From 503b80be0b12edb5a6a47c66db48d4517dc670a6 Mon Sep 17 00:00:00 2001
From: Andrew Ozz <admin@laptoptips.ca>
Date: Fri, 19 Jun 2015 01:53:26 +0000
Subject: [PATCH] Fix using `htmlspecialchars()` whit the `$double_encode`
 parameter. PHP < 5.4 doesn't validate the entities. Props miqrogroove. Fixes
 #17780. Built from https://develop.svn.wordpress.org/trunk@32851

git-svn-id: http://core.svn.wordpress.org/trunk@32822 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/formatting.php | 6 ++++++
 wp-includes/version.php    | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php
index 4d834550f5..ce33351a84 100644
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -688,6 +688,12 @@ function _wp_specialchars( $string, $quote_style = ENT_NOQUOTES, $charset = fals
 		$quote_style = ENT_NOQUOTES;
 	}
 
+	if ( ! $double_encode ) {
+		// Guarantee every &entity; is valid, convert &garbage; into &amp;garbage;
+		// This is required for PHP < 5.4.0 because ENT_HTML401 flag is unavailable.
+		$string = wp_kses_normalize_entities( $string );
+	}
+
 	$string = @htmlspecialchars( $string, $quote_style, $charset, $double_encode );
 
 	// Backwards compatibility
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 9f20cb58cc..54e3e06459 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.3-alpha-32850';
+$wp_version = '4.3-alpha-32851';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.