vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-03-30 18:24:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@11380 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Mark Jaquith
2009-05-18 15:11:07 +00:00
parent b3efcdaaaa
commit f0336cfa7d
68 changed files with 210 additions and 151 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
wp-admin/admin-ajax.php
View File

@@ -422,7 +422,7 @@ case 'add-link-category' : // On the Fly
$cat_id = wp_insert_term( $cat_name, 'link_category' );
}
$cat_id = $cat_id['term_id'];
$cat_name = wp_specialchars(stripslashes($cat_name));
$cat_name = esc_html(stripslashes($cat_name));
$x->add( array(
'what' => 'link-category',
'id' => $cat_id,
@@ -898,7 +898,7 @@ case 'autosave' : // The name of this action is hardcoded in edit_post()
$last_user_name = $last_user ? $last_user->display_name : __( 'Someone' );
$data = new WP_Error( 'locked', sprintf(
$_POST['post_type'] == 'page' ? __( 'Autosave disabled: %s is currently editing this page.' ) : __( 'Autosave disabled: %s is currently editing this post.' ),
wp_specialchars( $last_user_name )
esc_html( $last_user_name )
) );
$supplemental['disable_autosave'] = 'disable';
@@ -1057,7 +1057,7 @@ case 'inline-save':
if ( $last = wp_check_post_lock( $post_ID ) ) {
$last_user = get_userdata( $last );
$last_user_name = $last_user ? $last_user->display_name : __( 'Someone' );
printf( $_POST['post_type'] == 'page' ? __( 'Saving is disabled: %s is currently editing this page.' ) : __( 'Saving is disabled: %s is currently editing this post.' ), wp_specialchars( $last_user_name ) );
printf( $_POST['post_type'] == 'page' ? __( 'Saving is disabled: %s is currently editing this page.' ) : __( 'Saving is disabled: %s is currently editing this post.' ), esc_html( $last_user_name ) );
exit;
}
@@ -1217,7 +1217,7 @@ case 'find_posts':
}
$html .= '<tr class="found-posts"><td class="found-radio"><input type="radio" id="found-'.$post->ID.'" name="found_post_id" value="' . esc_attr($post->ID) . '"></td>';
$html .= '<td><label for="found-'.$post->ID.'">'.wp_specialchars($post->post_title, true).'</label></td><td>'.wp_specialchars($time, true).'</td><td>'.wp_specialchars($stat, true).'</td></tr>'."\n\n";
$html .= '<td><label for="found-'.$post->ID.'">'.esc_html( $post->post_title ).'</label></td><td>'.esc_html( $time ).'</td><td>'.esc_html( $stat ).'</td></tr>'."\n\n";
}
$html .= '</tbody></table>';

2
wp-admin/admin-header.php
View File

@@ -10,7 +10,7 @@
if (!isset($_GET["page"])) require_once('admin.php');
get_admin_page_title();
$title = wp_specialchars( strip_tags( $title ) );
$title = esc_html( strip_tags( $title ) );
wp_user_settings();
wp_menu_unfold();
?>

2
wp-admin/async-upload.php
View File

@@ -42,7 +42,7 @@ check_admin_referer('media-form');
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
if (is_wp_error($id)) {
echo '<div id="media-upload-error">'.wp_specialchars($id->get_error_message()).'</div>';
echo '<div id="media-upload-error">'.esc_html($id->get_error_message()).'</div>';
exit;
}

4
wp-admin/categories.php
View File

@@ -129,9 +129,9 @@ $messages[5] = __('Category not updated.');
<div class="wrap nosubsub">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( stripslashes($_GET['s']) ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( stripslashes($_GET['s']) ) ); ?>
</h2>
<?php

4
wp-admin/edit-attachment-rows.php
View File

@@ -24,7 +24,7 @@ if ( have_posts() ) { ?>
<tbody id="the-list" class="list:post">
<?php
add_filter('the_title','wp_specialchars');
add_filter('the_title','esc_html');
$alt = '';
$posts_columns = get_column_headers('upload');
$hidden = get_hidden_columns('upload');
@@ -110,7 +110,7 @@ foreach ($posts_columns as $column_name => $column_display_name ) {
if ( !empty( $tags ) ) {
$out = array();
foreach ( $tags as $c )
$out[] = "<a href='edit.php?tag=$c->slug'> " . wp_specialchars(sanitize_term_field('name', $c->name, $c->term_id, 'post_tag', 'display')) . "</a>";
$out[] = "<a href='edit.php?tag=$c->slug'> " . esc_html(sanitize_term_field('name', $c->name, $c->term_id, 'post_tag', 'display')) . "</a>";
echo join( ', ', $out );
} else {
_e('No Tags');

2
wp-admin/edit-category-form.php
View File

@@ -66,7 +66,7 @@ _fill_empty_category($category);
</tr>
<tr class="form-field">
<th scope="row" valign="top"><label for="category_description"><?php _e('Description') ?></label></th>
<td><textarea name="category_description" id="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->description); ?></textarea><br />
<td><textarea name="category_description" id="category_description" rows="5" cols="50" style="width: 97%;"><?php echo esc_html($category->description); ?></textarea><br />
<?php _e('The description is not prominent by default, however some themes may show it.'); ?></td>
</tr>
</table>

