WordPress.org
Get WordPress

Make WordPress Core

Changeset 11109


Ignore:
Timestamp:
04/28/2009 05:58:45 AM (16 years ago)
Author:
ryan
Message:

s/attribute_escape/attr/. see #9650

Location:
trunk
Files:
84 edited

Legend:

Unmodified
Added
Removed

  • trunk/wp-admin/admin-ajax.php

    r11104 r11109  
    475475        $level++;
    476476    }
    477     $cat_full_name = attribute_escape($cat_full_name);
     477    $cat_full_name = attr($cat_full_name);
    478478
    479479    $x = new WP_Ajax_Response( array(
    … …  
    553553
    554554    $tag_full_name = $tag->name;
    555     $tag_full_name = attribute_escape($tag_full_name);
     555    $tag_full_name = attr($tag_full_name);
    556556
    557557    $x = new WP_Ajax_Response( array(

  • trunk/wp-admin/custom-header.php

    r11104 r11109  
    288288<input type="button" class="button" value="<?php _ea('Select a Text Color'); ?>" id="pickcolor" /><input type="button" class="button" value="<?php _ea('Use Original Color'); ?>" onclick="colorDefault()" id="defaultcolor" />
    289289<?php wp_nonce_field('custom-header') ?>
    290 <input type="hidden" name="textcolor" id="textcolor" value="#<?php attribute_escape(header_textcolor()) ?>" /><input name="submit" type="submit" class="button" value="<?php _ea('Save Changes'); ?>" /></form>
     290<input type="hidden" name="textcolor" id="textcolor" value="#<?php attr(header_textcolor()) ?>" /><input name="submit" type="submit" class="button" value="<?php _ea('Save Changes'); ?>" /></form>
    291291<?php } ?>
    292292
    … …  
    297297<p><?php printf(__('Images of exactly <strong>%1$d x %2$d pixels</strong> will be used as-is.'), HEADER_IMAGE_WIDTH, HEADER_IMAGE_HEIGHT); ?></p>
    298298
    299 <form enctype="multipart/form-data" id="uploadForm" method="POST" action="<?php echo attribute_escape(add_query_arg('step', 2)) ?>" style="margin: auto; width: 50%;">
     299<form enctype="multipart/form-data" id="uploadForm" method="POST" action="<?php echo attr(add_query_arg('step', 2)) ?>" style="margin: auto; width: 50%;">
    300300<label for="upload"><?php _e('Choose an image from your computer:'); ?></label><br /><input type="file" id="upload" name="import" />
    301301<input type="hidden" name="action" value="save" />
    … …  
    312312<h2><?php _e('Reset Header Image and Color'); ?></h2>
    313313<p><?php _e('This will restore the original header image and color. You will not be able to retrieve any customizations.') ?></p>
    314 <form method="post" action="<?php echo attribute_escape(add_query_arg('step', 1)) ?>">
     314<form method="post" action="<?php echo attr(add_query_arg('step', 1)) ?>">
    315315<?php wp_nonce_field('custom-header'); ?>
    316316<input type="submit" class="button" name="resetheader" value="<?php _ea('Restore Original Header'); ?>" />
    … …  
    373373<div class="wrap">
    374374
    375 <form method="POST" action="<?php echo attribute_escape(add_query_arg('step', 3)) ?>">
     375<form method="POST" action="<?php echo attr(add_query_arg('step', 3)) ?>">
    376376
    377377<p><?php _e('Choose the part of the image you want to use as your header.'); ?></p>

  • trunk/wp-admin/edit-attachment-rows.php

    r10774 r11109  
    6363?>
    6464
    65                 <a href="media.php?action=edit&amp;attachment_id=<?php the_ID(); ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $att_title)); ?>">
     65                <a href="media.php?action=edit&amp;attachment_id=<?php the_ID(); ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $att_title)); ?>">
    6666                    <?php echo $thumb; ?>
    6767                </a>
    … …  
    7575    case 'media':
    7676        ?>
    77         <td <?php echo $attributes ?>><strong><a href="<?php echo get_edit_post_link( $post->ID ); ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php echo $att_title; ?></a></strong><br />
     77        <td <?php echo $attributes ?>><strong><a href="<?php echo get_edit_post_link( $post->ID ); ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php echo $att_title; ?></a></strong><br />
    7878        <?php echo strtoupper(preg_replace('/^.*?\.(\w+)$/', '$1', get_attached_file($post->ID))); ?>
    7979        <p>
    … …  
    8484        if ( current_user_can('delete_post', $post->ID) )
    8585            $actions['delete'] = "<a class='submitdelete' href='" . wp_nonce_url("post.php?action=delete&amp;post=$post->ID", 'delete-post_' . $post->ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $post->post_status) ? __("You are about to delete this attachment '%s'\n  'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this attachment '%s'\n  'Cancel' to stop, 'OK' to delete."), $post->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . "</a>";
    86         $actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attribute_escape(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
     86        $actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attr(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
    8787        $action_count = count($actions);
    8888        $i = 0;
    … …  
    183183        ?>
    184184        <td <?php echo $attributes ?>>
    185         <a href="media.php?action=edit&amp;attachment_id=<?php the_ID(); ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php _e('Edit'); ?></a> |
     185        <a href="media.php?action=edit&amp;attachment_id=<?php the_ID(); ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php _e('Edit'); ?></a> |
    186186        <a href="<?php the_permalink(); ?>"><?php _e('Get permalink'); ?></a>
    187187        </td>

