WordPress.org
Get WordPress

Make WordPress Core

Ticket #23012: 23012.6.diff

File 23012.6.diff, 33.3 KB (added by wonderboymusic, 10 years ago)

  • src/wp-includes/default-widgets.php

     
    203203                        $limit = -1;
    204204?>
    205205                <p>
    206                 <label for="<?php echo $this->get_field_id('category'); ?>"><?php _e( 'Select Link Category:' ); ?></label>
    207                 <select class="widefat" id="<?php echo $this->get_field_id('category'); ?>" name="<?php echo $this->get_field_name('category'); ?>">
     206                <label for="<?php echo esc_attr( $this->get_field_id( 'category' ) ); ?>"><?php _e( 'Select Link Category:' ); ?></label>
     207                <select class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'category' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'category' ) ); ?>">
    208208                <option value=""><?php _ex('All Links', 'links widget'); ?></option>
    209209                <?php
    210210                foreach ( $link_cats as $link_cat ) {
    … …  
    214214                }
    215215                ?>
    216216                </select>
    217                 <label for="<?php echo $this->get_field_id('orderby'); ?>"><?php _e( 'Sort by:' ); ?></label>
    218                 <select name="<?php echo $this->get_field_name('orderby'); ?>" id="<?php echo $this->get_field_id('orderby'); ?>" class="widefat">
     217                <label for="<?php echo esc_attr( $this->get_field_id( 'orderby' ) ); ?>"><?php _e( 'Sort by:' ); ?></label>
     218                <select name="<?php echo esc_attr( $this->get_field_name( 'orderby' ) ); ?>" id="<?php echo esc_attr( $this->get_field_id( 'orderby' ) ); ?>" class="widefat">
    219219                        <option value="name"<?php selected( $instance['orderby'], 'name' ); ?>><?php _e( 'Link title' ); ?></option>
    220220                        <option value="rating"<?php selected( $instance['orderby'], 'rating' ); ?>><?php _e( 'Link rating' ); ?></option>
    221221                        <option value="id"<?php selected( $instance['orderby'], 'id' ); ?>><?php _e( 'Link ID' ); ?></option>
    … …  
    223223                </select>
    224224                </p>
    225225                <p>
    226                 <input class="checkbox" type="checkbox" <?php checked($instance['images'], true) ?> id="<?php echo $this->get_field_id('images'); ?>" name="<?php echo $this->get_field_name('images'); ?>" />
    227                 <label for="<?php echo $this->get_field_id('images'); ?>"><?php _e('Show Link Image'); ?></label><br />
    228                 <input class="checkbox" type="checkbox" <?php checked($instance['name'], true) ?> id="<?php echo $this->get_field_id('name'); ?>" name="<?php echo $this->get_field_name('name'); ?>" />
    229                 <label for="<?php echo $this->get_field_id('name'); ?>"><?php _e('Show Link Name'); ?></label><br />
    230                 <input class="checkbox" type="checkbox" <?php checked($instance['description'], true) ?> id="<?php echo $this->get_field_id('description'); ?>" name="<?php echo $this->get_field_name('description'); ?>" />
    231                 <label for="<?php echo $this->get_field_id('description'); ?>"><?php _e('Show Link Description'); ?></label><br />
    232                 <input class="checkbox" type="checkbox" <?php checked($instance['rating'], true) ?> id="<?php echo $this->get_field_id('rating'); ?>" name="<?php echo $this->get_field_name('rating'); ?>" />
    233                 <label for="<?php echo $this->get_field_id('rating'); ?>"><?php _e('Show Link Rating'); ?></label>
     226                <input class="checkbox" type="checkbox" <?php checked( $instance['images'], true ) ?> id="<?php echo esc_attr( $this->get_field_id( 'images' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'images' ) ); ?>" />
     227                <label for="<?php echo esc_attr( $this->get_field_id( 'images' ) ); ?>"><?php _e('Show Link Image'); ?></label><br />
     228                <input class="checkbox" type="checkbox" <?php checked( $instance['name'], true ) ?> id="<?php echo esc_attr( $this->get_field_id( 'name' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'name' ) ); ?>" />
     229                <label for="<?php echo esc_attr( $this->get_field_id( 'name' ) ); ?>"><?php _e('Show Link Name'); ?></label><br />
     230                <input class="checkbox" type="checkbox" <?php checked( $instance['description'], true ) ?> id="<?php echo esc_attr( $this->get_field_id( 'description' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'description' ) ); ?>" />
     231                <label for="<?php echo esc_attr( $this->get_field_id( 'description' ) ); ?>"><?php _e('Show Link Description'); ?></label><br />
