Ticket #5998: 5998-comment-php.3.patch

wp-includes/comment.php

@@ -1235 +1235 @@
  * @return int The ID of the comment after adding.
  */
 function wp_new_comment( $commentdata ) {
+    if ( get_bloginfo('html_type') == 'application/xhtml+xml' 
+         && get_bloginfo('charset') == 'UTF-8' ) {
+        if ( $xml_parser = xml_parser_create('UTF-8') ){
+            $fake_xml_wrap = '<pre>' . $commentdata['comment_content'] . '</pre>';
+            if (!xml_parse($xml_parser, $fake_xml_wrap)) {
+                $err = sprintf('XML error: %s at line %d column %d',
+                         xml_error_string(xml_get_error_code($xml_parser)),
+                         xml_get_current_line_number($xml_parser),
+                         xml_get_current_column_number($xml_parser));
+                wp_die( __($err) );
+            }
+        }
+        xml_parser_free($xml_parser);
+    }
         $commentdata = apply_filters('preprocess_comment', $commentdata);
 
         $commentdata['comment_post_ID'] = (int) $commentdata['comment_post_ID'];