Inserting an video/audio/media with an apostrophe in the title results in \' in the HTML

[layotte]

If you insert a link using the Video, Audio, or Media buttons (note the Image button) and the Title has an apostrophe, the apostrophe is escaped with a slash.

e.g.

Video URL: ​http://my.awesomevideo.com/video

Title: Lew's Awesome Video

<a href="​http://my.awesomevideo.com/video">Lew\'s Awesome Video</a>

Seems related to an old (already fixed) bug #6414

stripslashes from $_POSTinstertonly?title?

The proper fix here would probably be to entity-encode the html special chars. This will also produce valid HTML when > and < are entered.

The > < chars are already fine already...

Only the quotes are being escaped and it looks like it is part of $_POST[insertonly][title]...

esc_attr is already being applied, but I think because the quotes are already escaped it isn't trying to convert them. I tried switching to esc_html and htmlspecialchars with no difference.

So this:

Lew's >, <, & "quote"

becomes:

Lew\'s >, <, & \"quote\"

If I don't stripslashes.

Can you double-check to see if this is still a problem for you?
I'm not able to reproduce the issue on 3.2.1 or trunk -- perhaps it has been since fixed?

I can reproduce on trunk by clicking Add Video > From URL and putting the values mentioned in the ticket into the fields.

refreshed to current version & used svn diff to make this a bit easier to apply.

Got rid of the coding standards tabbing fix, since there are a lot more instances. That'll be for a different patch.

You're correct! Apparently I tried every method of inserting but that one.
Patch works as advertised -- refreshed the patch to current code, and to get rid of the extra tabs added by the newlines in the patch.

Related 18445

Patch need refresh. 3.3 seems to have additional problems:

PHP Notice:  Undefined index: insertonly in /trunk/wp-admin/includes/media.php on line 515, referer: http://localhost/trunk/wp-admin/media-upload.php?post_id=2507&tab=type_url
PHP Notice:  Undefined index: insertonly in /trunk/wp-admin/includes/media.php on line 520, referer: http://localhost/trunk/wp-admin/media-upload.php?post_id=2507&tab=type_url
PHP Notice:  Undefined variable: html in /trunk/wp-admin/includes/media.php on line 532, referer: http://localhost/trunk/wp-admin/media-upload.php?post_id=2507&tab=type_url

In [18992]:

Fix media/audio/file URL insertion. Strip slashes off title text. Leave red X to images only. fixes #14996. fixes #17578.