WordPress.org
Get WordPress

Make WordPress Core

Ticket #23012: 23012.7.diff

File 23012.7.diff, 31.9 KB (added by wonderboymusic, 11 years ago)

  • src/wp-includes/default-widgets.php

     
    9898                $instance = wp_parse_args( (array) $instance, array( 'sortby' => 'post_title', 'title' => '', 'exclude' => '') );
    9999        ?>
    100100                <p>
    101                         <label for="<?php echo esc_attr( $this->get_field_id( 'title' ) ); ?>"><?php _e( 'Title:' ); ?></label>
    102                         <input class="widefat" id="<?php echo esc_attr( $this->get_field_id('title') ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'title' ) ); ?>" type="text" value="<?php echo esc_attr( $instance['title'] ); ?>" />
     101                        <label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e( 'Title:' ); ?></label>
     102                        <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $instance['title'] ); ?>" />
    103103                </p>
    104104                <p>
    105                         <label for="<?php echo esc_attr( $this->get_field_id( 'sortby' ) ); ?>"><?php _e( 'Sort by:' ); ?></label>
    106                         <select name="<?php echo esc_attr( $this->get_field_name( 'sortby' ) ); ?>" id="<?php echo esc_attr( $this->get_field_id( 'sortby' ) ); ?>" class="widefat">
     105                        <label for="<?php echo $this->get_field_id( 'sortby' ); ?>"><?php _e( 'Sort by:' ); ?></label>
     106                        <select name="<?php echo $this->get_field_name( 'sortby' ); ?>" id="<?php echo $this->get_field_id( 'sortby' ); ?>" class="widefat">
    107107                                <option value="post_title"<?php selected( $instance['sortby'], 'post_title' ); ?>><?php _e('Page title'); ?></option>
    108108                                <option value="menu_order"<?php selected( $instance['sortby'], 'menu_order' ); ?>><?php _e('Page order'); ?></option>
    109109                                <option value="ID"<?php selected( $instance['sortby'], 'ID' ); ?>><?php _e( 'Page ID' ); ?></option>
    … …  
    110110                        </select>
    111111                </p>
    112112                <p>
    113                         <label for="<?php echo esc_attr( $this->get_field_id( 'exclude' ) ); ?>"><?php _e( 'Exclude:' ); ?></label>
    114                         <input type="text" value="<?php echo esc_attr( $instance['exclude'] ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'exclude' ) ); ?>" id="<?php echo esc_attr( $this->get_field_id( 'exclude' ) ); ?>" class="widefat" />
     113                        <label for="<?php echo $this->get_field_id( 'exclude' ); ?>"><?php _e( 'Exclude:' ); ?></label>
     114                        <input type="text" value="<?php echo esc_attr( $instance['exclude'] ); ?>" name="<?php echo $this->get_field_name( 'exclude' ); ?>" id="<?php echo $this->get_field_id( 'exclude' ); ?>" class="widefat" />
    115115                        <br />
    116116                        <small><?php _e( 'Page IDs, separated by commas.' ); ?></small>
    117117                </p>
    … …  
    203203                        $limit = -1;
    204204?>
    205205                <p>
    206                 <label for="<?php echo $this->get_field_id('category'); ?>"><?php _e( 'Select Link Category:' ); ?></label>
    207                 <select class="widefat" id="<?php echo $this->get_field_id('category'); ?>" name="<?php echo $this->get_field_name('category'); ?>">
     206                <label for="<?php echo $this->get_field_id( 'category' ); ?>"><?php _e( 'Select Link Category:' ); ?></label>
     207                <select class="widefat" id="<?php echo $this->get_field_id( 'category' ); ?>" name="<?php echo $this->get_field_name( 'category' ); ?>">
    208208                <option value=""><?php _ex('All Links', 'links widget'); ?></option>
    209209                <?php
    210210                foreach ( $link_cats as $link_cat ) {
    … …  
    214214                }
    215215                ?>
    216216                </select>
    217                 <label for="<?php echo $this->get_field_id('orderby'); ?>"><?php _e( 'Sort by:' ); ?></label>
    218                 <select name="<?php echo $this->get_field_name('orderby'); ?>" id="<?php echo $this->get_field_id('orderby'); ?>" class="widefat">