     232                <input class="checkbox" type="checkbox" <?php checked( $instance['rating'], true ) ?> id="<?php echo esc_attr( $this->get_field_id( 'rating' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'rating' ) ); ?>" />
     233                <label for="<?php echo esc_attr( $this->get_field_id( 'rating' ) ); ?>"><?php _e('Show Link Rating'); ?></label>
    234234                </p>
    235235                <p>
    236                 <label for="<?php echo $this->get_field_id('limit'); ?>"><?php _e( 'Number of links to show:' ); ?></label>
    237                 <input id="<?php echo $this->get_field_id('limit'); ?>" name="<?php echo $this->get_field_name('limit'); ?>" type="text" value="<?php echo $limit == -1 ? '' : intval( $limit ); ?>" size="3" />
     236                <label for="<?php echo esc_attr( $this->get_field_id( 'limit' ) ); ?>"><?php _e( 'Number of links to show:' ); ?></label>
     237                <input id="<?php echo esc_attr( $this->get_field_id( 'limit' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'limit' ) ); ?>" type="text" value="<?php echo $limit == -1 ? '' : intval( $limit ); ?>" size="3" />
    238238                </p>
    239239<?php
    240240        }
    … …  
    278278                $instance = wp_parse_args( (array) $instance, array( 'title' => '') );
    279279                $title = $instance['title'];
    280280?>
    281                 <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr($title); ?>" /></label></p>
     281                <p><label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"><?php _e('Title:'); ?> <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>" /></label></p>
    282282<?php
    283283        }
    284284
    … …  
    290290        public function update( $new_instance, $old_instance ) {
    291291                $instance = $old_instance;
    292292                $new_instance = wp_parse_args((array) $new_instance, array( 'title' => ''));
    293                 $instance['title'] = strip_tags($new_instance['title']);
     293                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    294294                return $instance;
    295295        }
    296296
    … …  
    402402        public function update( $new_instance, $old_instance ) {
    403403                $instance = $old_instance;
    404404                $new_instance = wp_parse_args( (array) $new_instance, array( 'title' => '', 'count' => 0, 'dropdown' => '') );
    405                 $instance['title'] = strip_tags($new_instance['title']);
     405                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    406406                $instance['count'] = $new_instance['count'] ? 1 : 0;
    407407                $instance['dropdown'] = $new_instance['dropdown'] ? 1 : 0;
    408408
    … …  
    414414         */
    415415        public function form( $instance ) {
    416416                $instance = wp_parse_args( (array) $instance, array( 'title' => '', 'count' => 0, 'dropdown' => '') );
    417                 $title = strip_tags($instance['title']);
    418                 $count = $instance['count'] ? 'checked="checked"' : '';
    419                 $dropdown = $instance['dropdown'] ? 'checked="checked"' : '';
    420417?>
    421                 <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr($title); ?>" /></p>
     418                <p><label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"><?php _e('Title:'); ?></label> <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" type="text" value="<?php echo esc_attr( $instance['title'] ); ?>" /></p>
    422419                <p>
    423                         <input class="checkbox" type="checkbox" <?php echo $dropdown; ?> id="<?php echo $this->get_field_id('dropdown'); ?>" name="<?php echo $this->get_field_name('dropdown'); ?>" /> <label for="<?php echo $this->get_field_id('dropdown'); ?>"><?php _e('Display as dropdown'); ?></label>
     420                        <input class="checkbox" type="checkbox" <?php checked( $instance['dropdown'] ); ?> id="<?php echo esc_attr( $this->get_field_id( 'dropdown' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'dropdown' ) ); ?>" /> <label for="<?php echo esc_attr( $this->get_field_id( 'dropdown' ) ); ?>"><?php _e( 'Display as dropdown' ); ?></label>
    424421                        <br/>
    425                         <input class="checkbox" type="checkbox" <?php echo $count; ?> id="<?php echo $this->get_field_id('count'); ?>" name="<?php echo $this->get_field_name('count'); ?>" /> <label for="<?php echo $this->get_field_id('count'); ?>"><?php _e('Show post counts'); ?></label>
