WordPress.org

Make WordPress Core

Ticket #11040: esc_attr.patch

File esc_attr.patch, 483 bytes (added by scribu, 9 years ago)

Use wp_strip_all_tags() instead of _wp_specialchars()

  • wp-includes/formatting.php

     
    23142314 */
    23152315function esc_attr( $text ) {
    23162316        $safe_text = wp_check_invalid_utf8( $text );
    2317         $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );
     2317        $safe_text = wp_strip_all_tags( $safe_text, true );
    23182318        return apply_filters( 'attribute_escape', $safe_text, $text );
    23192319}
    23202320