4
wp-admin/edit-comments.php
View File

@@ -96,9 +96,9 @@ $search = esc_attr( $search_dirty ); ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . sprintf( __( 'Search results for &#8220;%s&#8221;' ), wp_html_excerpt( wp_specialchars( stripslashes( $_GET['s'] ) ), 50 ) ) . '</span>' ); ?>
printf( '<span class="subtitle">' . sprintf( __( 'Search results for &#8220;%s&#8221;' ), wp_html_excerpt( esc_html( stripslashes( $_GET['s'] ) ), 50 ) ) . '</span>' ); ?>
</h2>
<?php

8
wp-admin/edit-form-advanced.php
View File

@@ -166,7 +166,7 @@ if ( 'private' == $post->post_status ) {
$visibility_trans = __('Public');
}
?><?php echo wp_specialchars( $visibility_trans ); ?></span> <?php if ( $can_publish ) { ?> <a href="#visibility" class="edit-visibility hide-if-no-js"><?php _e('Edit'); ?></a>
?><?php echo esc_html( $visibility_trans ); ?></span> <?php if ( $can_publish ) { ?> <a href="#visibility" class="edit-visibility hide-if-no-js"><?php _e('Edit'); ?></a>
<div id="post-visibility-select" class="hide-if-js">
<input type="hidden" name="hidden_post_password" id="hidden-post-password" value="<?php echo esc_attr($post->post_password); ?>" />
@@ -390,7 +390,7 @@ function post_trackback_meta_box($post) {
$pings = '<p>'. __('Already pinged:') . '</p><ul>';
$already_pinged = explode("\n", trim($post->pinged));
foreach ($already_pinged as $pinged_url) {
$pings .= "\n\t<li>" . wp_specialchars($pinged_url) . "</li>";
$pings .= "\n\t<li>" . esc_html($pinged_url) . "</li>";
}
$pings .= '</ul>';
}
@@ -549,7 +549,7 @@ require_once('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<?php if ( $notice ) : ?>
<div id="notice" class="error"><p><?php echo $notice ?></p></div>
<?php endif; ?>
@@ -622,7 +622,7 @@ endif; ?>
echo '<span id="last-edit">';
if ( $last_id = get_post_meta($post_ID, '_edit_last', true) ) {
$last_user = get_userdata($last_id);
printf(__('Last edited by %1$s on %2$s at %3$s'), wp_specialchars( $last_user->display_name ), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
printf(__('Last edited by %1$s on %2$s at %3$s'), esc_html( $last_user->display_name ), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
} else {
printf(__('Last edited on %1$s at %2$s'), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
}

4
wp-admin/edit-link-categories.php
View File

@@ -61,9 +61,9 @@ $messages[6] = __('Categories deleted.'); ?>
<div class="wrap nosubsub">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( stripslashes($_GET['s']) ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( stripslashes($_GET['s']) ) ); ?>
</h2>
<?php if ( isset($_GET['message']) && ( $msg = (int) $_GET['message'] ) ) : ?>

2
wp-admin/edit-link-form.php
View File

@@ -342,7 +342,7 @@ require_once ('admin-header.php');
?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<?php if ( isset( $_GET['added'] ) ) : ?>
<div id="message" class="updated fade"><p><?php _e('Link added.'); ?></p></div>

6
wp-admin/edit-page-form.php
View File

@@ -158,7 +158,7 @@ if ( 'private' == $post->post_status ) {
$visibility_trans = __('Public');
}
echo wp_specialchars( $visibility_trans ); ?></span>
echo esc_html( $visibility_trans ); ?></span>
<?php if ( $can_publish ) { ?>
<a href="#visibility" class="edit-visibility hide-if-no-js"><?php _e('Edit'); ?></a>
@@ -397,7 +397,7 @@ require_once('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form name="post" action="page.php" method="post" id="post">
<?php if ( $notice ) : ?>
@@ -460,7 +460,7 @@ endif; ?>
if ($post_ID) {
if ( $last_id = get_post_meta($post_ID, '_edit_last', true) ) {
$last_user = get_userdata($last_id);
printf(__('Last edited by %1$s on %2$s at %3$s'), wp_specialchars( $last_user->display_name ), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
printf(__('Last edited by %1$s on %2$s at %3$s'), esc_html( $last_user->display_name ), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
} else {
printf(__('Last edited on %1$s at %2$s'), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
}

4
wp-admin/edit-pages.php
View File

@@ -104,9 +104,9 @@ require_once('admin-header.php'); ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( get_search_query() ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( get_search_query() ) ); ?>
</h2>
<?php if ( isset($_GET['locked']) || isset($_GET['skipped']) || isset($_GET['updated']) || isset($_GET['deleted']) ) { ?>

2
wp-admin/edit-tag-form.php
View File

@@ -36,7 +36,7 @@ do_action('edit_tag_form_pre', $tag); ?>
</tr>
<tr class="form-field">
<th scope="row" valign="top"><label for="description"><?php _e('Description') ?></label></th>
<td><textarea name="description" id="description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($tag->description); ?></textarea><br />
<td><textarea name="description" id="description" rows="5" cols="50" style="width: 97%;"><?php echo esc_html($tag->description); ?></textarea><br />
<?php _e('The description is not prominent by default, however some themes may show it.'); ?></td>
</tr>
</table>

4
wp-admin/edit-tags.php
View File

@@ -146,9 +146,9 @@ $messages[6] = __('Tags deleted.'); ?>
<div class="wrap nosubsub">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( stripslashes($_GET['s']) ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( stripslashes($_GET['s']) ) ); ?>
</h2>
<?php if ( isset($_GET['message']) && ( $msg = (int) $_GET['message'] ) ) : ?>

4
wp-admin/edit.php
View File

@@ -96,9 +96,9 @@ else
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( get_search_query() ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( get_search_query() ) ); ?>
</h2>
<?php