     422                        <input class="checkbox" type="checkbox" <?php checked( $instance['count'] ); ?> id="<?php echo esc_attr( $this->get_field_id( 'count' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'count' ) ); ?>" /> <label for="<?php echo esc_attr( $this->get_field_id( 'count' ) ); ?>"><?php _e( 'Show post counts' ); ?></label>
    426423                </p>
    427424<?php
    428425        }
    … …  
    458455                        <ul>
    459456                        <?php wp_register(); ?>
    460457                        <li><?php wp_loginout(); ?></li>
    461                         <li><a href="<?php bloginfo('rss2_url'); ?>"><?php _e('Entries <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
    462                         <li><a href="<?php bloginfo('comments_rss2_url'); ?>"><?php _e('Comments <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
     458                        <li><a href="<?php echo esc_url( get_bloginfo( 'rss2_url' ) ); ?>"><?php _e('Entries <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
     459                        <li><a href="<?php echo esc_url( get_bloginfo( 'comments_rss2_url' ) ); ?>"><?php _e('Comments <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
    463460<?php
    464461                        /**
    465462                         * Filter the "Powered by WordPress" text in the Meta widget.
    … …  
    488485         */
    489486        public function update( $new_instance, $old_instance ) {
    490487                $instance = $old_instance;
    491                 $instance['title'] = strip_tags($new_instance['title']);
     488                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    492489
    493490                return $instance;
    494491        }
    … …  
    498495         */
    499496        public function form( $instance ) {
    500497                $instance = wp_parse_args( (array) $instance, array( 'title' => '' ) );
    501                 $title = strip_tags($instance['title']);
    502498?>
    503                         <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr($title); ?>" /></p>
     499                <p><label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"><?php _e('Title:'); ?></label> <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" type="text" value="<?php echo esc_attr( $instance['title'] ); ?>" /></p>
    504500<?php
    505501        }
    506502}
    … …  
    542538         */
    543539        public function update( $new_instance, $old_instance ) {
    544540                $instance = $old_instance;
    545                 $instance['title'] = strip_tags($new_instance['title']);
     541                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    546542
    547543                return $instance;
    548544        }
    … …  
    552548         */
    553549        public function form( $instance ) {
    554550                $instance = wp_parse_args( (array) $instance, array( 'title' => '' ) );
    555                 $title = strip_tags($instance['title']);
    556551?>
    557                 <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label>
    558                 <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr($title); ?>" /></p>
     552                <p><label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"><?php _e('Title:'); ?></label>
     553                <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" type="text" value="<?php echo esc_attr( $instance['title'] ); ?>" /></p>
    559554<?php
    560555        }
    561556}
    … …  
    606601         */
    607602        public function update( $new_instance, $old_instance ) {
    608603                $instance = $old_instance;
    609                 $instance['title'] = strip_tags($new_instance['title']);
     604                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    610605                if ( current_user_can('unfiltered_html') )
    611606                        $instance['text'] =  $new_instance['text'];
    612607                else
    613                         $instance['text'] = stripslashes( wp_filter_post_kses( addslashes($new_instance['text']) ) ); // wp_filter_post_kses() expects slashed
     608                        $instance['text'] = wp_kses_post( $new_instance['text'] );
    614609                $instance['filter'] = ! empty( $new_instance['filter'] );
    615610                return $instance;
    616611        }
    … …  
    620615         */
    621616        public function form( $instance ) {
    622617                $instance = wp_parse_args( (array) $instance, array( 'title' => '', 'text' => '' ) );
    623                 $title = strip_tags($instance['title']);
    624                 $text = esc_textarea($instance['text']);
    625 ?>
    626                 <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label>