     217                <label for="<?php echo $this->get_field_id( 'orderby' ); ?>"><?php _e( 'Sort by:' ); ?></label>
     218                <select name="<?php echo $this->get_field_name( 'orderby' ); ?>" id="<?php echo $this->get_field_id( 'orderby' ); ?>" class="widefat">
    219219                        <option value="name"<?php selected( $instance['orderby'], 'name' ); ?>><?php _e( 'Link title' ); ?></option>
    220220                        <option value="rating"<?php selected( $instance['orderby'], 'rating' ); ?>><?php _e( 'Link rating' ); ?></option>
    221221                        <option value="id"<?php selected( $instance['orderby'], 'id' ); ?>><?php _e( 'Link ID' ); ?></option>
    … …  
    223223                </select>
    224224                </p>
    225225                <p>
    226                 <input class="checkbox" type="checkbox" <?php checked($instance['images'], true) ?> id="<?php echo $this->get_field_id('images'); ?>" name="<?php echo $this->get_field_name('images'); ?>" />
    227                 <label for="<?php echo $this->get_field_id('images'); ?>"><?php _e('Show Link Image'); ?></label><br />
    228                 <input class="checkbox" type="checkbox" <?php checked($instance['name'], true) ?> id="<?php echo $this->get_field_id('name'); ?>" name="<?php echo $this->get_field_name('name'); ?>" />
    229                 <label for="<?php echo $this->get_field_id('name'); ?>"><?php _e('Show Link Name'); ?></label><br />
    230                 <input class="checkbox" type="checkbox" <?php checked($instance['description'], true) ?> id="<?php echo $this->get_field_id('description'); ?>" name="<?php echo $this->get_field_name('description'); ?>" />
    231                 <label for="<?php echo $this->get_field_id('description'); ?>"><?php _e('Show Link Description'); ?></label><br />
    232                 <input class="checkbox" type="checkbox" <?php checked($instance['rating'], true) ?> id="<?php echo $this->get_field_id('rating'); ?>" name="<?php echo $this->get_field_name('rating'); ?>" />
    233                 <label for="<?php echo $this->get_field_id('rating'); ?>"><?php _e('Show Link Rating'); ?></label>
     226                <input class="checkbox" type="checkbox" <?php checked( $instance['images'], true ) ?> id="<?php echo $this->get_field_id( 'images' ); ?>" name="<?php echo $this->get_field_name( 'images' ); ?>" />
     227                <label for="<?php echo $this->get_field_id( 'images' ); ?>"><?php _e('Show Link Image'); ?></label><br />
     228                <input class="checkbox" type="checkbox" <?php checked( $instance['name'], true ) ?> id="<?php echo $this->get_field_id( 'name' ); ?>" name="<?php echo $this->get_field_name( 'name' ); ?>" />
     229                <label for="<?php echo $this->get_field_id( 'name' ); ?>"><?php _e('Show Link Name'); ?></label><br />
     230                <input class="checkbox" type="checkbox" <?php checked( $instance['description'], true ) ?> id="<?php echo $this->get_field_id( 'description' ); ?>" name="<?php echo $this->get_field_name( 'description' ); ?>" />
     231                <label for="<?php echo $this->get_field_id( 'description' ); ?>"><?php _e('Show Link Description'); ?></label><br />
     232                <input class="checkbox" type="checkbox" <?php checked( $instance['rating'], true ) ?> id="<?php echo $this->get_field_id( 'rating' ); ?>" name="<?php echo $this->get_field_name( 'rating' ); ?>" />
     233                <label for="<?php echo $this->get_field_id( 'rating' ); ?>"><?php _e('Show Link Rating'); ?></label>
    234234                </p>
    235235                <p>
    236                 <label for="<?php echo $this->get_field_id('limit'); ?>"><?php _e( 'Number of links to show:' ); ?></label>
    237                 <input id="<?php echo $this->get_field_id('limit'); ?>" name="<?php echo $this->get_field_name('limit'); ?>" type="text" value="<?php echo $limit == -1 ? '' : intval( $limit ); ?>" size="3" />
     236                <label for="<?php echo $this->get_field_id( 'limit' ); ?>"><?php _e( 'Number of links to show:' ); ?></label>
     237                <input id="<?php echo $this->get_field_id( 'limit' ); ?>" name="<?php echo $this->get_field_name( 'limit' ); ?>" type="text" value="<?php echo $limit == -1 ? '' : intval( $limit ); ?>" size="3" />