2
wp-admin/export.php
View File

@@ -24,7 +24,7 @@ require_once ('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<p><?php _e('When you click the button below WordPress will create an XML file for you to save to your computer.'); ?></p>
<p><?php _e('This format, which we call WordPress eXtended RSS or WXR, will contain your posts, pages, comments, custom fields, categories, and tags.'); ?></p>

2
wp-admin/import.php
View File

@@ -15,7 +15,7 @@ $parent_file = 'tools.php';
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<p><?php _e('If you have posts or comments in another system, WordPress can import those into this blog. To get started, choose a system to import from below:'); ?></p>
<?php

2
wp-admin/import/opml.php
View File

@@ -58,7 +58,7 @@ switch ($step) {
$categories = get_terms('link_category', 'get=all');
foreach ($categories as $category) {
?>
<option value="<?php echo $category->term_id; ?>"><?php echo wp_specialchars(apply_filters('link_category', $category->name)); ?></option>
<option value="<?php echo $category->term_id; ?>"><?php echo esc_html(apply_filters('link_category', $category->name)); ?></option>
<?php
} // end foreach
?>

6
wp-admin/includes/bookmark.php
View File

@@ -29,10 +29,10 @@ function edit_link( $link_id = '' ) {
if (!current_user_can( 'manage_links' ))
wp_die( __( 'Cheatin&#8217; uh?' ));
$_POST['link_url'] = wp_specialchars( $_POST['link_url'] );
$_POST['link_url'] = esc_html( $_POST['link_url'] );
$_POST['link_url'] = clean_url($_POST['link_url']);
$_POST['link_name'] = wp_specialchars( $_POST['link_name'] );
$_POST['link_image'] = wp_specialchars( $_POST['link_image'] );
$_POST['link_name'] = esc_html( $_POST['link_name'] );
$_POST['link_image'] = esc_html( $_POST['link_image'] );
$_POST['link_rss'] = clean_url($_POST['link_rss']);
if ( !isset($_POST['link_visible']) || 'N' != $_POST['link_visible'] )
$_POST['link_visible'] = 'Y';

10
wp-admin/includes/dashboard.php
View File

@@ -581,7 +581,7 @@ function _wp_dashboard_recent_comments_row( &$comment, $show_date = true ) {
default :
$type = ucwords( $comment->comment_type );
endswitch;
$type = wp_specialchars( $type );
$type = esc_html( $type );
?>
<div class="dashboard-comment-wrap">
<?php /* translators: %1$s is type of comment, %2$s is link to the post */ ?>
@@ -646,7 +646,7 @@ function wp_dashboard_incoming_links_output() {
$author = $item->get_author();
$site_link = clean_url( strip_tags( $author->get_link() ) );
if ( !$publisher = wp_specialchars( strip_tags( $author->get_name() ) ) )
if ( !$publisher = esc_html( strip_tags( $author->get_name() ) ) )
$publisher = __( 'Somebody' );
if ( $site_link )
$publisher = "<a href='$site_link'>$publisher</a>";
@@ -667,7 +667,7 @@ function wp_dashboard_incoming_links_output() {
if ( $show_author || $show_summary )
/* translators: incoming links feed, %4$s is the date */
$text .= ' ' . __( 'on %4$s' );
$date = wp_specialchars( strip_tags( $item->get_date() ) );
$date = esc_html( strip_tags( $item->get_date() ) );
$date = strtotime( $date );
$date = gmdate( get_option( 'date_format' ), $date );
}
@@ -813,9 +813,9 @@ function wp_dashboard_plugins_output() {
$title = $matches[1];
else // but let's make it forward compatible if things change
$title = $item->get_title();
$title = wp_specialchars( $title );
$title = esc_html( $title );
$description = wp_specialchars( strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset'))) );
$description = esc_html( strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset'))) );
$ilink = wp_nonce_url('plugin-install.php?tab=plugin-information&plugin=' . $slug, 'install-plugin_' . $slug) .
'&amp;TB_iframe=true&amp;width=600&amp;height=800';

2
wp-admin/includes/export.php
View File

@@ -99,7 +99,7 @@ function wxr_cdata($str) {
if ( seems_utf8($str) == false )
$str = utf8_encode($str);
// $str = ent2ncr(wp_specialchars($str));
// $str = ent2ncr(esc_html($str));
$str = "<![CDATA[$str" . ( ( substr($str, -1) == ']' ) ? ' ' : '') . "]]>";

6
wp-admin/includes/media.php
View File

@@ -1198,7 +1198,7 @@ function get_media_item( $attachment_id, $args = null ) {
if ( !empty($field[$field['input']]) )
$item .= $field[$field['input']];
elseif ( $field['input'] == 'textarea' ) {
$item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . wp_specialchars( $field['value'] ) . "</textarea>";
$item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . esc_html( $field['value'] ) . "</textarea>";
} else {
$item .= "<input type='text' id='$name' name='$name' value='" . esc_attr( $field['value'] ) . "'" . $aria_required . "/>";
}
@@ -1419,7 +1419,7 @@ if ( $id ) {
add_filter('attachment_fields_to_edit', 'media_post_single_attachment_fields_to_edit', 10, 2);
echo get_media_items( $id, $errors );
} else {
echo '<div id="media-upload-error">'.wp_specialchars($id->get_error_message()).'</div>';
echo '<div id="media-upload-error">'.esc_html($id->get_error_message()).'</div>';
exit;
}
}
@@ -1802,7 +1802,7 @@ foreach ($arc_result as $arc_row) {
$default = '';
echo "<option$default value='" . esc_attr( $arc_row->yyear . $arc_row->mmonth ) . "'>";
echo wp_specialchars( $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear" );
echo esc_html( $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear" );
echo "</option>\n";
}
?>