    627                 <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr($title); ?>" /></p>
     618                $filter = isset( $instance['filter'] ) ? $instance['filter'] : 0;
     619                ?>
     620                <p><label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"><?php _e('Title:'); ?></label>
     621                <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" type="text" value="<?php echo esc_attr( $instance['title'] ); ?>" /></p>
    628622
    629                 <p><label for="<?php echo $this->get_field_id( 'text' ); ?>"><?php _e( 'Content:' ); ?></label>
    630                 <textarea class="widefat" rows="16" cols="20" id="<?php echo $this->get_field_id('text'); ?>" name="<?php echo $this->get_field_name('text'); ?>"><?php echo $text; ?></textarea></p>
     623                <p><label for="<?php echo esc_attr( $this->get_field_id( 'text' ) ); ?>"><?php _e( 'Content:' ); ?></label>
     624                <textarea class="widefat" rows="16" cols="20" id="<?php echo esc_attr( $this->get_field_id( 'text' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'text' ) ); ?>"><?php echo esc_textarea( $instance['text'] ); ?></textarea></p>
    631625
    632                 <p><input id="<?php echo $this->get_field_id('filter'); ?>" name="<?php echo $this->get_field_name('filter'); ?>" type="checkbox" <?php checked(isset($instance['filter']) ? $instance['filter'] : 0); ?> />&nbsp;<label for="<?php echo $this->get_field_id('filter'); ?>"><?php _e('Automatically add paragraphs'); ?></label></p>
     626                <p><input id="<?php echo esc_attr( $this->get_field_id( 'filter' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'filter' ) ); ?>" type="checkbox" <?php checked( $filter ); ?> />&nbsp;<label for="<?php echo esc_attr( $this->get_field_id( 'filter' ) ); ?>"><?php _e('Automatically add paragraphs'); ?></label></p>
    633627<?php
    634628        }
    635629}
    … …  
    738732         */
    739733        public function update( $new_instance, $old_instance ) {
    740734                $instance = $old_instance;
    741                 $instance['title'] = strip_tags($new_instance['title']);
     735                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    742736                $instance['count'] = !empty($new_instance['count']) ? 1 : 0;
    743737                $instance['hierarchical'] = !empty($new_instance['hierarchical']) ? 1 : 0;
    744738                $instance['dropdown'] = !empty($new_instance['dropdown']) ? 1 : 0;
    … …  
    752746        public function form( $instance ) {
    753747                //Defaults
    754748                $instance = wp_parse_args( (array) $instance, array( 'title' => '') );
    755                 $title = esc_attr( $instance['title'] );
    756749                $count = isset($instance['count']) ? (bool) $instance['count'] :false;
    757750                $hierarchical = isset( $instance['hierarchical'] ) ? (bool) $instance['hierarchical'] : false;
    758751                $dropdown = isset( $instance['dropdown'] ) ? (bool) $instance['dropdown'] : false;
    759752?>
    760                 <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e( 'Title:' ); ?></label>
    761                 <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo $title; ?>" /></p>
     753                <p><label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"><?php _e('Title:'); ?></label>
     754                <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" type="text" value="<?php echo esc_attr( $instance['title'] ); ?>" /></p>
    762755
    763                 <p><input type="checkbox" class="checkbox" id="<?php echo $this->get_field_id('dropdown'); ?>" name="<?php echo $this->get_field_name('dropdown'); ?>"<?php checked( $dropdown ); ?> />
    764                 <label for="<?php echo $this->get_field_id('dropdown'); ?>"><?php _e( 'Display as dropdown' ); ?></label><br />
     756                <p><input type="checkbox" class="checkbox" id="<?php echo esc_attr( $this->get_field_id( 'dropdown' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'dropdown' ) ); ?>"<?php checked( $dropdown ); ?> />
     757                <label for="<?php echo esc_attr( $this->get_field_id( 'dropdown' ) ); ?>"><?php _e('Display as dropdown'); ?></label><br />
    765758
    766                 <input type="checkbox" class="checkbox" id="<?php echo $this->get_field_id('count'); ?>" name="<?php echo $this->get_field_name('count'); ?>"<?php checked( $count ); ?> />
    767                 <label for="<?php echo $this->get_field_id('count'); ?>"><?php _e( 'Show post counts' ); ?></label><br />
     759                <input type="checkbox" class="checkbox" id="<?php echo esc_attr( $this->get_field_id( 'count' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'count' ) ); ?>"<?php checked( $count ); ?> />
