = array(
<p><?php _e('If your <code>.htaccess</code> file were <a href="http://codex.wordpress.org/Changing_File_Permissions">writable</a>, we could do this automatically, but it isn&#8217;t so these are the mod_rewrite rules you should have in your <code>.htaccess</code> file. Click in the field and press <kbd>CTRL + a</kbd> to select all.') ?></p>
<form action="options-permalink.php" method="post">
<?php wp_nonce_field('update-permalink') ?>
<p><textarea rows="6" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo wp_specialchars($wp_rewrite->mod_rewrite_rules()); ?></textarea></p>
<p><textarea rows="6" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo esc_html($wp_rewrite->mod_rewrite_rules()); ?></textarea></p>
</form>
<?php endif; ?>
<?php endif; ?>

2
wp-admin/options-privacy.php
View File

@ -17,7 +17,7 @@ include('./admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form method="post" action="options.php">
<?php settings_fields('privacy'); ?>

2
wp-admin/options-reading.php
View File

@ -17,7 +17,7 @@ include('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form name="form1" method="post" action="options.php">
<?php settings_fields('reading'); ?>

2
wp-admin/options-writing.php
View File

@ -17,7 +17,7 @@ include('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form method="post" action="options.php">
<?php settings_fields('writing'); ?>

2
wp-admin/options.php
View File

@ -121,7 +121,7 @@ foreach ( (array) $options as $option) :
<th scope='row'><label for='$option->option_name'>$option->option_name</label></th>
<td>";
if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>" . wp_specialchars($value) . "</textarea>";
if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>" . esc_html($value) . "</textarea>";
else echo "<input class='regular-text $class' type='text' name='$option->option_name' id='$option->option_name' value='" . esc_attr($value) . "'$disabled />";
echo "</td>

2
wp-admin/page.php
View File

@ -100,7 +100,7 @@ case 'edit':
if ( $last = wp_check_post_lock( $post->ID ) ) {
$last_user = get_userdata( $last );
$last_user_name = $last_user ? $last_user->display_name : __('Somebody');
$message = sprintf( __( 'Warning: %s is currently editing this page' ), wp_specialchars( $last_user_name ) );
$message = sprintf( __( 'Warning: %s is currently editing this page' ), esc_html( $last_user_name ) );
$message = str_replace( "'", "\'", "<div class='error'><p>$message</p></div>" );
add_action('admin_notices', create_function( '', "echo '$message';" ) );
} else {

2
wp-admin/plugin-editor.php
View File

@ -135,7 +135,7 @@ default:
<?php endif; ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div class="bordertitle">
<form id="themeselector" action="plugin-editor.php" method="post">
<strong><label for="plugin"><?php _e('Select plugin to edit:'); ?> </label></strong>

2
wp-admin/plugin-install.php
View File

@ -56,7 +56,7 @@ include('admin-header.php');
?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<ul class="subsubsub">
<?php

4
wp-admin/plugins.php
View File

@ -189,7 +189,7 @@ require_once('admin-header.php');
$invalid = validate_active_plugins();
if ( !empty($invalid) )
foreach ( $invalid as $plugin_file => $error )
echo '<div id="message" class="error"><p>' . sprintf(__('The plugin <code>%s</code> has been <strong>deactivated</strong> due to an error: %s'), wp_specialchars($plugin_file), $error->get_error_message()) . '</p></div>';
echo '<div id="message" class="error"><p>' . sprintf(__('The plugin <code>%s</code> has been <strong>deactivated</strong> due to an error: %s'), esc_html($plugin_file), $error->get_error_message()) . '</p></div>';
?>
<?php if ( isset($_GET['error']) ) : ?>
@ -222,7 +222,7 @@ if ( !empty($invalid) )
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<?php