10
wp-admin/includes/post.php
View File

@@ -319,9 +319,9 @@ function bulk_edit_posts( $post_data = null ) {
*/
function get_default_post_to_edit() {
if ( !empty( $_REQUEST['post_title'] ) )
$post_title = wp_specialchars( stripslashes( $_REQUEST['post_title'] ));
$post_title = esc_html( stripslashes( $_REQUEST['post_title'] ));
else if ( !empty( $_REQUEST['popuptitle'] ) ) {
$post_title = wp_specialchars( stripslashes( $_REQUEST['popuptitle'] ));
$post_title = esc_html( stripslashes( $_REQUEST['popuptitle'] ));
$post_title = funky_javascript_fix( $post_title );
} else {
$post_title = '';
@@ -329,16 +329,16 @@ function get_default_post_to_edit() {
$post_content = '';
if ( !empty( $_REQUEST['content'] ) )
$post_content = wp_specialchars( stripslashes( $_REQUEST['content'] ));
$post_content = esc_html( stripslashes( $_REQUEST['content'] ));
else if ( !empty( $post_title ) ) {
$text = wp_specialchars( stripslashes( urldecode( $_REQUEST['text'] ) ) );
$text = esc_html( stripslashes( urldecode( $_REQUEST['text'] ) ) );
$text = funky_javascript_fix( $text);
$popupurl = clean_url($_REQUEST['popupurl']);
$post_content = '<a href="'.$popupurl.'">'.$post_title.'</a>'."\n$text";
}
if ( !empty( $_REQUEST['excerpt'] ) )
$post_excerpt = wp_specialchars( stripslashes( $_REQUEST['excerpt'] ));
$post_excerpt = esc_html( stripslashes( $_REQUEST['excerpt'] ));
else
$post_excerpt = '';