     760                <label for="<?php echo esc_attr( $this->get_field_id( 'count' ) ); ?>"><?php _e('Show post counts'); ?></label><br />
    768761
    769                 <input type="checkbox" class="checkbox" id="<?php echo $this->get_field_id('hierarchical'); ?>" name="<?php echo $this->get_field_name('hierarchical'); ?>"<?php checked( $hierarchical ); ?> />
    770                 <label for="<?php echo $this->get_field_id('hierarchical'); ?>"><?php _e( 'Show hierarchy' ); ?></label></p>
     762                <input type="checkbox" class="checkbox" id="<?php echo esc_attr( $this->get_field_id( 'hierarchical' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'hierarchical' ) ); ?>"<?php checked( $hierarchical ); ?> />
     763                <label for="<?php echo esc_attr( $this->get_field_id( 'hierarchical' ) ); ?>"><?php _e('Show hierarchy'); ?></label></p>
    771764<?php
    772765        }
    773766
    … …  
    879872         */
    880873        public function update( $new_instance, $old_instance ) {
    881874                $instance = $old_instance;
    882                 $instance['title'] = strip_tags($new_instance['title']);
     875                $instance['title'] = santize_text_field( $new_instance['title'] );
    883876                $instance['number'] = (int) $new_instance['number'];
    884877                $instance['show_date'] = isset( $new_instance['show_date'] ) ? (bool) $new_instance['show_date'] : false;
    885878                $this->flush_widget_cache();
    … …  
    906899                $number    = isset( $instance['number'] ) ? absint( $instance['number'] ) : 5;
    907900                $show_date = isset( $instance['show_date'] ) ? (bool) $instance['show_date'] : false;
    908901?>
    909                 <p><label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e( 'Title:' ); ?></label>
    910                 <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo $title; ?>" /></p>
     902                <p><label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"><?php _e('Title:'); ?></label>
     903                <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>" /></p>
    911904
    912                 <p><label for="<?php echo $this->get_field_id( 'number' ); ?>"><?php _e( 'Number of posts to show:' ); ?></label>
    913                 <input id="<?php echo $this->get_field_id( 'number' ); ?>" name="<?php echo $this->get_field_name( 'number' ); ?>" type="text" value="<?php echo $number; ?>" size="3" /></p>
     905                <p><label for="<?php echo esc_attr( $this->get_field_id( 'number' ) ); ?>"><?php _e('Number of posts to show:'); ?></label>
     906                <input id="<?php echo esc_attr( $this->get_field_id( 'number' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'number' ) ); ?>" type="text" value="<?php echo esc_attr( $number ); ?>" size="3" /></p>
    914907
    915                 <p><input class="checkbox" type="checkbox" <?php checked( $show_date ); ?> id="<?php echo $this->get_field_id( 'show_date' ); ?>" name="<?php echo $this->get_field_name( 'show_date' ); ?>" />
    916                 <label for="<?php echo $this->get_field_id( 'show_date' ); ?>"><?php _e( 'Display post date?' ); ?></label></p>
     908                <p><input class="checkbox" type="checkbox" <?php checked( $show_date ); ?> id="<?php echo esc_attr( $this->get_field_id( 'show_date' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'show_date' ) ); ?>" />
     909                <label for="<?php echo esc_attr( $this->get_field_id( 'show_date' ) ); ?>"><?php _e('Display post date?'); ?></label></p>
    917910<?php
    918911        }
    919912}
    … …  
    10561049         */
    10571050        public function update( $new_instance, $old_instance ) {
    10581051                $instance = $old_instance;
    1059                 $instance['title'] = strip_tags($new_instance['title']);
     1052                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    10601053                $instance['number'] = absint( $new_instance['number'] );
    10611054                $this->flush_widget_cache();
    10621055
    … …  
    10711064         * @param array $instance
    10721065         */
    10731066        public function form( $instance ) {
    1074                 $title  = isset( $instance['title'] ) ? esc_attr( $instance['title'] ) : '';
    1075                 $number = isset( $instance['number'] ) ? absint( $instance['number'] ) : 5;
     1067                $title = isset( $instance['title'] ) ? $instance['title'] : '';
     1068                $number = isset( $instance['number'] ) ? $instance['number'] : 5;
    10761069?>
    1077                 <p><label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e( 'Title:' ); ?></label>