2
wp-admin/post.php
View File

@ -135,7 +135,7 @@ case 'edit':
if ( $last = wp_check_post_lock( $post->ID ) ) {
$last_user = get_userdata( $last );
$last_user_name = $last_user ? $last_user->display_name : __('Somebody');
$message = sprintf( __( 'Warning: %s is currently editing this post' ), wp_specialchars( $last_user_name ) );
$message = sprintf( __( 'Warning: %s is currently editing this post' ), esc_html( $last_user_name ) );
$message = str_replace( "'", "\'", "<div class='error'><p>$message</p></div>" );
add_action('admin_notices', create_function( '', "echo '$message';" ) );
} else {

2
wp-admin/press-this.php
View File

@ -91,7 +91,7 @@ if ( isset($_REQUEST['action']) && 'post' == $_REQUEST['action'] ) {
}
// Set Variables
$title = isset($_GET['t']) ? wp_specialchars(aposfix(stripslashes($_GET['t']))) : '';
$title = isset($_GET['t']) ? esc_html(aposfix(stripslashes($_GET['t']))) : '';
$selection = isset($_GET['s']) ? trim( aposfix( stripslashes($_GET['s']) ) ) : '';
if ( ! empty($selection) ) {
$selection = preg_replace('/(\r?\n|\r)/', '</p><p>', $selection);

2
wp-admin/revision.php
View File

@ -177,7 +177,7 @@ foreach ( _wp_post_revision_fields() as $field => $field_title ) :
?>
<tr id="revision-field-<?php echo $field; ?>">
<th scope="row"><?php echo wp_specialchars( $field_title ); ?></th>
<th scope="row"><?php echo esc_html( $field_title ); ?></th>
<td><div class="pre"><?php echo $content; ?></div></td>
</tr>

2
wp-admin/theme-editor.php
View File

@ -115,7 +115,7 @@ $desc_header = ( $description != $file_show ) ? "<strong>$description</strong> (
?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div class="bordertitle">
<form id="themeselector" action="theme-editor.php" method="post">
<strong><label for="theme"><?php _e('Select theme to edit:'); ?> </label></strong>

2
wp-admin/theme-install.php
View File

@ -56,7 +56,7 @@ include('admin-header.php');
?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<ul class="subsubsub">
<?php

2
wp-admin/themes.php
View File

@ -119,7 +119,7 @@ function theme_update_available( $theme ) {
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<h3><?php _e('Current Theme'); ?></h3>
<div id="current-theme">

2
wp-admin/tools.php
View File

@ -17,7 +17,7 @@ require_once('admin-header.php');
screen_icon();
?>
<div class="wrap">
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div class="tool-box">
<?php

6
wp-admin/upload.php
View File

@ -164,9 +164,9 @@ if ( isset($_GET['message']) && (int) $_GET['message'] ) {
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( get_search_query() ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( get_search_query() ) ); ?>
</h2>
<?php
@ -322,7 +322,7 @@ foreach ($arc_result as $arc_row) {
if ( $orphans ) {
foreach ( $orphans as $post ) {
$class = 'alternate' == $class ? '' : 'alternate';
$att_title = wp_specialchars( _draft_or_post_title($post->ID) );
$att_title = esc_html( _draft_or_post_title($post->ID) );
?>
<tr id='post-<?php echo $post->ID; ?>' class='<?php echo $class; ?>' valign="top">
<th scope="row" class="check-column"><input type="checkbox" name="media[]" value="<?php echo esc_attr($post->ID); ?>" /></th>

2
wp-admin/user-edit.php
View File

@ -115,7 +115,7 @@ include ('admin-header.php');
<div class="wrap" id="profile-page">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form id="your-profile" action="" method="post">
<?php wp_nonce_field('update-user_' . $user_id) ?>

4
wp-admin/users.php
View File

@ -239,9 +239,9 @@ if ( ! empty($messages) ) {
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['usersearch']) && $_GET['usersearch'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( $_GET['usersearch'] ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( $_GET['usersearch'] ) ); ?>
</h2>
<div class="filter">