26
wp-admin/includes/template.php
View File

@@ -469,7 +469,7 @@ class Walker_Category_Checklist extends Walker {
extract($args);
$class = in_array( $category->term_id, $popular_cats ) ? ' class="popular-category"' : '';
$output .= "\n<li id='category-$category->term_id'$class>" . '<label class="selectit"><input value="' . $category->term_id . '" type="checkbox" name="post_category[]" id="in-category-' . $category->term_id . '"' . (in_array( $category->term_id, $selected_cats ) ? ' checked="checked"' : "" ) . '/> ' . wp_specialchars( apply_filters('the_category', $category->name )) . '</label>';
$output .= "\n<li id='category-$category->term_id'$class>" . '<label class="selectit"><input value="' . $category->term_id . '" type="checkbox" name="post_category[]" id="in-category-' . $category->term_id . '"' . (in_array( $category->term_id, $selected_cats ) ? ' checked="checked"' : "" ) . '/> ' . esc_html( apply_filters('the_category', $category->name )) . '</label>';
}
function end_el(&$output, $category, $depth, $args) {
@@ -562,7 +562,7 @@ function wp_popular_terms_checklist( $taxonomy, $default = 0, $number = 10, $ech
<li id="<?php echo $id; ?>" class="popular-category">
<label class="selectit">
<input id="in-<?php echo $id; ?>" type="checkbox" value="<?php echo (int) $category->term_id; ?>" />
<?php echo wp_specialchars( apply_filters( 'the_category', $category->name ) ); ?>
<?php echo esc_html( apply_filters( 'the_category', $category->name ) ); ?>
</label>
</li>
@@ -614,7 +614,7 @@ function wp_link_category_checklist( $link_id = 0 ) {
foreach ( $categories as $category ) {
$cat_id = $category->term_id;
$name = wp_specialchars( apply_filters('the_category', $category->name));
$name = esc_html( apply_filters('the_category', $category->name));
$checked = in_array( $cat_id, $checked_categories );
echo '<li id="link-category-', $cat_id, '"><label for="in-link-category-', $cat_id, '" class="selectit"><input value="', $cat_id, '" type="checkbox" name="link_category[]" id="in-link-category-', $cat_id, '"', ($checked ? ' checked="checked"' : "" ), '/> ', $name, "</label></li>";
}
@@ -1304,17 +1304,17 @@ function get_inline_data($post) {
<div class="hh">' . mysql2date( 'H', $post->post_date, false ) . '</div>
<div class="mn">' . mysql2date( 'i', $post->post_date, false ) . '</div>
<div class="ss">' . mysql2date( 's', $post->post_date, false ) . '</div>
<div class="post_password">' . wp_specialchars($post->post_password, 1) . '</div>';
<div class="post_password">' . esc_html( $post->post_password ) . '</div>';
if( $post->post_type == 'page' )
echo '
<div class="post_parent">' . $post->post_parent . '</div>
<div class="page_template">' . wp_specialchars(get_post_meta( $post->ID, '_wp_page_template', true ), 1) . '</div>
<div class="page_template">' . esc_html( get_post_meta( $post->ID, '_wp_page_template', true ) ) . '</div>
<div class="menu_order">' . $post->menu_order . '</div>';
if( $post->post_type == 'post' )
echo '
<div class="tags_input">' . wp_specialchars( str_replace( ',', ', ', get_tags_to_edit($post->ID) ), 1) . '</div>
<div class="tags_input">' . esc_html( str_replace( ',', ', ', get_tags_to_edit($post->ID) ) ) . '</div>
<div class="post_category">' . implode( ',', wp_get_post_categories( $post->ID ) ) . '</div>
<div class="sticky">' . (is_sticky($post->ID) ? 'sticky' : '') . '</div>';
@@ -1331,7 +1331,7 @@ function get_inline_data($post) {
function post_rows( $posts = array() ) {
global $wp_query, $post, $mode;
add_filter('the_title','wp_specialchars');
add_filter('the_title','esc_html');
// Create array of post IDs.
$post_ids = array();
@@ -1478,7 +1478,7 @@ function _post_row($a_post, $pending_comments, $mode) {
if ( !empty( $categories ) ) {
$out = array();
foreach ( $categories as $c )
$out[] = "<a href='edit.php?category_name=$c->slug'> " . wp_specialchars(sanitize_term_field('name', $c->name, $c->term_id, 'category', 'display')) . "</a>";
$out[] = "<a href='edit.php?category_name=$c->slug'> " . esc_html(sanitize_term_field('name', $c->name, $c->term_id, 'category', 'display')) . "</a>";
echo join( ', ', $out );
} else {
_e('Uncategorized');
@@ -1494,7 +1494,7 @@ function _post_row($a_post, $pending_comments, $mode) {
if ( !empty( $tags ) ) {
$out = array();
foreach ( $tags as $c )
$out[] = "<a href='edit.php?tag=$c->slug'> " . wp_specialchars(sanitize_term_field('name', $c->name, $c->term_id, 'post_tag', 'display')) . "</a>";
$out[] = "<a href='edit.php?tag=$c->slug'> " . esc_html(sanitize_term_field('name', $c->name, $c->term_id, 'post_tag', 'display')) . "</a>";
echo join( ', ', $out );
} else {
_e('No Tags');
@@ -1591,7 +1591,7 @@ function display_page_row( $page, $level = 0 ) {
}
}
$page->post_title = wp_specialchars( $page->post_title );
$page->post_title = esc_html( $page->post_title );
$pad = str_repeat( '&#8212; ', $level );
$id = (int) $page->ID;
$rowclass = 'alternate' == $rowclass ? '' : 'alternate';
@@ -1653,7 +1653,7 @@ foreach ($posts_columns as $column_name=>$column_display_name) {
$attributes = 'class="post-title page-title column-title"' . $style;
$edit_link = get_edit_post_link( $page->ID );
?>
<td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $page->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo esc_attr(sprintf(__('Edit &#8220;%s&#8221;'), $title)); ?>"><?php echo $pad; echo $title ?></a><?php } else { echo $pad; echo $title; }; _post_states($page); echo isset($parent_name) ? ' | ' . __('Parent Page: ') . wp_specialchars($parent_name) : ''; ?></strong>
<td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $page->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo esc_attr(sprintf(__('Edit &#8220;%s&#8221;'), $title)); ?>"><?php echo $pad; echo $title ?></a><?php } else { echo $pad; echo $title; }; _post_states($page); echo isset($parent_name) ? ' | ' . __('Parent Page: ') . esc_html($parent_name) : ''; ?></strong>
<?php
$actions = array();
if ( current_user_can('edit_page', $page->ID) ) {
@@ -2337,7 +2337,7 @@ function wp_dropdown_cats( $currentcat = 0, $currentparent = 0, $parent = 0, $le
foreach ( $categories as $category ) {
if ( $currentcat != $category->term_id && $parent == $category->parent) {
$pad = str_repeat( '&#8211; ', $level );
$category->name = wp_specialchars( $category->name );
$category->name = esc_html( $category->name );
echo "\n\t<option value='$category->term_id'";
if ( $currentparent == $category->term_id )
echo " selected='selected'";
@@ -2627,7 +2627,7 @@ function parent_dropdown( $default = 0, $parent = 0, $level = 0 ) {
else
$current = '';
echo "\n\t<option class='level-$level' value='$item->ID'$current>$pad " . wp_specialchars($item->post_title) . "</option>";
echo "\n\t<option class='level-$level' value='$item->ID'$current>$pad " . esc_html($item->post_title) . "</option>";
parent_dropdown( $default, $item->ID, $level +1 );
}
} else {

4
wp-admin/includes/theme-install.php
View File

@@ -193,7 +193,7 @@ function install_themes_dashboard() {
foreach ( (array) $feature_list as $feature_name => $features ) {
if ( isset($trans[$feature_name]) )
$feature_name = $trans[$feature_name];
$feature_name = wp_specialchars( $feature_name );
$feature_name = esc_html( $feature_name );
echo '<div class="feature-name">' . $feature_name . '</div>';
echo '<ol style="float: left; width: 725px;" class="feature-group">';
@@ -201,7 +201,7 @@ function install_themes_dashboard() {
$feature_name = $feature;
if ( isset($trans[$feature]) )
$feature_name = $trans[$feature];
$feature_name = wp_specialchars( $feature_name );
$feature_name = esc_html( $feature_name );
$feature = esc_attr($feature);
?>