  • trunk/wp-admin/edit-category-form.php

    r11104 r11109  
    5050        <tr class="form-field form-required">
    5151            <th scope="row" valign="top"><label for="cat_name"><?php _e('Category Name') ?></label></th>
    52             <td><input name="cat_name" id="cat_name" type="text" value="<?php echo attribute_escape($category->name); ?>" size="40" aria-required="true" /><br />
     52            <td><input name="cat_name" id="cat_name" type="text" value="<?php echo attr($category->name); ?>" size="40" aria-required="true" /><br />
    5353            <?php _e('The name is used to identify the category almost everywhere, for example under the post or in the category widget.'); ?></td>
    5454        </tr>
    5555        <tr class="form-field">
    5656            <th scope="row" valign="top"><label for="category_nicename"><?php _e('Category Slug') ?></label></th>
    57             <td><input name="category_nicename" id="category_nicename" type="text" value="<?php echo attribute_escape(apply_filters('editable_slug', $category->slug)); ?>" size="40" /><br />
     57            <td><input name="category_nicename" id="category_nicename" type="text" value="<?php echo attr(apply_filters('editable_slug', $category->slug)); ?>" size="40" /><br />
    5858            <?php _e('The &#8220;slug&#8221; is the URL-friendly version of the name. It is usually all lowercase and contains only letters, numbers, and hyphens.'); ?></td>
    5959        </tr>

  • trunk/wp-admin/edit-comments.php

    r11104 r11109  
    8484require_once('admin-header.php');
    8585
    86 $mode = ( ! isset($_GET['mode']) || empty($_GET['mode']) ) ? 'detail' : attribute_escape($_GET['mode']);
     86$mode = ( ! isset($_GET['mode']) || empty($_GET['mode']) ) ? 'detail' : attr($_GET['mode']);
    8787
    8888$default_status = get_user_option('edit_comments_last_view');
    … …  
    9595    update_usermeta($current_user->ID, 'edit_comments_last_view', $comment_status);
    9696
    97 $comment_type = !empty($_GET['comment_type']) ? attribute_escape($_GET['comment_type']) : '';
     97$comment_type = !empty($_GET['comment_type']) ? attr($_GET['comment_type']) : '';
    9898
    9999$search_dirty = ( isset($_GET['s']) ) ? $_GET['s'] : '';
    100 $search = attribute_escape( $search_dirty ); ?>
     100$search = attr( $search_dirty ); ?>
    101101
    102102<div class="wrap">
    … …  
    165165    // I toyed with this, but decided against it. Leaving it in here in case anyone thinks it is a good idea. ~ Mark
    166166    if ( !empty( $_GET['s'] ) )
    167         $link = add_query_arg( 's', attribute_escape( stripslashes( $_GET['s'] ) ), $link );
     167        $link = add_query_arg( 's', attr( stripslashes( $_GET['s'] ) ), $link );
    168168    */
    169169    $status_links[] = "<li class='$status'><a href='$link'$class>" . sprintf(
    … …  
    365365    <input type="hidden" name="comment_status" value="<?php echo attr($comment_status); ?>" />
    366366    <input type="hidden" name="page" value="<?php echo isset($_REQUEST['page']) ? absint( $_REQUEST['page'] ) : 1; ?>" />
    367     <input type="hidden" name="p" value="<?php echo attribute_escape( $post_id ); ?>" />
    368     <input type="hidden" name="comment_type" value="<?php echo attribute_escape( $comment_type ); ?>" />
     367    <input type="hidden" name="p" value="<?php echo attr( $post_id ); ?>" />
     368    <input type="hidden" name="comment_type" value="<?php echo attr( $comment_type ); ?>" />
    369369    <?php wp_nonce_field( 'add-comment', '_ajax_nonce', false ); ?>
    370370</form>