10
wp-admin/widgets.php
View File

@ -125,7 +125,7 @@ if ( count($wp_registered_sidebars) == 1 ) {
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div class="error">
<p><?php _e( 'No Sidebars Defined' ); ?></p>
</div>
@ -258,9 +258,9 @@ if ( isset($_GET['editwidget']) && $_GET['editwidget'] ) {
require_once( 'admin-header.php' ); ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div class="editwidget"<?php echo $width; ?>>
<h3><?php printf( __( 'Widget %s' ), wp_specialchars( strip_tags($control['name']) ) ); ?></h3>
<h3><?php printf( __( 'Widget %s' ), esc_html( strip_tags($control['name']) ) ); ?></h3>
<form action="widgets.php" method="post">
<div class="widget-inside">
@ -334,7 +334,7 @@ require_once( 'admin-header.php' ); ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<?php if ( isset($_GET['message']) && isset($messages[$_GET['message']]) ) { ?>
<div id="message" class="updated fade"><p><?php echo $messages[$_GET['message']]; ?></p></div>
@ -378,7 +378,7 @@ foreach ( $wp_registered_sidebars as $sidebar => $registered_sidebar ) {
<div class="widgets-holder-wrap<?php echo $closed; ?>">
<div class="sidebar-name">
<div class="sidebar-name-arrow"><br /></div>
<h3><?php echo wp_specialchars( $registered_sidebar['name'] ); ?>
<h3><?php echo esc_html( $registered_sidebar['name'] ); ?>
<span><img src="images/wpspin_dark.gif" class="ajax-feedback" title="" alt="" /></span></h3></div>
<?php wp_list_widget_controls( $sidebar ); // Show the control forms for each of the widgets in this sidebar ?>
</div>

2
wp-includes/classes.php
View File

@ -1252,7 +1252,7 @@ class Walker_PageDropdown extends Walker {
if ( $page->ID == $args['selected'] )
$output .= ' selected="selected"';
$output .= '>';
$title = wp_specialchars($page->post_title);
$title = esc_html($page->post_title);
$output .= "$pad$title";
$output .= "</option>\n";
}

2
wp-includes/comment-template.php
View File

@ -1078,7 +1078,7 @@ function get_cancel_comment_reply_link($text = '') {
$text = __('Click here to cancel reply.');
$style = isset($_GET['replytocom']) ? '' : ' style="display:none;"';
$link = wp_specialchars( remove_query_arg('replytocom') ) . '#respond';
$link = esc_html( remove_query_arg('replytocom') ) . '#respond';
return apply_filters('cancel_comment_reply_link', '<a rel="nofollow" id="cancel-comment-reply-link" href="' . $link . '"' . $style . '>' . $text . '</a>', $link, $text);
}

10
wp-includes/default-filters.php
View File

@ -20,7 +20,7 @@ foreach ( $filters as $filter ) {
add_filter($filter, 'strip_tags');
add_filter($filter, 'trim');
add_filter($filter, 'wp_filter_kses');
add_filter($filter, 'wp_specialchars', 30);
add_filter($filter, 'esc_html', 30);
}
// Kses only for textarea saves
@ -80,7 +80,7 @@ $filters = array('comment_author', 'term_name', 'link_name', 'link_description',
foreach ( $filters as $filter ) {
add_filter($filter, 'wptexturize');
add_filter($filter, 'convert_chars');
add_filter($filter, 'wp_specialchars');
add_filter($filter, 'esc_html');
}
// Format text area for display.
@ -131,19 +131,19 @@ add_filter('wp_sprintf', 'wp_sprintf_l', 10, 2);
// RSS filters
add_filter('the_title_rss', 'strip_tags');
add_filter('the_title_rss', 'ent2ncr', 8);
add_filter('the_title_rss', 'wp_specialchars');
add_filter('the_title_rss', 'esc_html');
add_filter('the_content_rss', 'ent2ncr', 8);
add_filter('the_excerpt_rss', 'convert_chars');
add_filter('the_excerpt_rss', 'ent2ncr', 8);
add_filter('comment_author_rss', 'ent2ncr', 8);
add_filter('comment_text_rss', 'ent2ncr', 8);
add_filter('comment_text_rss', 'wp_specialchars');
add_filter('comment_text_rss', 'esc_html');
add_filter('bloginfo_rss', 'ent2ncr', 8);
add_filter('the_author', 'ent2ncr', 8);
// Misc filters
add_filter('option_ping_sites', 'privacy_ping_filter');
add_filter('option_blog_charset', 'wp_specialchars');
add_filter('option_blog_charset', '_wp_specialchars'); // IMPORTANT: This must not be wp_specialchars() or esc_html() or it'll cause an infinite loop
add_filter('option_home', '_config_wp_home');
add_filter('option_siteurl', '_config_wp_siteurl');
add_filter('tiny_mce_before_init', '_mce_set_direction');