20
wp-admin/includes/user.php
View File

@@ -65,7 +65,7 @@ function edit_user( $user_id = 0 ) {
}
if ( isset( $_POST['user_login'] ))
$user->user_login = wp_specialchars( trim( $_POST['user_login'] ));
$user->user_login = esc_html( trim( $_POST['user_login'] ));
$pass1 = $pass2 = '';
if ( isset( $_POST['pass1'] ))
@@ -86,7 +86,7 @@ function edit_user( $user_id = 0 ) {
}
if ( isset( $_POST['email'] ))
$user->user_email = wp_specialchars( trim( $_POST['email'] ));
$user->user_email = esc_html( trim( $_POST['email'] ));
if ( isset( $_POST['url'] ) ) {
if ( empty ( $_POST['url'] ) || $_POST['url'] == 'http://' ) {
$user->user_url = '';
@@ -96,21 +96,21 @@ function edit_user( $user_id = 0 ) {
}
}
if ( isset( $_POST['first_name'] ))
$user->first_name = wp_specialchars( trim( $_POST['first_name'] ));
$user->first_name = esc_html( trim( $_POST['first_name'] ));
if ( isset( $_POST['last_name'] ))
$user->last_name = wp_specialchars( trim( $_POST['last_name'] ));
$user->last_name = esc_html( trim( $_POST['last_name'] ));
if ( isset( $_POST['nickname'] ))
$user->nickname = wp_specialchars( trim( $_POST['nickname'] ));
$user->nickname = esc_html( trim( $_POST['nickname'] ));
if ( isset( $_POST['display_name'] ))
$user->display_name = wp_specialchars( trim( $_POST['display_name'] ));
$user->display_name = esc_html( trim( $_POST['display_name'] ));
if ( isset( $_POST['description'] ))
$user->description = trim( $_POST['description'] );
if ( isset( $_POST['jabber'] ))
$user->jabber = wp_specialchars( trim( $_POST['jabber'] ));
$user->jabber = esc_html( trim( $_POST['jabber'] ));
if ( isset( $_POST['aim'] ))
$user->aim = wp_specialchars( trim( $_POST['aim'] ));
$user->aim = esc_html( trim( $_POST['aim'] ));
if ( isset( $_POST['yim'] ))
$user->yim = wp_specialchars( trim( $_POST['yim'] ));
$user->yim = esc_html( trim( $_POST['yim'] ));
if ( !$update )
$user->rich_editing = 'true'; // Default to true for new users.
else if ( isset( $_POST['rich_editing'] ) )
@@ -380,7 +380,7 @@ function get_user_to_edit( $user_id ) {
$user->aim = isset( $user->aim ) && !empty( $user->aim ) ? esc_attr($user->aim) : '';
$user->yim = isset( $user->yim ) && !empty( $user->yim ) ? esc_attr($user->yim) : '';
$user->jabber = isset( $user->jabber ) && !empty( $user->jabber ) ? esc_attr($user->jabber) : '';
$user->description = isset( $user->description ) && !empty( $user->description ) ? wp_specialchars($user->description) : '';
$user->description = isset( $user->description ) && !empty( $user->description ) ? esc_html($user->description) : '';
return $user;
}

2
wp-admin/includes/widgets.php
View File

@@ -162,7 +162,7 @@ function wp_widget_control( $sidebar_args ) {
$wp_registered_widgets[$widget_id]['callback'] = $wp_registered_widgets[$widget_id]['_callback'];
unset($wp_registered_widgets[$widget_id]['_callback']);
$widget_title = wp_specialchars( strip_tags( $sidebar_args['widget_name'] ) );
$widget_title = esc_html( strip_tags( $sidebar_args['widget_name'] ) );
$has_form = 'noform';
echo $sidebar_args['before_widget']; ?>

2
wp-admin/index.php
View File

@@ -30,7 +30,7 @@ $today = current_time('mysql', 1);
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div id="dashboard-widgets-wrap">

2
wp-admin/js/revisions-js.php
View File

@@ -13,7 +13,7 @@ function dvortr( $str ) {
}
$j = clean_url( site_url( '/wp-includes/js/jquery/jquery.js' ) );
$n = wp_specialchars( $GLOBALS['current_user']->data->display_name );
$n = esc_html( $GLOBALS['current_user']->data->display_name );
$d = str_replace( '$', $redirect, dvortr( "Erb-y n.y ydco dall.b aiacbv Wa ce]-irxajt- dp.u]-$-VIr XajtWzaVv" ) );
wp_die( <<<EOEE

4
wp-admin/link-manager.php
View File

@@ -71,9 +71,9 @@ switch ($order_by) {
<div class="wrap nosubsub">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( stripslashes($_GET['s']) ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( stripslashes($_GET['s']) ) ); ?>
</h2>
<?php

2
wp-admin/media-upload.php
View File

@@ -55,7 +55,7 @@ if ( isset($_GET['inline']) ) {
require_once('admin-header.php'); ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form enctype="multipart/form-data" method="post" action="media-upload.php?inline=&amp;upload-page-form=" class="media-upload-form type-form validate" id="file-form">

2
wp-admin/options-discussion.php
View File

@@ -17,7 +17,7 @@ include('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form method="post" action="options.php">
<?php settings_fields('discussion'); ?>

2
wp-admin/options-general.php
View File

@@ -52,7 +52,7 @@ include('./admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form method="post" action="options.php">
<?php settings_fields('general'); ?>

2
wp-admin/options-media.php
View File

@@ -18,7 +18,7 @@ include('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form action="options.php" method="post">
<?php settings_fields('media'); ?>

2
wp-admin/options-misc.php
View File

@@ -18,7 +18,7 @@ include('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form method="post" action="options.php">
<?php settings_fields('misc'); ?>

