Ticket #10874: esc_html.diff

wp-includes/wp-db.php

@@ -607 +607 @@
                 if ( !$this->show_errors )
                         return false;
 
-                $str = htmlspecialchars($str, ENT_QUOTES);
-                $query = htmlspecialchars($this->last_query, ENT_QUOTES);
+                $str = esc_html($str);
+                $query = esc_html($this->last_query);
 
                 // If there is an error then take note of it
                 print "<div id='error'>

wp-admin/includes/template.php

@@ -2141 +2141 @@
                                 comment_text();
                                 if ( $user_can ) { ?>
                                 <div id="inline-<?php echo $comment->comment_ID; ?>" class="hidden">
-                                <textarea class="comment" rows="1" cols="1"><?php echo htmlspecialchars( apply_filters('comment_edit_pre', $comment->comment_content), ENT_QUOTES ); ?></textarea>
+                                <textarea class="comment" rows="1" cols="1"><?php echo esc_html( apply_filters('comment_edit_pre', $comment->comment_content) ); ?></textarea>
                                 <div class="author-email"><?php echo esc_attr( $comment->comment_author_email ); ?></div>
                                 <div class="author"><?php echo esc_attr( $comment->comment_author ); ?></div>
                                 <div class="author-url"><?php echo esc_attr( $comment->comment_author_url ); ?></div>

wp-admin/edit-page-form.php

@@ -120 +120 @@
 <div id="titlediv">
 <div id="titlewrap">
         <label class="screen-reader-text" for="title"><?php _e('Title') ?></label>
-        <input type="text" name="post_title" size="30" tabindex="1" value="<?php echo esc_attr( htmlspecialchars( $post->post_title ) ); ?>" id="title" autocomplete="off" />
+        <input type="text" name="post_title" size="30" tabindex="1" value="<?php echo esc_attr( $post->post_title ); ?>" id="title" autocomplete="off" />
 </div>
 <div class="inside">
 <?php $sample_permalink_html = get_sample_permalink_html($post->ID); ?>