    238238                </p>
    239239<?php
    240240        }
    … …  
    290290        public function update( $new_instance, $old_instance ) {
    291291                $instance = $old_instance;
    292292                $new_instance = wp_parse_args((array) $new_instance, array( 'title' => ''));
    293                 $instance['title'] = strip_tags($new_instance['title']);
     293                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    294294                return $instance;
    295295        }
    296296
    … …  
    402402        public function update( $new_instance, $old_instance ) {
    403403                $instance = $old_instance;
    404404                $new_instance = wp_parse_args( (array) $new_instance, array( 'title' => '', 'count' => 0, 'dropdown' => '') );
    405                 $instance['title'] = strip_tags($new_instance['title']);
     405                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    406406                $instance['count'] = $new_instance['count'] ? 1 : 0;
    407407                $instance['dropdown'] = $new_instance['dropdown'] ? 1 : 0;
    408408
    … …  
    414414         */
    415415        public function form( $instance ) {
    416416                $instance = wp_parse_args( (array) $instance, array( 'title' => '', 'count' => 0, 'dropdown' => '') );
    417                 $title = strip_tags($instance['title']);
    418                 $count = $instance['count'] ? 'checked="checked"' : '';
    419                 $dropdown = $instance['dropdown'] ? 'checked="checked"' : '';
     417                $title = sanitize_text_field( $instance['title'] );
    420418?>
    421                 <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr($title); ?>" /></p>
     419                <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr( $title ); ?>" /></p>
    422420                <p>
    423                         <input class="checkbox" type="checkbox" <?php echo $dropdown; ?> id="<?php echo $this->get_field_id('dropdown'); ?>" name="<?php echo $this->get_field_name('dropdown'); ?>" /> <label for="<?php echo $this->get_field_id('dropdown'); ?>"><?php _e('Display as dropdown'); ?></label>
     421                        <input class="checkbox" type="checkbox" <?php checked( $instance['dropdown'] ); ?> id="<?php echo $this->get_field_id( 'dropdown' ); ?>" name="<?php echo $this->get_field_name( 'dropdown' ); ?>" /> <label for="<?php echo $this->get_field_id( 'dropdown' ); ?>"><?php _e( 'Display as dropdown' ); ?></label>
    424422                        <br/>
    425                         <input class="checkbox" type="checkbox" <?php echo $count; ?> id="<?php echo $this->get_field_id('count'); ?>" name="<?php echo $this->get_field_name('count'); ?>" /> <label for="<?php echo $this->get_field_id('count'); ?>"><?php _e('Show post counts'); ?></label>
     423                        <input class="checkbox" type="checkbox" <?php checked( $instance['count'] ); ?> id="<?php echo $this->get_field_id( 'count' ); ?>" name="<?php echo $this->get_field_name( 'count' ); ?>" /> <label for="<?php echo $this->get_field_id( 'count' ); ?>"><?php _e( 'Show post counts' ); ?></label>
    426424                </p>
    427425<?php
    428426        }
    … …  
    458456                        <ul>
    459457                        <?php wp_register(); ?>
    460458                        <li><?php wp_loginout(); ?></li>
    461                         <li><a href="<?php bloginfo('rss2_url'); ?>"><?php _e('Entries <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
    462                         <li><a href="<?php bloginfo('comments_rss2_url'); ?>"><?php _e('Comments <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
     459                        <li><a href="<?php echo esc_url( get_bloginfo( 'rss2_url' ) ); ?>"><?php _e('Entries <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
     460                        <li><a href="<?php echo esc_url( get_bloginfo( 'comments_rss2_url' ) ); ?>"><?php _e('Comments <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
    463461<?php
    464462                        /**
    465463                         * Filter the "Powered by WordPress" text in the Meta widget.