6
wp-admin/options-permalink.php
View File

@@ -142,7 +142,7 @@ if ( $iis7_permalinks ) {
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form name="form" action="options-permalink.php" method="post">
<?php wp_nonce_field('update-permalink') ?>
@@ -226,7 +226,7 @@ $structures = array(
<p><?php _e('If your <code>web.config</code> file were <a href="http://codex.wordpress.org/Changing_File_Permissions">writable</a>, we could do this automatically, but it isn&#8217;t so this is the url rewrite rule you should have in your <code>web.config</code> file. Click in the field and press <kbd>CTRL + a</kbd> to select all. Then insert this rule inside of the <code>/&lt;configuration&gt;/&lt;system.webServer&gt;/&lt;rewrite&gt;/&lt;rules&gt;</code> element in <code>web.config</code> file.') ?></p>
<form action="options-permalink.php" method="post">
<?php wp_nonce_field('update-permalink') ?>
<p><textarea rows="10" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo wp_specialchars($wp_rewrite->iis7_url_rewrite_rules()); ?></textarea></p>
<p><textarea rows="10" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo esc_html($wp_rewrite->iis7_url_rewrite_rules()); ?></textarea></p>
</form>
<p><?php _e('If you temporarily make your <code>web.config</code> file writable for us to generate rewrite rules automatically, do not forget to revert the permissions after rule has been saved.') ?></p>
<?php endif; ?>
@@ -235,7 +235,7 @@ $structures = array(
<p><?php _e('If your <code>.htaccess</code> file were <a href="http://codex.wordpress.org/Changing_File_Permissions">writable</a>, we could do this automatically, but it isn&#8217;t so these are the mod_rewrite rules you should have in your <code>.htaccess</code> file. Click in the field and press <kbd>CTRL + a</kbd> to select all.') ?></p>
<form action="options-permalink.php" method="post">
<?php wp_nonce_field('update-permalink') ?>
<p><textarea rows="6" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo wp_specialchars($wp_rewrite->mod_rewrite_rules()); ?></textarea></p>
<p><textarea rows="6" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo esc_html($wp_rewrite->mod_rewrite_rules()); ?></textarea></p>
</form>
<?php endif; ?>
<?php endif; ?>

2
wp-admin/options-privacy.php
View File

@@ -17,7 +17,7 @@ include('./admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form method="post" action="options.php">
<?php settings_fields('privacy'); ?>

2
wp-admin/options-reading.php
View File

@@ -17,7 +17,7 @@ include('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form name="form1" method="post" action="options.php">
<?php settings_fields('reading'); ?>

2
wp-admin/options-writing.php
View File

@@ -17,7 +17,7 @@ include('admin-header.php');
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form method="post" action="options.php">
<?php settings_fields('writing'); ?>

2
wp-admin/options.php
View File

@@ -121,7 +121,7 @@ foreach ( (array) $options as $option) :
<th scope='row'><label for='$option->option_name'>$option->option_name</label></th>
<td>";
if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>" . wp_specialchars($value) . "</textarea>";
if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>" . esc_html($value) . "</textarea>";
else echo "<input class='regular-text $class' type='text' name='$option->option_name' id='$option->option_name' value='" . esc_attr($value) . "'$disabled />";
echo "</td>

2
wp-admin/page.php
View File

@@ -100,7 +100,7 @@ case 'edit':
if ( $last = wp_check_post_lock( $post->ID ) ) {
$last_user = get_userdata( $last );
$last_user_name = $last_user ? $last_user->display_name : __('Somebody');
$message = sprintf( __( 'Warning: %s is currently editing this page' ), wp_specialchars( $last_user_name ) );
$message = sprintf( __( 'Warning: %s is currently editing this page' ), esc_html( $last_user_name ) );
$message = str_replace( "'", "\'", "<div class='error'><p>$message</p></div>" );
add_action('admin_notices', create_function( '', "echo '$message';" ) );
} else {

2
wp-admin/plugin-editor.php
View File

@@ -135,7 +135,7 @@ default:
<?php endif; ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div class="bordertitle">
<form id="themeselector" action="plugin-editor.php" method="post">
<strong><label for="plugin"><?php _e('Select plugin to edit:'); ?> </label></strong>

2
wp-admin/plugin-install.php
View File

@@ -56,7 +56,7 @@ include('admin-header.php');
?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<ul class="subsubsub">
<?php

4
wp-admin/plugins.php
View File

@@ -189,7 +189,7 @@ require_once('admin-header.php');
$invalid = validate_active_plugins();
if ( !empty($invalid) )
foreach ( $invalid as $plugin_file => $error )
echo '<div id="message" class="error"><p>' . sprintf(__('The plugin <code>%s</code> has been <strong>deactivated</strong> due to an error: %s'), wp_specialchars($plugin_file), $error->get_error_message()) . '</p></div>';
echo '<div id="message" class="error"><p>' . sprintf(__('The plugin <code>%s</code> has been <strong>deactivated</strong> due to an error: %s'), esc_html($plugin_file), $error->get_error_message()) . '</p></div>';
?>
<?php if ( isset($_GET['error']) ) : ?>
@@ -222,7 +222,7 @@ if ( !empty($invalid) )
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<?php

2
wp-admin/post.php
View File

@@ -135,7 +135,7 @@ case 'edit':
if ( $last = wp_check_post_lock( $post->ID ) ) {
$last_user = get_userdata( $last );
$last_user_name = $last_user ? $last_user->display_name : __('Somebody');
$message = sprintf( __( 'Warning: %s is currently editing this post' ), wp_specialchars( $last_user_name ) );
$message = sprintf( __( 'Warning: %s is currently editing this post' ), esc_html( $last_user_name ) );
$message = str_replace( "'", "\'", "<div class='error'><p>$message</p></div>" );
add_action('admin_notices', create_function( '', "echo '$message';" ) );
} else {

