WordPress.org

Make WordPress Core

Ticket #11040: esc_attr.patch

File esc_attr.patch, 483 bytes (added by scribu, 4 years ago)

Use wp_strip_all_tags() instead of _wp_specialchars()

  • wp-includes/formatting.php

     
    23142314 */ 
    23152315function esc_attr( $text ) { 
    23162316        $safe_text = wp_check_invalid_utf8( $text ); 
    2317         $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES ); 
     2317        $safe_text = wp_strip_all_tags( $safe_text, true ); 
    23182318        return apply_filters( 'attribute_escape', $safe_text, $text ); 
    23192319} 
    23202320