From 69f8f6ecf63233e92937d7692d4a0fa9ba7d9825 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov.ru@gmail.com>
Date: Tue, 19 Aug 2025 12:30:31 +0000
Subject: [PATCH] Coding Standards: Sanitize input values in
 `wp-trackback.php`.

Follow-up to [4676], [12284], [23594], [53719].

Props utsav72640, mukesh27, ankitmaru, dhruvang21, SergeyBiryukov.
Fixes #58511.
Built from https://develop.svn.wordpress.org/trunk@60646


git-svn-id: http://core.svn.wordpress.org/trunk@59982 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/version.php |  2 +-
 wp-trackback.php        | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/wp-includes/version.php b/wp-includes/version.php
index 3aa1c80a3a..d64461d873 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.9-alpha-60645';
+$wp_version = '6.9-alpha-60646';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
diff --git a/wp-trackback.php b/wp-trackback.php
index 6a93d059fc..c9149363e1 100644
--- a/wp-trackback.php
+++ b/wp-trackback.php
@@ -50,13 +50,13 @@ if ( ! isset( $_GET['tb_id'] ) || ! $_GET['tb_id'] ) {
 	$post_id = (int) $post_id[ count( $post_id ) - 1 ];
 }
 
-$trackback_url = isset( $_POST['url'] ) ? $_POST['url'] : '';
-$charset       = isset( $_POST['charset'] ) ? $_POST['charset'] : '';
+$trackback_url = isset( $_POST['url'] ) ? sanitize_url( $_POST['url'] ) : '';
+$charset       = isset( $_POST['charset'] ) ? sanitize_text_field( $_POST['charset'] ) : '';
 
 // These three are stripslashed here so they can be properly escaped after mb_convert_encoding().
-$title     = isset( $_POST['title'] ) ? wp_unslash( $_POST['title'] ) : '';
-$excerpt   = isset( $_POST['excerpt'] ) ? wp_unslash( $_POST['excerpt'] ) : '';
-$blog_name = isset( $_POST['blog_name'] ) ? wp_unslash( $_POST['blog_name'] ) : '';
+$title     = isset( $_POST['title'] ) ? sanitize_text_field( wp_unslash( $_POST['title'] ) ) : '';
+$excerpt   = isset( $_POST['excerpt'] ) ? sanitize_textarea_field( wp_unslash( $_POST['excerpt'] ) ) : '';
+$blog_name = isset( $_POST['blog_name'] ) ? sanitize_text_field( wp_unslash( $_POST['blog_name'] ) ) : '';
 
 if ( $charset ) {
 	$charset = str_replace( array( ',', ' ' ), '', strtoupper( trim( $charset ) ) );