vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-12 12:50:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

esc_textarea() and application for obvious textarea escaping. props alexkingorg. fixes #15454

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@16431 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Mark Jaquith
2010-11-17 17:12:01 +00:00
parent b9b0431d29
commit 55e0256967
22 changed files with 48 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-includes/default-widgets.php
+1 -1
View File
@@ -399,7 +399,7 @@ class WP_Widget_Text extends WP_Widget {
function form( $instance ) {
$instance = wp_parse_args( (array) $instance, array( 'title' => '', 'text' => '' ) );
$title = strip_tags($instance['title']);
$text = format_to_edit($instance['text']);
$text = esc_textarea($instance['text']);
?>
<p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label>
<input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr($title); ?>" /></p>
wp-includes/formatting.php
+13
View File
@@ -2352,6 +2352,19 @@ function esc_attr( $text ) {
return apply_filters( 'attribute_escape', $safe_text, $text );
}
/**
* Escaping for textarea values.
*
* @since 3.1
*
* @param string $text
* @return string
*/
function esc_textarea( $text ) {
$safe_text = htmlspecialchars( $text );
return apply_filters( 'esc_textarea', $safe_text, $text );
}
/**
* Escape a HTML tag name.
*
wp-includes/post.php
+1 -1
View File
@@ -5123,7 +5123,7 @@ function wp_quickpress_form( $args = array(), $post_type = 'post'){
'capability' => '',
'output' => '<h4 id="%s-content-label"><label for="content">'. __('Content') .'</label></h4>
<div class="textarea-wrap">
<textarea name="content" id="%s-content" class="mceEditor" rows="3" cols="15" tabindex="%d">'. $post->post_content.'</textarea>
<textarea name="content" id="%s-content" class="mceEditor" rows="3" cols="15" tabindex="%d">'. esc_textarea( $post->post_content ) .'</textarea>
</div>
'." <script type='text/javascript'>edCanvas = document.getElementById('content');edInsertContent = null;</script>
"