  • trunk/wp-admin/edit-form-advanced.php

    r11104 r11109  
    1717if ( isset($_GET['message']) )
    1818    $_GET['message'] = absint( $_GET['message'] );
    19 $messages[1] = sprintf( __( 'Post updated. Continue editing below or <a href="%s">go back</a>.' ), attribute_escape( stripslashes( ( isset( $_GET['_wp_original_http_referer'] ) ? $_GET['_wp_original_http_referer'] : '') ) ) );
     19$messages[1] = sprintf( __( 'Post updated. Continue editing below or <a href="%s">go back</a>.' ), attr( stripslashes( ( isset( $_GET['_wp_original_http_referer'] ) ? $_GET['_wp_original_http_referer'] : '') ) ) );
    2020$messages[2] = __('Custom field updated.');
    2121$messages[3] = __('Custom field deleted.');
    … …  
    170170
    171171<div id="post-visibility-select" class="hide-if-js">
    172 <input type="hidden" name="hidden_post_password" id="hidden-post-password" value="<?php echo attribute_escape($post->post_password); ?>" />
     172<input type="hidden" name="hidden_post_password" id="hidden-post-password" value="<?php echo attr($post->post_password); ?>" />
    173173<input type="checkbox" style="display:none" name="hidden_post_sticky" id="hidden-post-sticky" value="sticky" <?php checked(is_sticky($post->ID)); ?> />
    174 <input type="hidden" name="hidden_post_visibility" id="hidden-post-visibility" value="<?php echo attribute_escape( $visibility ); ?>" />
     174<input type="hidden" name="hidden_post_visibility" id="hidden-post-visibility" value="<?php echo attr( $visibility ); ?>" />
    175175
    176176
    … …  
    178178<span id="sticky-span"><input id="sticky" name="sticky" type="checkbox" value="sticky" <?php checked(is_sticky($post->ID)); ?> tabindex="4" /> <label for="sticky" class="selectit"><?php _e('Stick this post to the front page') ?></label><br /></span>
    179179<input type="radio" name="visibility" id="visibility-radio-password" value="password" <?php checked( $visibility, 'password' ); ?> /> <label for="visibility-radio-password" class="selectit"><?php _e('Password protected'); ?></label><br />
    180 <span id="password-span"><label for="post_password"><?php _e('Password:'); ?></label> <input type="text" name="post_password" id="post_password" value="<?php echo attribute_escape($post->post_password); ?>" /><br /></span>
     180<span id="password-span"><label for="post_password"><?php _e('Password:'); ?></label> <input type="text" name="post_password" id="post_password" value="<?php echo attr($post->post_password); ?>" /><br /></span>
    181181<input type="radio" name="visibility" id="visibility-radio-private" value="private" <?php checked( $visibility, 'private' ); ?> /> <label for="visibility-radio-private" class="selectit"><?php _e('Private'); ?></label><br />
    182182
    … …  
    272272    $tax_name = substr($box['id'], 8);
    273273    $taxonomy = get_taxonomy($tax_name);
    274     $helps = isset($taxonomy->helps) ? attribute_escape($taxonomy->helps) : __('Separate tags with commas.');
     274    $helps = isset($taxonomy->helps) ? attr($taxonomy->helps) : __('Separate tags with commas.');
    275275?>
    276276<div class="tagsdiv" id="<?php echo $tax_name; ?>">
    … …  
    294294    if ( !is_taxonomy_hierarchical($tax_name) ) {
    295295        $taxonomy = get_taxonomy($tax_name);
    296         $label = isset($taxonomy->label) ? attribute_escape($taxonomy->label) : $tax_name;
     296        $label = isset($taxonomy->label) ? attr($taxonomy->label) : $tax_name;
    297297
    298298        add_meta_box('tagsdiv-' . $tax_name, $label, 'post_tags_meta_box', 'post', 'side', 'core');
    … …  
    385385 */
    386386function post_trackback_meta_box($post) {
    387     $form_trackback = '<input type="text" name="trackback_url" id="trackback_url" class="code" tabindex="7" value="'. attribute_escape( str_replace("\n", ' ', $post->to_ping) ) .'" />';
     387    $form_trackback = '<input type="text" name="trackback_url" id="trackback_url" class="code" tabindex="7" value="'. attr( str_replace("\n", ' ', $post->to_ping) ) .'" />';
    388388    if ('' != $post->pinged) {
    389389        $pings = '<p>'. __('Already pinged:') . '</p><ul>';
    … …  
    498498function post_slug_meta_box($post) {
    499499?>
    500 <label class="hidden" for="post_name"><?php _e('Post Slug') ?></label><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attribute_escape( $post->post_name ); ?>" />
     500<label class="hidden" for="post_name"><?php _e('Post Slug') ?></label><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attr( $post->post_name ); ?>" />
    501501<?php
    502502}
    … …  
    575575<input type="hidden" id="hiddenaction" name="action" value="<?php echo attr($form_action) ?>" />
    576576<input type="hidden" id="originalaction" name="originalaction" value="<?php echo attr($form_action) ?>" />
    577 <input type="hidden" id="post_author" name="post_author" value="<?php echo attribute_escape( $post->post_author ); ?>" />
     577<input type="hidden" id="post_author" name="post_author" value="<?php echo attr( $post->post_author ); ?>" />
    578578<input type="hidden" id="post_type" name="post_type" value="<?php echo attr($post->post_type) ?>" />
    579579<input type="hidden" id="original_post_status" name="original_post_status" value="<?php echo attr($post->post_status) ?>" />
    … …  
    596596<div id="titlediv">
    597597<div id="titlewrap">
    598     <input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape( htmlspecialchars( $post->post_title ) ); ?>" id="title" autocomplete="off" />
     598    <input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attr( htmlspecialchars( $post->post_title ) ); ?>" id="title" autocomplete="off" />
    599599</div>
    600600<div class="inside">