    … …  
    488486         */
    489487        public function update( $new_instance, $old_instance ) {
    490488                $instance = $old_instance;
    491                 $instance['title'] = strip_tags($new_instance['title']);
     489                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    492490
    493491                return $instance;
    494492        }
    … …  
    498496         */
    499497        public function form( $instance ) {
    500498                $instance = wp_parse_args( (array) $instance, array( 'title' => '' ) );
    501                 $title = strip_tags($instance['title']);
    502499?>
    503                         <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr($title); ?>" /></p>
     500                <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label> <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $instance['title'] ); ?>" /></p>
    504501<?php
    505502        }
    506503}
    … …  
    542539         */
    543540        public function update( $new_instance, $old_instance ) {
    544541                $instance = $old_instance;
    545                 $instance['title'] = strip_tags($new_instance['title']);
     542                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    546543
    547544                return $instance;
    548545        }
    … …  
    552549         */
    553550        public function form( $instance ) {
    554551                $instance = wp_parse_args( (array) $instance, array( 'title' => '' ) );
    555                 $title = strip_tags($instance['title']);
    556552?>
    557                 <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label>
    558                 <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr($title); ?>" /></p>
     553                <p><label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e('Title:'); ?></label>
     554                <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $instance['title'] ); ?>" /></p>
    559555<?php
    560556        }
    561557}
    … …  
    606602         */
    607603        public function update( $new_instance, $old_instance ) {
    608604                $instance = $old_instance;
    609                 $instance['title'] = strip_tags($new_instance['title']);
     605                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    610606                if ( current_user_can('unfiltered_html') )
    611607                        $instance['text'] =  $new_instance['text'];
    612608                else
    613                         $instance['text'] = stripslashes( wp_filter_post_kses( addslashes($new_instance['text']) ) ); // wp_filter_post_kses() expects slashed
     609                        $instance['text'] = wp_kses_post( $new_instance['text'] );
    614610                $instance['filter'] = ! empty( $new_instance['filter'] );
    615611                return $instance;
    616612        }
    … …  
    620616         */
    621617        public function form( $instance ) {
    622618                $instance = wp_parse_args( (array) $instance, array( 'title' => '', 'text' => '' ) );
    623                 $title = strip_tags($instance['title']);
    624                 $text = esc_textarea($instance['text']);
    625 ?>
    626                 <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?></label>
    627                 <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo esc_attr($title); ?>" /></p>
     619                $filter = isset( $instance['filter'] ) ? $instance['filter'] : 0;
     620                ?>
     621                <p><label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e('Title:'); ?></label>
     622                <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $instance['title'] ); ?>" /></p>
    628623
    629624                <p><label for="<?php echo $this->get_field_id( 'text' ); ?>"><?php _e( 'Content:' ); ?></label>
    630                 <textarea class="widefat" rows="16" cols="20" id="<?php echo $this->get_field_id('text'); ?>" name="<?php echo $this->get_field_name('text'); ?>"><?php echo $text; ?></textarea></p>
     625                <textarea class="widefat" rows="16" cols="20" id="<?php echo $this->get_field_id( 'text' ); ?>" name="<?php echo $this->get_field_name( 'text' ); ?>"><?php echo esc_textarea( $instance['text'] ); ?></textarea></p>
    631626
    632                 <p><input id="<?php echo $this->get_field_id('filter'); ?>" name="<?php echo $this->get_field_name('filter'); ?>" type="checkbox" <?php checked(isset($instance['filter']) ? $instance['filter'] : 0); ?> />&nbsp;<label for="<?php echo $this->get_field_id('filter'); ?>"><?php _e('Automatically add paragraphs'); ?></label></p>