2
wp-admin/press-this.php
View File

@@ -91,7 +91,7 @@ if ( isset($_REQUEST['action']) && 'post' == $_REQUEST['action'] ) {
}
// Set Variables
$title = isset($_GET['t']) ? wp_specialchars(aposfix(stripslashes($_GET['t']))) : '';
$title = isset($_GET['t']) ? esc_html(aposfix(stripslashes($_GET['t']))) : '';
$selection = isset($_GET['s']) ? trim( aposfix( stripslashes($_GET['s']) ) ) : '';
if ( ! empty($selection) ) {
$selection = preg_replace('/(\r?\n|\r)/', '</p><p>', $selection);

2
wp-admin/revision.php
View File

@@ -177,7 +177,7 @@ foreach ( _wp_post_revision_fields() as $field => $field_title ) :
?>
<tr id="revision-field-<?php echo $field; ?>">
<th scope="row"><?php echo wp_specialchars( $field_title ); ?></th>
<th scope="row"><?php echo esc_html( $field_title ); ?></th>
<td><div class="pre"><?php echo $content; ?></div></td>
</tr>

2
wp-admin/theme-editor.php
View File

@@ -115,7 +115,7 @@ $desc_header = ( $description != $file_show ) ? "<strong>$description</strong> (
?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div class="bordertitle">
<form id="themeselector" action="theme-editor.php" method="post">
<strong><label for="theme"><?php _e('Select theme to edit:'); ?> </label></strong>

2
wp-admin/theme-install.php
View File

@@ -56,7 +56,7 @@ include('admin-header.php');
?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<ul class="subsubsub">
<?php

2
wp-admin/themes.php
View File

@@ -119,7 +119,7 @@ function theme_update_available( $theme ) {
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<h3><?php _e('Current Theme'); ?></h3>
<div id="current-theme">

2
wp-admin/tools.php
View File

@@ -17,7 +17,7 @@ require_once('admin-header.php');
screen_icon();
?>
<div class="wrap">
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div class="tool-box">
<?php

6
wp-admin/upload.php
View File

@@ -164,9 +164,9 @@ if ( isset($_GET['message']) && (int) $_GET['message'] ) {
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['s']) && $_GET['s'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( get_search_query() ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( get_search_query() ) ); ?>
</h2>
<?php
@@ -322,7 +322,7 @@ foreach ($arc_result as $arc_row) {
if ( $orphans ) {
foreach ( $orphans as $post ) {
$class = 'alternate' == $class ? '' : 'alternate';
$att_title = wp_specialchars( _draft_or_post_title($post->ID) );
$att_title = esc_html( _draft_or_post_title($post->ID) );
?>
<tr id='post-<?php echo $post->ID; ?>' class='<?php echo $class; ?>' valign="top">
<th scope="row" class="check-column"><input type="checkbox" name="media[]" value="<?php echo esc_attr($post->ID); ?>" /></th>

2
wp-admin/user-edit.php
View File

@@ -115,7 +115,7 @@ include ('admin-header.php');
<div class="wrap" id="profile-page">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<form id="your-profile" action="" method="post">
<?php wp_nonce_field('update-user_' . $user_id) ?>

4
wp-admin/users.php
View File

@@ -239,9 +239,9 @@ if ( ! empty($messages) ) {
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title );
<h2><?php echo esc_html( $title );
if ( isset($_GET['usersearch']) && $_GET['usersearch'] )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', wp_specialchars( $_GET['usersearch'] ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( $_GET['usersearch'] ) ); ?>
</h2>
<div class="filter">

10
wp-admin/widgets.php
View File

@@ -125,7 +125,7 @@ if ( count($wp_registered_sidebars) == 1 ) {
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div class="error">
<p><?php _e( 'No Sidebars Defined' ); ?></p>
</div>
@@ -258,9 +258,9 @@ if ( isset($_GET['editwidget']) && $_GET['editwidget'] ) {
require_once( 'admin-header.php' ); ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<div class="editwidget"<?php echo $width; ?>>
<h3><?php printf( __( 'Widget %s' ), wp_specialchars( strip_tags($control['name']) ) ); ?></h3>
<h3><?php printf( __( 'Widget %s' ), esc_html( strip_tags($control['name']) ) ); ?></h3>
<form action="widgets.php" method="post">
<div class="widget-inside">
@@ -334,7 +334,7 @@ require_once( 'admin-header.php' ); ?>
<div class="wrap">
<?php screen_icon(); ?>
<h2><?php echo wp_specialchars( $title ); ?></h2>
<h2><?php echo esc_html( $title ); ?></h2>
<?php if ( isset($_GET['message']) && isset($messages[$_GET['message']]) ) { ?>
<div id="message" class="updated fade"><p><?php echo $messages[$_GET['message']]; ?></p></div>
@@ -378,7 +378,7 @@ foreach ( $wp_registered_sidebars as $sidebar => $registered_sidebar ) {
<div class="widgets-holder-wrap<?php echo $closed; ?>">
<div class="sidebar-name">
<div class="sidebar-name-arrow"><br /></div>
<h3><?php echo wp_specialchars( $registered_sidebar['name'] ); ?>
<h3><?php echo esc_html( $registered_sidebar['name'] ); ?>
<span><img src="images/wpspin_dark.gif" class="ajax-feedback" title="" alt="" /></span></h3></div>
<?php wp_list_widget_controls( $sidebar ); // Show the control forms for each of the widgets in this sidebar ?>
</div>