4
wp-includes/default-widgets.php
View File

@ -820,7 +820,7 @@ function wp_widget_rss_output( $rss, $args = array() ) {
$desc = str_replace(array("\n", "\r"), ' ', esc_attr(strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset')))));
$desc = wp_html_excerpt( $desc, 360 ) . ' [&hellip;]';
$desc = wp_specialchars( $desc );
$desc = esc_html( $desc );
if ( $show_summary ) {
$summary = "<div class='rssSummary'>$desc</div>";
@ -844,7 +844,7 @@ function wp_widget_rss_output( $rss, $args = array() ) {
if ( $show_author ) {
$author = $item->get_author();
$author = $author->get_name();
$author = ' <cite>' . wp_specialchars( strip_tags( $author ) ) . '</cite>';
$author = ' <cite>' . esc_html( strip_tags( $author ) ) . '</cite>';
}
if ( $link == '' ) {

2
wp-includes/feed.php
View File

@ -165,7 +165,7 @@ function the_content_rss($more_link_text='(more...)', $stripteaser=0, $more_file
if ( $cut && !$encode_html )
$encode_html = 2;
if ( 1== $encode_html ) {
$content = wp_specialchars($content);
$content = esc_html($content);
$cut = 0;
} elseif ( 0 == $encode_html ) {
$content = make_url_footnote($content);