  • trunk/wp-admin/edit-form-comment.php

    r11104 r11109  
    2727<?php
    2828
    29 $email = attribute_escape( $comment->comment_author_email );
    30 $url = attribute_escape( $comment->comment_author_url );
     29$email = attr( $comment->comment_author_email );
     30$url = attr( $comment->comment_author_url );
    3131// add_meta_box('submitdiv', __('Save'), 'comment_submit_meta_box', 'comment', 'side', 'core');
    3232?>
    … …  
    9191<tr valign="top">
    9292    <td class="first"><?php _e( 'Name:' ); ?></td>
    93     <td><input type="text" name="newcomment_author" size="30" value="<?php echo attribute_escape( $comment->comment_author ); ?>" tabindex="1" id="name" /></td>
     93    <td><input type="text" name="newcomment_author" size="30" value="<?php echo attr( $comment->comment_author ); ?>" tabindex="1" id="name" /></td>
    9494</tr>
    9595<tr valign="top">

  • trunk/wp-admin/edit-link-category-form.php

    r11104 r11109  
    6868        <tr class="form-field">
    6969            <th scope="row" valign="top"><label for="slug"><?php _e('Link Category slug') ?></label></th>
    70             <td><input name="slug" id="slug" type="text" value="<?php echo attribute_escape(apply_filters('editable_slug', $category->slug)); ?>" size="40" /><br />
     70            <td><input name="slug" id="slug" type="text" value="<?php echo attr(apply_filters('editable_slug', $category->slug)); ?>" size="40" /><br />
    7171            <?php _e('The &#8220;slug&#8221; is the URL-friendly version of the name. It is usually all lowercase and contains only letters, numbers, and hyphens.'); ?></td>
    7272        </tr>

  • trunk/wp-admin/edit-link-form.php

    r11104 r11109  
    405405<input type="hidden" name="action" value="save" />
    406406<input type="hidden" name="link_id" value="<?php echo (int) $link_id; ?>" />
    407 <input type="hidden" name="order_by" value="<?php echo attribute_escape($order_by); ?>" />
     407<input type="hidden" name="order_by" value="<?php echo attr($order_by); ?>" />
    408408<input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
    409409<?php else: ?>