    1078                 <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo $title; ?>" /></p>
     1070                <p><label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"><?php _e('Title:'); ?></label>
     1071                <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>" /></p>
    10791072
    1080                 <p><label for="<?php echo $this->get_field_id( 'number' ); ?>"><?php _e( 'Number of comments to show:' ); ?></label>
    1081                 <input id="<?php echo $this->get_field_id( 'number' ); ?>" name="<?php echo $this->get_field_name( 'number' ); ?>" type="text" value="<?php echo $number; ?>" size="3" /></p>
     1073                <p><label for="<?php echo esc_attr( $this->get_field_id( 'number' ) ); ?>"><?php _e('Number of comments to show:'); ?></label>
     1074                <input id="<?php echo esc_attr( $this->get_field_id( 'number' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'number' ) ); ?>" type="text" value="<?php echo absint( $number ); ?>" size="3" /></p>
    10821075<?php
    10831076        }
    10841077}
    … …  
    11231116                if ( ! is_wp_error($rss) ) {
    11241117                        $desc = esc_attr(strip_tags(@html_entity_decode($rss->get_description(), ENT_QUOTES, get_option('blog_charset'))));
    11251118                        if ( empty($title) )
    1126                                 $title = esc_html(strip_tags($rss->get_title()));
    1127                         $link = esc_url(strip_tags($rss->get_permalink()));
     1119                                $title = strip_tags( $rss->get_title() );
     1120                        $link = strip_tags( $rss->get_permalink() );
    11281121                        while ( stristr($link, 'http') != $link )
    11291122                                $link = substr($link, 1);
    11301123                }
    … …  
    11351128                /** This filter is documented in wp-includes/default-widgets.php */
    11361129                $title = apply_filters( 'widget_title', $title, $instance, $this->id_base );
    11371130
    1138                 $url = esc_url(strip_tags($url));
    1139                 $icon = includes_url('images/rss.png');
     1131                $url = strip_tags( $url );
     1132                $icon = includes_url( 'images/rss.png' );
    11401133                if ( $title )
    1141                         $title = "<a class='rsswidget' href='$url'><img style='border:0' width='14' height='14' src='$icon' alt='RSS' /></a> <a class='rsswidget' href='$link'>$title</a>";
     1134                        $title = '<a class="rsswidget" href="' . esc_url( $url ) . '"><img style="border:0" width="14" height="14" src="' . esc_url( $icon ) . '" alt="RSS" /></a> <a class="rsswidget" href="' . esc_url( $link ) . '">"'. esc_html( $title ) .'"</a>';
    11421135
    11431136                echo $args['before_widget'];
    11441137                if ( $title ) {
    … …  
    12911284        $default_inputs = array( 'url' => true, 'title' => true, 'items' => true, 'show_summary' => true, 'show_author' => true, 'show_date' => true );
    12921285        $inputs = wp_parse_args( $inputs, $default_inputs );
    12931286
    1294         $args['number'] = esc_attr( $args['number'] );
    1295         $args['title'] = isset( $args['title'] ) ? esc_attr( $args['title'] ) : '';
    1296         $args['url'] = isset( $args['url'] ) ? esc_url( $args['url'] ) : '';
     1287        $args['title'] = isset( $args['title'] ) ? $args['title'] : '';
     1288        $args['url'] = isset( $args['url'] ) ? $args['url'] : '';
    12971289        $args['items'] = isset( $args['items'] ) ? (int) $args['items'] : 0;
    12981290
    12991291        if ( $args['items'] < 1 || 20 < $args['items'] ) {
    … …  
    13101302
    13111303        if ( $inputs['url'] ) :
    13121304?>
    1313         <p><label for="rss-url-<?php echo $args['number']; ?>"><?php _e( 'Enter the RSS feed URL here:' ); ?></label>
    1314         <input class="widefat" id="rss-url-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][url]" type="text" value="<?php echo $args['url']; ?>" /></p>
     1305        <p><label for="rss-url-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'Enter the RSS feed URL here:' ); ?></label>
     1306        <input class="widefat" id="rss-url-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][url]" type="text" value="<?php echo esc_url( $args['url'] ); ?>" /></p>
    13151307<?php endif; if ( $inputs['title'] ) : ?>
    1316         <p><label for="rss-title-<?php echo $args['number']; ?>"><?php _e( 'Give the feed a title (optional):' ); ?></label>
    1317         <input class="widefat" id="rss-title-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][title]" type="text" value="<?php echo $args['title']; ?>" /></p>