     627                <p><input id="<?php echo $this->get_field_id( 'filter' ); ?>" name="<?php echo $this->get_field_name( 'filter' ); ?>" type="checkbox" <?php checked( $filter ); ?> />&nbsp;<label for="<?php echo $this->get_field_id( 'filter' ); ?>"><?php _e('Automatically add paragraphs'); ?></label></p>
    633628<?php
    634629        }
    635630}
    … …  
    738733         */
    739734        public function update( $new_instance, $old_instance ) {
    740735                $instance = $old_instance;
    741                 $instance['title'] = strip_tags($new_instance['title']);
     736                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    742737                $instance['count'] = !empty($new_instance['count']) ? 1 : 0;
    743738                $instance['hierarchical'] = !empty($new_instance['hierarchical']) ? 1 : 0;
    744739                $instance['dropdown'] = !empty($new_instance['dropdown']) ? 1 : 0;
    … …  
    752747        public function form( $instance ) {
    753748                //Defaults
    754749                $instance = wp_parse_args( (array) $instance, array( 'title' => '') );
    755                 $title = esc_attr( $instance['title'] );
    756750                $count = isset($instance['count']) ? (bool) $instance['count'] :false;
    757751                $hierarchical = isset( $instance['hierarchical'] ) ? (bool) $instance['hierarchical'] : false;
    758752                $dropdown = isset( $instance['dropdown'] ) ? (bool) $instance['dropdown'] : false;
    759753?>
    760                 <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e( 'Title:' ); ?></label>
    761                 <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo $title; ?>" /></p>
     754                <p><label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e('Title:'); ?></label>
     755                <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $instance['title'] ); ?>" /></p>
    762756
    763                 <p><input type="checkbox" class="checkbox" id="<?php echo $this->get_field_id('dropdown'); ?>" name="<?php echo $this->get_field_name('dropdown'); ?>"<?php checked( $dropdown ); ?> />
    764                 <label for="<?php echo $this->get_field_id('dropdown'); ?>"><?php _e( 'Display as dropdown' ); ?></label><br />
     757                <p><input type="checkbox" class="checkbox" id="<?php echo $this->get_field_id( 'dropdown' ); ?>" name="<?php echo $this->get_field_name( 'dropdown' ); ?>"<?php checked( $dropdown ); ?> />
     758                <label for="<?php echo $this->get_field_id( 'dropdown' ); ?>"><?php _e('Display as dropdown'); ?></label><br />
    765759
    766                 <input type="checkbox" class="checkbox" id="<?php echo $this->get_field_id('count'); ?>" name="<?php echo $this->get_field_name('count'); ?>"<?php checked( $count ); ?> />
    767                 <label for="<?php echo $this->get_field_id('count'); ?>"><?php _e( 'Show post counts' ); ?></label><br />
     760                <input type="checkbox" class="checkbox" id="<?php echo $this->get_field_id( 'count' ); ?>" name="<?php echo $this->get_field_name( 'count' ); ?>"<?php checked( $count ); ?> />
     761                <label for="<?php echo $this->get_field_id( 'count' ); ?>"><?php _e('Show post counts'); ?></label><br />
    768762
    769                 <input type="checkbox" class="checkbox" id="<?php echo $this->get_field_id('hierarchical'); ?>" name="<?php echo $this->get_field_name('hierarchical'); ?>"<?php checked( $hierarchical ); ?> />
    770                 <label for="<?php echo $this->get_field_id('hierarchical'); ?>"><?php _e( 'Show hierarchy' ); ?></label></p>
     763                <input type="checkbox" class="checkbox" id="<?php echo $this->get_field_id( 'hierarchical' ); ?>" name="<?php echo $this->get_field_name( 'hierarchical' ); ?>"<?php checked( $hierarchical ); ?> />
     764                <label for="<?php echo $this->get_field_id( 'hierarchical' ); ?>"><?php _e('Show hierarchy'); ?></label></p>
    771765<?php
    772766        }
    773767
    … …  
    879873         */
    880874        public function update( $new_instance, $old_instance ) {
    881875                $instance = $old_instance;
    882                 $instance['title'] = strip_tags($new_instance['title']);
     876                $instance['title'] = santize_text_field( $new_instance['title'] );
    883877                $instance['number'] = (int) $new_instance['number'];
    884878                $instance['show_date'] = isset( $new_instance['show_date'] ) ? (bool) $new_instance['show_date'] : false;
    885879                $this->flush_widget_cache();
    … …  
    907901                $show_date = isset( $instance['show_date'] ) ? (bool) $instance['show_date'] : false;
    908902?>
    909903                <p><label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e( 'Title:' ); ?></label>
    910                 <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo $title; ?>" /></p>