  • trunk/wp-admin/edit-page-form.php

    r11104 r11109  
    1919if ( isset($_GET['message']) )
    2020    $_GET['message'] = absint( $_GET['message'] );
    21 $messages[1] = sprintf( __( 'Page updated. Continue editing below or <a href="%s">go back</a>.' ), attribute_escape( stripslashes( ( isset( $_GET['_wp_original_http_referer'] ) ? $_GET['_wp_original_http_referer'] : '') ) ) );
     21$messages[1] = sprintf( __( 'Page updated. Continue editing below or <a href="%s">go back</a>.' ), attr( stripslashes( ( isset( $_GET['_wp_original_http_referer'] ) ? $_GET['_wp_original_http_referer'] : '') ) ) );
    2222$messages[2] = __('Custom field updated.');
    2323$messages[3] = __('Custom field deleted.');
    … …  
    7474<div id="save-action">
    7575<?php if ( 'publish' != $post->post_status && 'future' != $post->post_status && 'pending' != $post->post_status )  { ?>
    76 <input <?php if ( 'private' == $post->post_status ) { ?>style="display:none"<?php } ?> type="submit" name="save" id="save-post" value="<?php echo attribute_escape( __('Save Draft') ); ?>" tabindex="4" class="button button-highlighted" />
     76<input <?php if ( 'private' == $post->post_status ) { ?>style="display:none"<?php } ?> type="submit" name="save" id="save-post" value="<?php echo attr( __('Save Draft') ); ?>" tabindex="4" class="button button-highlighted" />
    7777<?php } elseif ( 'pending' == $post->post_status && $can_publish ) { ?>
    78 <input type="submit" name="save" id="save-post" value="<?php echo attribute_escape( __('Save as Pending') ); ?>" tabindex="4" class="button button-highlighted" />
     78<input type="submit" name="save" id="save-post" value="<?php echo attr( __('Save as Pending') ); ?>" tabindex="4" class="button button-highlighted" />
    7979<?php } ?>
    8080</div>
    … …  
    163163
    164164<div id="post-visibility-select" class="hide-if-js">
    165 <input type="hidden" name="hidden_post_password" id="hidden-post-password" value="<?php echo attribute_escape($post->post_password); ?>" />
    166 <input type="hidden" name="hidden_post_visibility" id="hidden-post-visibility" value="<?php echo attribute_escape( $visibility ); ?>" />
     165<input type="hidden" name="hidden_post_password" id="hidden-post-password" value="<?php echo attr($post->post_password); ?>" />
     166<input type="hidden" name="hidden_post_visibility" id="hidden-post-visibility" value="<?php echo attr( $visibility ); ?>" />
    167167
    168168
    169169<input type="radio" name="visibility" id="visibility-radio-public" value="public" <?php checked( $visibility, 'public' ); ?> /> <label for="visibility-radio-public" class="selectit"><?php _e('Public'); ?></label><br />
    170170<input type="radio" name="visibility" id="visibility-radio-password" value="password" <?php checked( $visibility, 'password' ); ?> /> <label for="visibility-radio-password" class="selectit"><?php _e('Password protected'); ?></label><br />
    171 <span id="password-span"><label for="post_password"><?php _e('Password:'); ?></label> <input type="text" name="post_password" id="post_password" value="<?php echo attribute_escape($post->post_password); ?>" /><br /></span>
     171<span id="password-span"><label for="post_password"><?php _e('Password:'); ?></label> <input type="text" name="post_password" id="post_password" value="<?php echo attr($post->post_password); ?>" /><br /></span>
    172172<input type="radio" name="visibility" id="visibility-radio-private" value="private" <?php checked( $visibility, 'private' ); ?> /> <label for="visibility-radio-private" class="selectit"><?php _e('Private'); ?></label><br />
    173173
    … …  
    350350function page_slug_meta_box($post){
    351351?>
    352 <label class="hidden" for="post_name"><?php _e('Page Slug') ?></label><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attribute_escape( $post->post_name ); ?>" />
     352<label class="hidden" for="post_name"><?php _e('Page Slug') ?></label><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attr( $post->post_name ); ?>" />
    353353<?php
    354354}
    … …  
    420420<input type="hidden" id="hiddenaction" name="action" value='<?php echo $form_action ?>' />
    421421<input type="hidden" id="originalaction" name="originalaction" value="<?php echo $form_action ?>" />
    422 <input type="hidden" id="post_author" name="post_author" value="<?php echo attribute_escape( $post->post_author ); ?>" />
     422<input type="hidden" id="post_author" name="post_author" value="<?php echo attr( $post->post_author ); ?>" />
    423423<?php echo $form_extra ?>
    424424<input type="hidden" id="post_type" name="post_type" value="<?php echo $post->post_type ?>" />
    … …  
    443443<div id="titlediv">
    444444<div id="titlewrap">
    445   <input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape( htmlspecialchars( $post->post_title ) ); ?>" id="title" autocomplete="off" />
     445  <input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attr( htmlspecialchars( $post->post_title ) ); ?>" id="title" autocomplete="off" />
    446446</div>
    447447<div class="inside">

  • trunk/wp-admin/edit-pages.php

    r11036 r11109  
    176176
    177177<?php if ( isset($_GET['post_status'] ) ) : ?>
    178 <input type="hidden" name="post_status" value="<?php echo attribute_escape($_GET['post_status']) ?>" />
     178<input type="hidden" name="post_status" value="<?php echo attr($_GET['post_status']) ?>" />
    179179<?php endif; ?>
    180180

  • trunk/wp-admin/edit-tag-form.php

    r10903 r11109  
    2222<input type="hidden" name="action" value="editedtag" />
    2323<input type="hidden" name="tag_ID" value="<?php echo $tag->term_id ?>" />
    24 <input type="hidden" name="taxonomy" value="<?php echo attribute_escape($taxonomy) ?>" />
     24<input type="hidden" name="taxonomy" value="<?php echo attr($taxonomy) ?>" />
    2525<?php wp_original_referer_field(true, 'previous'); wp_nonce_field('update-tag_' . $tag_ID); ?>
    2626    <table class="form-table">
    2727        <tr class="form-field form-required">
    2828            <th scope="row" valign="top"><label for="name"><?php _e('Tag name') ?></label></th>
    29             <td><input name="name" id="name" type="text" value="<?php if ( isset( $tag->name ) ) echo attribute_escape($tag->name); ?>" size="40" aria-required="true" />
     29            <td><input name="name" id="name" type="text" value="<?php if ( isset( $tag->name ) ) echo attr($tag->name); ?>" size="40" aria-required="true" />
    3030            <p><?php _e('The name is how the tag appears on your site.'); ?></p></td>
    3131        </tr>
    3232        <tr class="form-field">
    3333            <th scope="row" valign="top"><label for="slug"><?php _e('Tag slug') ?></label></th>
    34             <td><input name="slug" id="slug" type="text" value="<?php if ( isset( $tag->slug ) ) echo attribute_escape(apply_filters('editable_slug', $tag->slug)); ?>" size="40" />
     34            <td><input name="slug" id="slug" type="text" value="<?php if ( isset( $tag->slug ) ) echo attr(apply_filters('editable_slug', $tag->slug)); ?>" size="40" />
    3535            <p><?php _e('The &#8220;slug&#8221; is the URL-friendly version of the name. It is usually all lowercase and contains only letters, numbers, and hyphens.'); ?></p></td>
    3636        </tr>