     1308        <p><label for="rss-title-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'Give the feed a title (optional):' ); ?></label>
     1309        <input class="widefat" id="rss-title-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][title]" type="text" value="<?php echo esc_attr( $args['title'] ); ?>" /></p>
    13181310<?php endif; if ( $inputs['items'] ) : ?>
    1319         <p><label for="rss-items-<?php echo $args['number']; ?>"><?php _e( 'How many items would you like to display?' ); ?></label>
    1320         <select id="rss-items-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][items]">
    1321 <?php
    1322                 for ( $i = 1; $i <= 20; ++$i ) {
    1323                         echo "<option value='$i' " . selected( $args['items'], $i, false ) . ">$i</option>";
    1324                 }
    1325 ?>
     1311        <p><label for="rss-items-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'How many items would you like to display?' ); ?></label>
     1312        <select id="rss-items-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][items]">
     1313        <?php
     1314        for ( $i = 1; $i <= 20; ++$i ) {
     1315                echo "<option value='$i' " . selected( $args['items'], $i, false ) . ">$i</option>";
     1316        }
     1317        ?>
    13261318        </select></p>
    13271319<?php endif; if ( $inputs['show_summary'] ) : ?>
    1328         <p><input id="rss-show-summary-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][show_summary]" type="checkbox" value="1" <?php checked( $args['show_summary'] ); ?> />
    1329         <label for="rss-show-summary-<?php echo $args['number']; ?>"><?php _e( 'Display item content?' ); ?></label></p>
     1320        <p><input id="rss-show-summary-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][show_summary]" type="checkbox" value="1" <?php checked( $args['show_summary'] ); ?> />
     1321        <label for="rss-show-summary-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'Display item content?' ); ?></label></p>
    13301322<?php endif; if ( $inputs['show_author'] ) : ?>
    1331         <p><input id="rss-show-author-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][show_author]" type="checkbox" value="1" <?php checked( $args['show_author'] ); ?> />
    1332         <label for="rss-show-author-<?php echo $args['number']; ?>"><?php _e( 'Display item author if available?' ); ?></label></p>
     1323        <p><input id="rss-show-author-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][show_author]" type="checkbox" value="1" <?php checked( $args['show_author'] ); ?> />
     1324        <label for="rss-show-author-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'Display item author if available?' ); ?></label></p>
    13331325<?php endif; if ( $inputs['show_date'] ) : ?>
    1334         <p><input id="rss-show-date-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][show_date]" type="checkbox" value="1" <?php checked( $args['show_date'] ); ?>/>
    1335         <label for="rss-show-date-<?php echo $args['number']; ?>"><?php _e( 'Display item date?' ); ?></label></p>
     1326        <p><input id="rss-show-date-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][show_date]" type="checkbox" value="1" <?php checked( $args['show_date'] ); ?>/>
     1327        <label for="rss-show-date-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'Display item date?' ); ?></label></p>
    13361328<?php
    13371329        endif;
    13381330        foreach ( array_keys($default_inputs) as $input ) :
    … …  
    13391331                if ( 'hidden' === $inputs[$input] ) :
    13401332                        $id = str_replace( '_', '-', $input );
    13411333?>
    1342         <input type="hidden" id="rss-<?php echo $id; ?>-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][<?php echo $input; ?>]" value="<?php echo $args[ $input ]; ?>" />
     1334        <input type="hidden" id="rss-<?php echo esc_attr( $id ); ?>-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][<?php echo esc_attr( $input ); ?>]" value="<?php echo esc_attr( $args[ $input ] ); ?>" />
    13431335<?php
    13441336                endif;
    13451337        endforeach;
    … …  
    14531445         */
    14541446        public function update( $new_instance, $old_instance ) {
    14551447                $instance = array();
    1456                 $instance['title'] = strip_tags(stripslashes($new_instance['title']));
     1448                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    14571449                $instance['taxonomy'] = stripslashes($new_instance['taxonomy']);
    14581450                return $instance;
    14591451        }
    … …  