47
wp-includes/formatting.php
View File

@ -213,7 +213,7 @@ function seems_utf8($Str) { # by bmorel at ssi dot fr
* @param boolean $double_encode Optional. Whether or not to encode existing html entities. Default is false.
* @return string The encoded text with HTML entities.
*/
function wp_specialchars( $string, $quote_style = ENT_NOQUOTES, $charset = false, $double_encode = false ) {
function _wp_specialchars( $string, $quote_style = ENT_NOQUOTES, $charset = false, $double_encode = false ) {
$string = (string) $string;
if ( 0 === strlen( $string ) ) {
@ -286,7 +286,7 @@ function wp_specialchars( $string, $quote_style = ENT_NOQUOTES, $charset = false
* @since 2.8
*
* @param string $string The text which is to be decoded.
* @param mixed $quote_style Optional. Converts double quotes if set to ENT_COMPAT, both single and double if set to ENT_QUOTES or none if set to ENT_NOQUOTES. Also compatible with old wp_specialchars() values; converting single quotes if set to 'single', double if set to 'double' or both if otherwise set. Default is ENT_NOQUOTES.
* @param mixed $quote_style Optional. Converts double quotes if set to ENT_COMPAT, both single and double if set to ENT_QUOTES or none if set to ENT_NOQUOTES. Also compatible with old _wp_specialchars() values; converting single quotes if set to 'single', double if set to 'double' or both if otherwise set. Default is ENT_NOQUOTES.
* @return string The decoded text without HTML entities.
*/
function wp_specialchars_decode( $string, $quote_style = ENT_NOQUOTES ) {
@ -301,7 +301,7 @@ function wp_specialchars_decode( $string, $quote_style = ENT_NOQUOTES ) {
return $string;
}
// Match the previous behaviour of wp_specialchars() when the $quote_style is not an accepted value
// Match the previous behaviour of _wp_specialchars() when the $quote_style is not an accepted value
if ( empty( $quote_style ) ) {
$quote_style = ENT_NOQUOTES;
} elseif ( !in_array( $quote_style, array( 0, 2, 3, 'single', 'double' ), true ) ) {
@ -2074,7 +2074,7 @@ function htmlentities2($myHTML) {
*/
function esc_js( $text ) {
$safe_text = wp_check_invalid_utf8( $text );
$safe_text = wp_specialchars( $safe_text, ENT_COMPAT );
$safe_text = _wp_specialchars( $safe_text, ENT_COMPAT );
$safe_text = preg_replace( '/&#(x)?0*(?(1)27|39);?/i', "'", stripslashes( $safe_text ) );
$safe_text = preg_replace( "/\r?\n/", "\\n", addslashes( $safe_text ) );
return apply_filters( 'js_escape', $safe_text, $text );
@ -2097,6 +2097,35 @@ function js_escape( $text ) {
return esc_js( $text );
}
/**
* Escaping for HTML blocks.
*
* @since 2.8.0
*
* @param string $text
* @return string
*/
function esc_html( $text ) {
$safe_text = wp_check_invalid_utf8( $text );
$safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );
return apply_filters( 'esc_html', $safe_text, $text );
return $text;
}
/**
* Escaping for HTML blocks
* @deprecated 2.8.0
* @see esc_html()
*/
function wp_specialchars( $string, $quote_style = ENT_NOQUOTES, $charset = false, $double_encode = false ) {
if ( func_num_args() > 1 ) { // Maintain backwards compat for people passing additional args
$args = func_get_args();
return call_user_func_array( '_wp_specialchars', $args );
} else {
return esc_html( $string );
}
}
/**
* Escaping for HTML attributes.
*
@ -2107,7 +2136,7 @@ function js_escape( $text ) {
*/
function esc_attr( $text ) {
$safe_text = wp_check_invalid_utf8( $text );
$safe_text = wp_specialchars( $safe_text, ENT_QUOTES );
$safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );
return apply_filters( 'attribute_escape', $safe_text, $text );
}
@ -2224,7 +2253,7 @@ function sanitize_option($option, $value) {
$value = addslashes($value);
$value = wp_filter_post_kses( $value ); // calls stripslashes then addslashes
$value = stripslashes($value);
$value = wp_specialchars( $value );
$value = esc_html( $value );
break;
case 'blog_charset':
@ -2298,15 +2327,15 @@ function wp_pre_kses_less_than( $text ) {
/**
* Callback function used by preg_replace.
*
* @uses wp_specialchars to format the $matches text.
* @uses esc_html to format the $matches text.
* @since 2.3.0
*
* @param array $matches Populated by matches to preg_replace.
* @return string The text returned after wp_specialchars if needed.
* @return string The text returned after esc_html if needed.
*/
function wp_pre_kses_less_than_callback( $matches ) {
if ( false === strpos($matches[0], '>') )
return wp_specialchars($matches[0]);
return esc_html($matches[0]);
return $matches[0];
}