  • trunk/wp-admin/edit-tags.php

    r10943 r11109  
    171171<div class="col-wrap">
    172172<form id="posts-filter" action="" method="get">
    173 <input type="hidden" name="taxonomy" value="<?php echo attribute_escape($taxonomy); ?>" />
     173<input type="hidden" name="taxonomy" value="<?php echo attr($taxonomy); ?>" />
    174174<div class="tablenav">
    175175<?php
    … …  
    277277<form name="addtag" id="addtag" method="post" action="edit-tags.php" class="add:the-list: validate">
    278278<input type="hidden" name="action" value="addtag" />
    279 <input type="hidden" name="taxonomy" value="<?php echo attribute_escape($taxonomy); ?>" />
     279<input type="hidden" name="taxonomy" value="<?php echo attr($taxonomy); ?>" />
    280280<?php wp_original_referer_field(true, 'previous'); wp_nonce_field('add-tag'); ?>
    281281

  • trunk/wp-admin/edit.php

    r10943 r11109  
    9393    $mode = 'list';
    9494else
    95     $mode = attribute_escape($_GET['mode']); ?>
     95    $mode = attr($_GET['mode']); ?>
    9696
    9797<div class="wrap">
    … …  
    171171
    172172<?php if ( isset($_GET['post_status'] ) ) : ?>
    173 <input type="hidden" name="post_status" value="<?php echo attribute_escape($_GET['post_status']) ?>" />
     173<input type="hidden" name="post_status" value="<?php echo attr($_GET['post_status']) ?>" />
    174174<?php endif; ?>
    175175<input type="hidden" name="mode" value="<?php echo $mode; ?>" />

  • trunk/wp-admin/import/dotclear.php

    r10606 r11109  
    216216        wp_nonce_field('import-dotclear');
    217217        $this->db_form();
    218         echo '<p class="submit"><input type="submit" name="submit" class="button" value="'.attribute_escape(__('Import Categories')).'" /></p>';
     218        echo '<p class="submit"><input type="submit" name="submit" class="button" value="'.attr(__('Import Categories')).'" /></p>';
    219219        echo '</form></div>';
    220220    }
    … …  
    633633        echo '<form action="admin.php?import=dotclear&amp;step=2" method="post">';
    634634        wp_nonce_field('import-dotclear');
    635         printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attribute_escape(__('Import Users')));
     635        printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attr(__('Import Users')));
    636636        echo '</form>';
    637637
    … …  
    646646        echo '<form action="admin.php?import=dotclear&amp;step=3" method="post">';
    647647        wp_nonce_field('import-dotclear');
    648         printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attribute_escape(__('Import Posts')));
     648        printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attr(__('Import Posts')));
    649649        echo '</form>';
    650650    }
    … …  
    660660        echo '<form action="admin.php?import=dotclear&amp;step=4" method="post">';
    661661        wp_nonce_field('import-dotclear');
    662         printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attribute_escape(__('Import Comments')));
     662        printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attr(__('Import Comments')));
    663663        echo '</form>';
    664664    }
    … …  
    672672        echo '<form action="admin.php?import=dotclear&amp;step=5" method="post">';
    673673        wp_nonce_field('import-dotclear');
    674         printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attribute_escape(__('Import Links')));
     674        printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attr(__('Import Links')));
    675675        echo '</form>';
    676676    }
    … …  
    685685        echo '<form action="admin.php?import=dotclear&amp;step=6" method="post">';
    686686        wp_nonce_field('import-dotclear');
    687         printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attribute_escape(__('Finish')));
     687        printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attr(__('Finish')));
    688688        echo '</form>';
    689689    }