     904                <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>" /></p>
    911905
    912                 <p><label for="<?php echo $this->get_field_id( 'number' ); ?>"><?php _e( 'Number of posts to show:' ); ?></label>
    913                 <input id="<?php echo $this->get_field_id( 'number' ); ?>" name="<?php echo $this->get_field_name( 'number' ); ?>" type="text" value="<?php echo $number; ?>" size="3" /></p>
     906                <p><label for="<?php echo $this->get_field_id( 'number' ); ?>"><?php _e('Number of posts to show:'); ?></label>
     907                <input id="<?php echo $this->get_field_id( 'number' ); ?>" name="<?php echo $this->get_field_name( 'number' ); ?>" type="text" value="<?php echo esc_attr( $number ); ?>" size="3" /></p>
    914908
    915909                <p><input class="checkbox" type="checkbox" <?php checked( $show_date ); ?> id="<?php echo $this->get_field_id( 'show_date' ); ?>" name="<?php echo $this->get_field_name( 'show_date' ); ?>" />
    916910                <label for="<?php echo $this->get_field_id( 'show_date' ); ?>"><?php _e( 'Display post date?' ); ?></label></p>
    … …  
    10561050         */
    10571051        public function update( $new_instance, $old_instance ) {
    10581052                $instance = $old_instance;
    1059                 $instance['title'] = strip_tags($new_instance['title']);
     1053                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    10601054                $instance['number'] = absint( $new_instance['number'] );
    10611055                $this->flush_widget_cache();
    10621056
    … …  
    10711065         * @param array $instance
    10721066         */
    10731067        public function form( $instance ) {
    1074                 $title  = isset( $instance['title'] ) ? esc_attr( $instance['title'] ) : '';
    1075                 $number = isset( $instance['number'] ) ? absint( $instance['number'] ) : 5;
     1068                $title = isset( $instance['title'] ) ? $instance['title'] : '';
     1069                $number = isset( $instance['number'] ) ? $instance['number'] : 5;
    10761070?>
    10771071                <p><label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e( 'Title:' ); ?></label>
    1078                 <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo $title; ?>" /></p>
     1072                <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>" /></p>
    10791073
    1080                 <p><label for="<?php echo $this->get_field_id( 'number' ); ?>"><?php _e( 'Number of comments to show:' ); ?></label>
    1081                 <input id="<?php echo $this->get_field_id( 'number' ); ?>" name="<?php echo $this->get_field_name( 'number' ); ?>" type="text" value="<?php echo $number; ?>" size="3" /></p>
     1074                <p><label for="<?php echo $this->get_field_id( 'number' ); ?>"><?php _e('Number of comments to show:'); ?></label>
     1075                <input id="<?php echo $this->get_field_id( 'number' ); ?>" name="<?php echo $this->get_field_name( 'number' ); ?>" type="text" value="<?php echo absint( $number ); ?>" size="3" /></p>
    10821076<?php
    10831077        }
    10841078}
    … …  
    11231117                if ( ! is_wp_error($rss) ) {
    11241118                        $desc = esc_attr(strip_tags(@html_entity_decode($rss->get_description(), ENT_QUOTES, get_option('blog_charset'))));
    11251119                        if ( empty($title) )
    1126                                 $title = esc_html(strip_tags($rss->get_title()));
    1127                         $link = esc_url(strip_tags($rss->get_permalink()));
     1120                                $title = strip_tags( $rss->get_title() );
     1121                        $link = strip_tags( $rss->get_permalink() );
    11281122                        while ( stristr($link, 'http') != $link )
    11291123                                $link = substr($link, 1);
    11301124                }
    … …  
    11351129                /** This filter is documented in wp-includes/default-widgets.php */
    11361130                $title = apply_filters( 'widget_title', $title, $instance, $this->id_base );
    11371131
    1138                 $url = esc_url(strip_tags($url));
    1139                 $icon = includes_url('images/rss.png');
     1132                $url = strip_tags( $url );
     1133                $icon = includes_url( 'images/rss.png' );
    11401134                if ( $title )
    1141                         $title = "<a class='rsswidget' href='$url'><img style='border:0' width='14' height='14' src='$icon' alt='RSS' /></a> <a class='rsswidget' href='$link'>$title</a>";
     1135                        $title = '<a class="rsswidget" href="' . esc_url( $url ) . '"><img style="border:0" width="14" height="14" src="' . esc_url( $icon ) . '" alt="RSS" /></a> <a class="rsswidget" href="' . esc_url( $link ) . '">"'. esc_html( $title ) .'"</a>';