    14631455         */
    14641456        public function form( $instance ) {
    14651457                $current_taxonomy = $this->_get_current_taxonomy($instance);
     1458                $title = isset( $instance['title'] ) ? $instance['title'] : '';
    14661459?>
    1467         <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:') ?></label>
    1468         <input type="text" class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" value="<?php if (isset ( $instance['title'])) {echo esc_attr( $instance['title'] );} ?>" /></p>
    1469         <p><label for="<?php echo $this->get_field_id('taxonomy'); ?>"><?php _e('Taxonomy:') ?></label>
    1470         <select class="widefat" id="<?php echo $this->get_field_id('taxonomy'); ?>" name="<?php echo $this->get_field_name('taxonomy'); ?>">
     1460        <p><label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"><?php _e( 'Title:' ) ?></label>
     1461        <input type="text" class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" value="<?php echo esc_attr( $title ); ?>" /></p>
     1462        <p><label for="<?php echo esc_attr( $this->get_field_id( 'taxonomy' ) ); ?>"><?php _e( 'Taxonomy:' ) ?></label>
     1463        <select class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'taxonomy' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'taxonomy' ) ); ?>">
    14711464        <?php foreach ( get_taxonomies() as $taxonomy ) :
    1472                                 $tax = get_taxonomy($taxonomy);
    1473                                 if ( !$tax->show_tagcloud || empty($tax->labels->name) )
    1474                                         continue;
     1465                $tax = get_taxonomy($taxonomy);
     1466                if ( !$tax->show_tagcloud || empty($tax->labels->name) )
     1467                        continue;
    14751468        ?>
    1476                 <option value="<?php echo esc_attr($taxonomy) ?>" <?php selected($taxonomy, $current_taxonomy) ?>><?php echo $tax->labels->name; ?></option>
     1469                <option value="<?php echo esc_attr($taxonomy) ?>" <?php selected($taxonomy, $current_taxonomy) ?>><?php echo esc_attr( $tax->labels->name ); ?></option>
    14771470        <?php endforeach; ?>
    14781471        </select></p><?php
    14791472        }
    … …  
    15531546        public function update( $new_instance, $old_instance ) {
    15541547                $instance = array();
    15551548                if ( ! empty( $new_instance['title'] ) ) {
    1556                         $instance['title'] = strip_tags( stripslashes($new_instance['title']) );
     1549                        $instance['title'] = sanitize_text_field( $new_instance['title'] );
    15571550                }
    15581551                if ( ! empty( $new_instance['nav_menu'] ) ) {
    15591552                        $instance['nav_menu'] = (int) $new_instance['nav_menu'];
    … …  
    15861579                </p>
    15871580                <div class="nav-menu-widget-form-controls" <?php if ( empty( $menus ) ) { echo ' style="display:none" '; } ?>>
    15881581                        <p>
    1589                                 <label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e( 'Title:' ) ?></label>
    1590                                 <input type="text" class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" value="<?php echo esc_attr( $title ); ?>"/>
     1582                                <label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"><?php _e( 'Title:' ) ?></label>
     1583                                <input type="text" class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" value="<?php echo esc_attr( $title ); ?>"/>
    15911584                        </p>
    15921585                        <p>
    1593                                 <label for="<?php echo $this->get_field_id( 'nav_menu' ); ?>"><?php _e( 'Select Menu:' ); ?></label>
    1594                                 <select id="<?php echo $this->get_field_id( 'nav_menu' ); ?>" name="<?php echo $this->get_field_name( 'nav_menu' ); ?>">
     1586                                <label for="<?php echo esc_attr( $this->get_field_id( 'nav_menu' ) ); ?>"><?php _e( 'Select Menu:' ); ?></label>
     1587                                <select id="<?php echo esc_attr( $this->get_field_id( 'nav_menu' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'nav_menu' ) ); ?>">
    15951588                                        <option value="0"><?php _e( '&mdash; Select &mdash;' ); ?></option>
    15961589                                        <?php foreach ( $menus as $menu ) : ?>
    15971590                                                <option value="<?php echo esc_attr( $menu->term_id ); ?>" <?php selected( $nav_menu, $menu->term_id ); ?>>