  • trunk/wp-admin/import/livejournal.php

    r11081 r11109  
    185185            <p><?php _e( 'It looks like you attempted to import your LiveJournal posts previously and got interrupted.' ) ?></p>
    186186            <p class="submit">
    187                 <input type="submit" class="button-primary" value="<?php echo attribute_escape( __( 'Continue previous import' ) ) ?>" />
     187                <input type="submit" class="button-primary" value="<?php echo attr( __( 'Continue previous import' ) ) ?>" />
    188188            </p>
    189             <p class="submitbox"><a href="<?php echo clean_url($_SERVER['PHP_SELF'] . '?import=livejournal&amp;step=-1&amp;_wpnonce=' . wp_create_nonce( 'lj-api-import' ) . '&amp;_wp_http_referer=' . attribute_escape( $_SERVER['REQUEST_URI'] )) ?>" class="deletion submitdelete"><?php _e( 'Cancel &amp; start a new import' ) ?></a></p>
     189            <p class="submitbox"><a href="<?php echo clean_url($_SERVER['PHP_SELF'] . '?import=livejournal&amp;step=-1&amp;_wpnonce=' . wp_create_nonce( 'lj-api-import' ) . '&amp;_wp_http_referer=' . attr( $_SERVER['REQUEST_URI'] )) ?>" class="deletion submitdelete"><?php _e( 'Cancel &amp; start a new import' ) ?></a></p>
    190190            <p>
    191191        <?php else : ?>
    … …  
    224224
    225225            <p class="submit">
    226                 <input type="submit" class="button-primary" value="<?php echo attribute_escape( __( 'Connect to LiveJournal and Import' ) ) ?>" />
     226                <input type="submit" class="button-primary" value="<?php echo attr( __( 'Connect to LiveJournal and Import' ) ) ?>" />
    227227            </p>
    228228
    … …  
    725725            ?>
    726726            <p><?php _e( 'Please enter your LiveJournal username <em>and</em> password so we can download your posts and comments.' ) ?></p>
    727             <p><a href="<?php echo clean_url($_SERVER['PHP_SELF'] . '?import=livejournal&amp;step=-1&amp;_wpnonce=' . wp_create_nonce( 'lj-api-import' ) . '&amp;_wp_http_referer=' . attribute_escape( str_replace( '&step=1', '', $_SERVER['REQUEST_URI'] ) ) ) ?>"><?php _e( 'Start again' ) ?></a></p>
     727            <p><a href="<?php echo clean_url($_SERVER['PHP_SELF'] . '?import=livejournal&amp;step=-1&amp;_wpnonce=' . wp_create_nonce( 'lj-api-import' ) . '&amp;_wp_http_referer=' . attr( str_replace( '&step=1', '', $_SERVER['REQUEST_URI'] ) ) ) ?>"><?php _e( 'Start again' ) ?></a></p>
    728728            <?php
    729729            return false;
    … …  
    737737                ?>
    738738                <p><?php _e( 'Logging in to LiveJournal failed. Check your username and password and try again.' ) ?></p>
    739                 <p><a href="<?php echo clean_url($_SERVER['PHP_SELF'] . '?import=livejournal&amp;step=-1&amp;_wpnonce=' . wp_create_nonce( 'lj-api-import' ) . '&amp;_wp_http_referer=' . attribute_escape( str_replace( '&step=1', '', $_SERVER['REQUEST_URI'] ) ) ) ?>"><?php _e( 'Start again' ) ?></a></p>
     739                <p><a href="<?php echo clean_url($_SERVER['PHP_SELF'] . '?import=livejournal&amp;step=-1&amp;_wpnonce=' . wp_create_nonce( 'lj-api-import' ) . '&amp;_wp_http_referer=' . attr( str_replace( '&step=1', '', $_SERVER['REQUEST_URI'] ) ) ) ?>"><?php _e( 'Start again' ) ?></a></p>
    740740                <?php
    741741                return false;
    … …  
    817817            <?php wp_nonce_field( 'lj-api-import' ) ?>
    818818            <input type="hidden" name="step" id="step" value="1" />
    819             <p><input type="submit" class="button-primary" value="<?php echo attribute_escape( __( 'Import the next batch' ) ) ?>" /> <span id="auto-message"></span></p>
     819            <p><input type="submit" class="button-primary" value="<?php echo attr( __( 'Import the next batch' ) ) ?>" /> <span id="auto-message"></span></p>
    820820            </form>
    821821            <?php $this->auto_ajax( 'ljapi-auto-repost', 'auto-message', 0 ); ?>
    … …  
    867867            <?php wp_nonce_field( 'lj-api-import' ) ?>
    868868            <input type="hidden" name="step" id="step" value="2" />
    869             <p><input type="submit" class="button-primary" value="<?php echo attribute_escape( __( 'Import the next batch' ) ) ?>" /> <span id="auto-message"></span></p>
     869            <p><input type="submit" class="button-primary" value="<?php echo attr( __( 'Import the next batch' ) ) ?>" /> <span id="auto-message"></span></p>
    870870            </form>
    871871            <?php $this->auto_ajax( 'ljapi-auto-repost', 'auto-message', 0 ); ?>
    … …  
    943943        $str .= wp_referer_field( false );
    944944        $str .= '<input type="hidden" name="step" id="step" value="' . $next_step . '" />';
    945         $str .= '<p><input type="submit" class="button-primary" value="' . attribute_escape( $label ) . '" /> <span id="auto-message"></span></p>';
     945        $str .= '<p><input type="submit" class="button-primary" value="' . attr( $label ) . '" /> <span id="auto-message"></span></p>';
    946946        $str .= '</form>';
    947947