    11421136
    11431137                echo $args['before_widget'];
    11441138                if ( $title ) {
    … …  
    12911285        $default_inputs = array( 'url' => true, 'title' => true, 'items' => true, 'show_summary' => true, 'show_author' => true, 'show_date' => true );
    12921286        $inputs = wp_parse_args( $inputs, $default_inputs );
    12931287
    1294         $args['number'] = esc_attr( $args['number'] );
    1295         $args['title'] = isset( $args['title'] ) ? esc_attr( $args['title'] ) : '';
    1296         $args['url'] = isset( $args['url'] ) ? esc_url( $args['url'] ) : '';
     1288        $args['title'] = isset( $args['title'] ) ? $args['title'] : '';
     1289        $args['url'] = isset( $args['url'] ) ? $args['url'] : '';
    12971290        $args['items'] = isset( $args['items'] ) ? (int) $args['items'] : 0;
    12981291
    12991292        if ( $args['items'] < 1 || 20 < $args['items'] ) {
    … …  
    13101303
    13111304        if ( $inputs['url'] ) :
    13121305?>
    1313         <p><label for="rss-url-<?php echo $args['number']; ?>"><?php _e( 'Enter the RSS feed URL here:' ); ?></label>
    1314         <input class="widefat" id="rss-url-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][url]" type="text" value="<?php echo $args['url']; ?>" /></p>
     1306        <p><label for="rss-url-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'Enter the RSS feed URL here:' ); ?></label>
     1307        <input class="widefat" id="rss-url-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][url]" type="text" value="<?php echo esc_url( $args['url'] ); ?>" /></p>
    13151308<?php endif; if ( $inputs['title'] ) : ?>
    1316         <p><label for="rss-title-<?php echo $args['number']; ?>"><?php _e( 'Give the feed a title (optional):' ); ?></label>
    1317         <input class="widefat" id="rss-title-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][title]" type="text" value="<?php echo $args['title']; ?>" /></p>
     1309        <p><label for="rss-title-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'Give the feed a title (optional):' ); ?></label>
     1310        <input class="widefat" id="rss-title-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][title]" type="text" value="<?php echo esc_attr( $args['title'] ); ?>" /></p>
    13181311<?php endif; if ( $inputs['items'] ) : ?>
    1319         <p><label for="rss-items-<?php echo $args['number']; ?>"><?php _e( 'How many items would you like to display?' ); ?></label>
    1320         <select id="rss-items-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][items]">
    1321 <?php
    1322                 for ( $i = 1; $i <= 20; ++$i ) {
    1323                         echo "<option value='$i' " . selected( $args['items'], $i, false ) . ">$i</option>";
    1324                 }
    1325 ?>
     1312        <p><label for="rss-items-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'How many items would you like to display?' ); ?></label>
     1313        <select id="rss-items-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][items]">
     1314        <?php
     1315        for ( $i = 1; $i <= 20; ++$i ) {
     1316                echo "<option value='$i' " . selected( $args['items'], $i, false ) . ">$i</option>";
     1317        }
     1318        ?>
    13261319        </select></p>
    13271320<?php endif; if ( $inputs['show_summary'] ) : ?>
    1328         <p><input id="rss-show-summary-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][show_summary]" type="checkbox" value="1" <?php checked( $args['show_summary'] ); ?> />
    1329         <label for="rss-show-summary-<?php echo $args['number']; ?>"><?php _e( 'Display item content?' ); ?></label></p>
     1321        <p><input id="rss-show-summary-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][show_summary]" type="checkbox" value="1" <?php checked( $args['show_summary'] ); ?> />
     1322        <label for="rss-show-summary-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'Display item content?' ); ?></label></p>
    13301323<?php endif; if ( $inputs['show_author'] ) : ?>
    1331         <p><input id="rss-show-author-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][show_author]" type="checkbox" value="1" <?php checked( $args['show_author'] ); ?> />
    1332         <label for="rss-show-author-<?php echo $args['number']; ?>"><?php _e( 'Display item author if available?' ); ?></label></p>
     1324        <p><input id="rss-show-author-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][show_author]" type="checkbox" value="1" <?php checked( $args['show_author'] ); ?> />
     1325        <label for="rss-show-author-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'Display item author if available?' ); ?></label></p>
