Ticket #6992: 6992.diff

wp-includes/compat.php

@@ -96 +96 @@
         return implode( '', $chars );
 }
 
+function php_compat_htmlspecialchars_decode($string, $quote_style = null)
+{
+    // Sanity check
+        if (!is_scalar($string)) {
+                user_error('htmlspecialchars_decode() expects parameter 1 to be string, ' .gettype($string) . ' given', E_USER_WARNING);
+                return;
+        }
+
+        if (!is_int($quote_style) && $quote_style !== null) {
+                user_error('htmlspecialchars_decode() expects parameter 2 to be integer, ' .gettype($quote_style) . ' given', E_USER_WARNING);
+                return;
+        }
+        
+        // Init
+        $from   = array('&', '<', '>');
+        $to     = array('&', '<', '>');
+
+        // The function does not behave as documented
+        // This matches the actual behaviour of the function
+        if ($quote_style & ENT_COMPAT || $quote_style & ENT_QUOTES) {
+                $from[] = '&quot;';
+                $to[]   = '"';
+                
+                $from[] = '&#039;';
+                $to[]   = "'";
+        }
+        return str_replace($from, $to, $string);
+}
+
+if (!function_exists('htmlspecialchars_decode')) {
+        function htmlspecialchars_decode($string, $quote_style = null)
+        {
+                return php_compat_htmlspecialchars_decode($string, $quote_style);
+        }
+}
 ?>

wp-includes/comment-template.php

@@ -818 +818 @@
         } else if ( empty($comment_author) ) {
                 $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '1' ORDER BY comment_date", $post->ID));
         } else {
-                $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND ( comment_approved = '1' OR ( comment_author = %s AND comment_author_email = %s AND comment_approved = '0' ) ) ORDER BY comment_date", $post->ID, $comment_author, $comment_author_email));
+                $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND ( comment_approved = '1' OR ( comment_author = %s AND comment_author_email = %s AND comment_approved = '0' ) ) ORDER BY comment_date", $post->ID, htmlspecialchars_decode($comment_author, ENT_QUOTES), $comment_author_email));
         }
 
         // keep $comments for legacy's sake