10
wp-includes/functions.php
View File

@ -379,7 +379,7 @@ function get_option( $setting, $default = false ) {
function wp_protect_special_option( $option ) {
$protected = array( 'alloptions', 'notoptions' );
if ( in_array( $option, $protected ) )
die( sprintf( __( '%s is a protected WP option and may not be modified' ), wp_specialchars( $option ) ) );
die( sprintf( __( '%s is a protected WP option and may not be modified' ), esc_html( $option ) ) );
}
/**
@ -1593,7 +1593,7 @@ function do_feed() {
$hook = 'do_feed_' . $feed;
if ( !has_action($hook) ) {
$message = sprintf( __( 'ERROR: %s is not a valid feed template' ), wp_specialchars($feed));
$message = sprintf( __( 'ERROR: %s is not a valid feed template' ), esc_html($feed));
wp_die($message);
}
@ -1718,7 +1718,7 @@ function is_blog_installed() {
*/
function wp_nonce_url( $actionurl, $action = -1 ) {
$actionurl = str_replace( '&amp;', '&', $actionurl );
return wp_specialchars( add_query_arg( '_wpnonce', wp_create_nonce( $action ), $actionurl ) );
return esc_html( add_query_arg( '_wpnonce', wp_create_nonce( $action ), $actionurl ) );
}
/**
@ -2308,7 +2308,7 @@ function wp_explain_nonce( $action ) {
else
$object = call_user_func( $lookup, $object );
}
return sprintf( $trans[$verb][$noun][0], wp_specialchars($object) );
return sprintf( $trans[$verb][$noun][0], esc_html($object) );
} else {
return $trans[$verb][$noun][0];
}
@ -2334,7 +2334,7 @@ function wp_explain_nonce( $action ) {
*/
function wp_nonce_ays( $action ) {
$title = __( 'WordPress Failure Notice' );
$html = wp_specialchars( wp_explain_nonce( $action ) );
$html = esc_html( wp_explain_nonce( $action ) );
if ( wp_get_referer() )
$html .= "</p><p><a href='" . clean_url( remove_query_arg( 'updated', wp_get_referer() ) ) . "'>" . __( 'Please try again.' ) . "</a>";
elseif ( 'log-out' == $action )

2
wp-includes/general-template.php
View File

@ -1469,7 +1469,7 @@ function feed_links_extra( $args ) {
$post = &get_post( $id = 0 );
if ( comments_open() || pings_open() || $post->comment_count > 0 ) {
$title = esc_attr(sprintf( $args['singletitle'], get_bloginfo('name'), $args['separator'], wp_specialchars( get_the_title() ) ));
$title = esc_attr(sprintf( $args['singletitle'], get_bloginfo('name'), $args['separator'], esc_html( get_the_title() ) ));
$href = get_post_comments_feed_link( $post->ID );
}
} elseif ( is_category() ) {

30
wp-includes/l10n.php
View File

@ -119,6 +119,22 @@ function esc_attr__( $text, $domain = 'default' ) {
return esc_attr( translate( $text, $domain ) );
}
/**
* Retrieves the translation of $text and escapes it for safe use in HTML output.
* If there is no translation, or the domain isn't loaded the original text is returned.
*
* @see translate() An alias of translate()
* @see esc_html()
* @since 2.8.0
*
* @param string $text Text to translate
* @param string $domain Optional. Domain to retrieve the translated text
* @return string Translated text
*/
function esc_html__( $text, $domain = 'default' ) {
return esc_html( translate( $text, $domain ) );
}
/**
* Displays the returned translated text from translate().
*
@ -146,6 +162,20 @@ function esc_attr_e( $text, $domain = 'default' ) {
echo esc_attr( translate( $text, $domain ) );
}
/**
* Displays translated text that has been escaped for safe use in HTML output.
*
* @see translate() Echoes returned translate() string
* @see esc_html()
* @since 2.8.0
*
* @param string $text Text to translate
* @param string $domain Optional. Domain to retrieve the translated text
*/
function esc_html_e( $text, $domain = 'default' ) {
echo esc_html( translate( $text, $domain ) );
}
/**
* Retrieve translated string with vertical bar context
*

2
wp-includes/user.php
View File

@ -540,7 +540,7 @@ function wp_dropdown_users( $args = '' ) {
$user->ID = (int) $user->ID;
$_selected = $user->ID == $selected ? " selected='selected'" : '';
$display = !empty($user->$show) ? $user->$show : '('. $user->user_login . ')';
$output .= "\t<option value='$user->ID'$_selected>" . wp_specialchars($display) . "</option>\n";
$output .= "\t<option value='$user->ID'$_selected>" . esc_html($display) . "</option>\n";
}
$output .= "</select>";