    13331326<?php endif; if ( $inputs['show_date'] ) : ?>
    1334         <p><input id="rss-show-date-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][show_date]" type="checkbox" value="1" <?php checked( $args['show_date'] ); ?>/>
    1335         <label for="rss-show-date-<?php echo $args['number']; ?>"><?php _e( 'Display item date?' ); ?></label></p>
     1327        <p><input id="rss-show-date-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][show_date]" type="checkbox" value="1" <?php checked( $args['show_date'] ); ?>/>
     1328        <label for="rss-show-date-<?php echo esc_attr( $args['number'] ); ?>"><?php _e( 'Display item date?' ); ?></label></p>
    13361329<?php
    13371330        endif;
    13381331        foreach ( array_keys($default_inputs) as $input ) :
    … …  
    13391332                if ( 'hidden' === $inputs[$input] ) :
    13401333                        $id = str_replace( '_', '-', $input );
    13411334?>
    1342         <input type="hidden" id="rss-<?php echo $id; ?>-<?php echo $args['number']; ?>" name="widget-rss[<?php echo $args['number']; ?>][<?php echo $input; ?>]" value="<?php echo $args[ $input ]; ?>" />
     1335        <input type="hidden" id="rss-<?php echo esc_attr( $id ); ?>-<?php echo esc_attr( $args['number'] ); ?>" name="widget-rss[<?php echo esc_attr( $args['number'] ); ?>][<?php echo esc_attr( $input ); ?>]" value="<?php echo esc_attr( $args[ $input ] ); ?>" />
    13431336<?php
    13441337                endif;
    13451338        endforeach;
    … …  
    14531446         */
    14541447        public function update( $new_instance, $old_instance ) {
    14551448                $instance = array();
    1456                 $instance['title'] = strip_tags(stripslashes($new_instance['title']));
     1449                $instance['title'] = sanitize_text_field( $new_instance['title'] );
    14571450                $instance['taxonomy'] = stripslashes($new_instance['taxonomy']);
    14581451                return $instance;
    14591452        }
    … …  
    14631456         */
    14641457        public function form( $instance ) {
    14651458                $current_taxonomy = $this->_get_current_taxonomy($instance);
     1459                $title = isset( $instance['title'] ) ? $instance['title'] : '';
    14661460?>
    1467         <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:') ?></label>
    1468         <input type="text" class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" value="<?php if (isset ( $instance['title'])) {echo esc_attr( $instance['title'] );} ?>" /></p>
    1469         <p><label for="<?php echo $this->get_field_id('taxonomy'); ?>"><?php _e('Taxonomy:') ?></label>
    1470         <select class="widefat" id="<?php echo $this->get_field_id('taxonomy'); ?>" name="<?php echo $this->get_field_name('taxonomy'); ?>">
     1461        <p><label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _e( 'Title:' ) ?></label>
     1462        <input type="text" class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" value="<?php echo esc_attr( $title ); ?>" /></p>
     1463        <p><label for="<?php echo $this->get_field_id( 'taxonomy' ); ?>"><?php _e( 'Taxonomy:' ) ?></label>
     1464        <select class="widefat" id="<?php echo $this->get_field_id( 'taxonomy' ); ?>" name="<?php echo $this->get_field_name( 'taxonomy' ); ?>">
    14711465        <?php foreach ( get_taxonomies() as $taxonomy ) :
    1472                                 $tax = get_taxonomy($taxonomy);
    1473                                 if ( !$tax->show_tagcloud || empty($tax->labels->name) )
    1474                                         continue;
     1466                $tax = get_taxonomy($taxonomy);
     1467                if ( !$tax->show_tagcloud || empty($tax->labels->name) )
     1468                        continue;
    14751469        ?>
    1476                 <option value="<?php echo esc_attr($taxonomy) ?>" <?php selected($taxonomy, $current_taxonomy) ?>><?php echo $tax->labels->name; ?></option>
     1470                <option value="<?php echo esc_attr($taxonomy) ?>" <?php selected($taxonomy, $current_taxonomy) ?>><?php echo esc_attr( $tax->labels->name ); ?></option>
    14771471        <?php endforeach; ?>
    14781472        </select></p><?php
    14791473        }
    … …  
    15531547        public function update( $new_instance, $old_instance ) {
    15541548                $instance = array();
    15551549                if ( ! empty( $new_instance['title'] ) ) {
    1556                         $instance['title'] = strip_tags( stripslashes($new_instance['title']) );
     1550                        $instance['title'] = sanitize_text_field( $new_instance['title'] );
    15571551                }
    15581552                if ( ! empty( $new_instance['nav_menu'] ) ) {
    15591553                        $instance['nav_menu'] = (int) $new_instance['nav_menu'];