From cb45a6cb79c4a82aa1b6b004852498ad03a4b32f Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov@git.wordpress.org>
Date: Fri, 10 May 2013 02:06:34 +0000
Subject: [PATCH] Use esc_textarea(), not esc_html(), for escaping textarea
 content. props johnbillion. fixes #24300.

git-svn-id: https://develop.svn.wordpress.org/trunk@24230 602fd350-edb4-49c9-b593-d223f7449a82
---
 wp-admin/includes/post-formats.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/wp-admin/includes/post-formats.php b/wp-admin/includes/post-formats.php
index 70dad05071..6c1cb86387 100644
--- a/wp-admin/includes/post-formats.php
+++ b/wp-admin/includes/post-formats.php
@@ -53,7 +53,7 @@ wp_nonce_field( 'show-post-format-ui_' . $post_type, 'show_post_format_ui_nonce'
 					else
 						_e( 'Image URL' );
 				?></label>
-				<textarea id="wp_format_image" type="text" name="_format_image" class="widefat"><?php echo esc_html( $format_meta['image'] ); ?></textarea>
+				<textarea id="wp_format_image" type="text" name="_format_image" class="widefat"><?php echo esc_textarea( $format_meta['image'] ); ?></textarea>
 			</div>
 			<p class="use-url-or-html hide-if-no-js"><span><?php printf( __( '(or %suse an image URL or HTML%s)' ), '<a href="#">', '</a>' ); ?></span>
 				<span style="display: none"><?php printf( __( '(or %sselect/upload an image%s)' ), '<a href="#">', '</a>' ); ?></span></p>
@@ -102,7 +102,7 @@ wp_nonce_field( 'show-post-format-ui_' . $post_type, 'show_post_format_ui_nonce'
 				else
 					_e( 'Video URL' );
 			?></label>
-			<textarea id="wp_format_video" type="text" name="_format_video_embed" class="widefat"><?php echo esc_html( $format_meta['video_embed'] ); ?></textarea>
+			<textarea id="wp_format_video" type="text" name="_format_video_embed" class="widefat"><?php echo esc_textarea( $format_meta['video_embed'] ); ?></textarea>
 			<div data-format="video" class="wp-format-media-holder hide-if-no-js">
 				<a href="#" class="wp-format-media-select"
 					data-choose="<?php esc_attr_e( 'Choose a Video' ); ?>"
@@ -140,7 +140,7 @@ wp_nonce_field( 'show-post-format-ui_' . $post_type, 'show_post_format_ui_nonce'
 				else
 					_e( 'Audio URL' );
 			?></label>
-			<textarea id="wp_format_audio" name="_format_audio_embed" class="widefat"><?php echo esc_html( $format_meta['audio_embed'] ); ?></textarea>
+			<textarea id="wp_format_audio" name="_format_audio_embed" class="widefat"><?php echo esc_textarea( $format_meta['audio_embed'] ); ?></textarea>
 			<div data-format="audio" class="wp-format-media-holder hide-if-no-js">
 				<a href="#" class="wp-format-media-select" data-choose="<?php esc_attr_e( 'Choose Audio' ); ?>" data-update="<?php esc_attr_e( 'Select Audio' ); ?>">
 					<?php _e( 'Select Audio From Media Library' ) ?>