2
wp-includes/widgets.php
View File

@ -601,7 +601,7 @@ function wp_widget_description( $id ) {
global $wp_registered_widgets;
if ( isset($wp_registered_widgets[$id]['description']) )
return wp_specialchars( $wp_registered_widgets[$id]['description'] );
return esc_html( $wp_registered_widgets[$id]['description'] );
}
/**

8
wp-mail.php
View File

@ -23,7 +23,7 @@ if ( ! $pop3->connect(get_option('mailserver_url'), get_option('mailserver_port'
! $pop3->user(get_option('mailserver_login')) ||
( ! $count = $pop3->pass(get_option('mailserver_pass')) ) ) {
$pop3->quit();
wp_die( ( 0 === $count ) ? __('There doesn&#8217;t seem to be any new mail.') : wp_specialchars($pop3->ERROR) );
wp_die( ( 0 === $count ) ? __('There doesn&#8217;t seem to be any new mail.') : esc_html($pop3->ERROR) );
}
for ( $i = 1; $i <= $count; $i++ ) {
@ -195,11 +195,11 @@ for ( $i = 1; $i <= $count; $i++ ) {
do_action('publish_phone', $post_ID);
echo "\n<p>" . sprintf(__('<strong>Author:</strong> %s'), wp_specialchars($post_author)) . '</p>';
echo "\n<p>" . sprintf(__('<strong>Posted title:</strong> %s'), wp_specialchars($post_title)) . '</p>';
echo "\n<p>" . sprintf(__('<strong>Author:</strong> %s'), esc_html($post_author)) . '</p>';
echo "\n<p>" . sprintf(__('<strong>Posted title:</strong> %s'), esc_html($post_title)) . '</p>';
if(!$pop3->delete($i)) {
echo '<p>' . sprintf(__('Oops: %s'), wp_specialchars($pop3->ERROR)) . '</p>';
echo '<p>' . sprintf(__('Oops: %s'), esc_html($pop3->ERROR)) . '</p>';
$pop3->reset();
exit;
} else {

10
xmlrpc.php
View File

@ -883,8 +883,8 @@ class wp_xmlrpc_server extends IXR_Server {
$struct['name'] = $tag->name;
$struct['count'] = $tag->count;
$struct['slug'] = $tag->slug;
$struct['html_url'] = wp_specialchars( get_tag_link( $tag->term_id ) );
$struct['rss_url'] = wp_specialchars( get_tag_feed_link( $tag->term_id ) );
$struct['html_url'] = esc_html( get_tag_link( $tag->term_id ) );
$struct['rss_url'] = esc_html( get_tag_feed_link( $tag->term_id ) );
$tags[] = $struct;
}
@ -2790,8 +2790,8 @@ class wp_xmlrpc_server extends IXR_Server {
$struct['description'] = $cat->name;
$struct['categoryDescription'] = $cat->description;
$struct['categoryName'] = $cat->name;
$struct['htmlUrl'] = wp_specialchars(get_category_link($cat->term_id));
$struct['rssUrl'] = wp_specialchars(get_category_feed_link($cat->term_id, 'rss2'));
$struct['htmlUrl'] = esc_html(get_category_link($cat->term_id));
$struct['rssUrl'] = esc_html(get_category_feed_link($cat->term_id, 'rss2'));
$categories_struct[] = $struct;
}
@ -3327,7 +3327,7 @@ class wp_xmlrpc_server extends IXR_Server {
$pagelinkedfrom = str_replace('&', '&amp;', $pagelinkedfrom);
$context = '[...] ' . wp_specialchars( $excerpt ) . ' [...]';
$context = '[...] ' . esc_html( $excerpt ) . ' [...]';
$pagelinkedfrom = $wpdb->escape( $pagelinkedfrom );
$comment_post_ID = (int) $post_ID;