  • trunk/wp-admin/import/mt.php

    r10810 r11109  
    4040
    4141<?php wp_import_upload_form( add_query_arg('step', 1) ); ?>
    42 <form method="post" action="<?php echo attribute_escape(add_query_arg('step', 1)); ?>" class="import-upload-form">
     42<form method="post" action="<?php echo attr(add_query_arg('step', 1)); ?>" class="import-upload-form">
    4343
    4444<?php wp_nonce_field('import-upload'); ?>
    … …  
    4747<?php _e('Or use <code>mt-export.txt</code> in your <code>/wp-content/</code> directory'); ?></p>
    4848<p class="submit">
    49 <input type="submit" class="button" value="<?php echo attribute_escape(__('Import mt-export.txt')); ?>" />
     49<input type="submit" class="button" value="<?php echo attr(__('Import mt-export.txt')); ?>" />
    5050</p>
    5151</form>

  • trunk/wp-admin/import/textpattern.php

    r10606 r11109  
    7171        wp_nonce_field('import-textpattern');
    7272        $this->db_form();
    73         echo '<p class="submit"><input type="submit" name="submit" class="button" value="'.attribute_escape(__('Import')).'" /></p>';
     73        echo '<p class="submit"><input type="submit" name="submit" class="button" value="'.attr(__('Import')).'" /></p>';
    7474        echo '</form>';
    7575        echo '</div>';
    … …  
    506506        echo '<form action="admin.php?import=textpattern&amp;step=2" method="post">';
    507507        wp_nonce_field('import-textpattern');
    508         printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attribute_escape(__('Import Users')));
     508        printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attr(__('Import Users')));
    509509        echo '</form>';
    510510
    … …  
    519519        echo '<form action="admin.php?import=textpattern&amp;step=3" method="post">';
    520520        wp_nonce_field('import-textpattern');
    521         printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attribute_escape(__('Import Posts')));
     521        printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attr(__('Import Posts')));
    522522        echo '</form>';
    523523    }
    … …  
    533533        echo '<form action="admin.php?import=textpattern&amp;step=4" method="post">';
    534534        wp_nonce_field('import-textpattern');
    535         printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attribute_escape(__('Import Comments')));
     535        printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attr(__('Import Comments')));
    536536        echo '</form>';
    537537    }
    … …  
    545545        echo '<form action="admin.php?import=textpattern&amp;step=5" method="post">';
    546546        wp_nonce_field('import-textpattern');
    547         printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attribute_escape(__('Import Links')));
     547        printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attr(__('Import Links')));
    548548        echo '</form>';
    549549    }
    … …  
    558558        echo '<form action="admin.php?import=textpattern&amp;step=6" method="post">';
    559559        wp_nonce_field('import-textpattern');
    560         printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attribute_escape(__('Finish')));
     560        printf('<p class="submit"><input type="submit" name="submit" class="button" value="%s" /></p>', attr(__('Finish')));
    561561        echo '</form>';
    562562    }

  • trunk/wp-admin/import/wordpress.php

    r10606 r11109  
    234234
    235235        echo '<p class="submit">';
    236         echo '<input type="submit" class="button" value="'.attribute_escape( __('Submit') ).'" />'.'<br />';
     236        echo '<input type="submit" class="button" value="'.attr( __('Submit') ).'" />'.'<br />';
    237237        echo '</p>';
    238238        echo '</form>';

  • trunk/wp-admin/import/wp-cat2tag.php

    r10608 r11109  
    185185
    186186<?php   foreach ( $this->all_tags as $tag ) { ?>
    187     <li><label><input type="checkbox" name="tags_to_convert[]" value="<?php echo intval($tag->term_id); ?>" /> <?php echo attribute_escape($tag->name) . ' (' . $tag->count . ')'; ?></label><?php if ( in_array( intval($tag->term_id),  $this->hybrids_ids ) ) echo ' <a href="#note"> * </a>'; ?></li>
     187    <li><label><input type="checkbox" name="tags_to_convert[]" value="<?php echo intval($tag->term_id); ?>" /> <?php echo attr($tag->name) . ' (' . $tag->count . ')'; ?></label><?php if ( in_array( intval($tag->term_id),  $this->hybrids_ids ) ) echo ' <a href="#note"> * </a>'; ?></li>
    188188
    189189<?php   } ?>

  • trunk/wp-admin/includes/bookmark.php

    r10414 r11109  
    6060
    6161    if ( isset( $_GET['name'] ) )
    62         $link->link_name = attribute_escape( $_GET['name']);
     62        $link->link_name = attr( $_GET['name']);
    6363    else
    6464        $link->link_name = '';

  • trunk/wp-admin/includes/class-wp-upgrader.php

    r11089 r11109  
    821821        }
    822822        $update_actions =  array(
    823             'activate_plugin' => '<a href="' . wp_nonce_url('plugins.php?action=activate&amp;plugin=' . $this->plugin, 'activate-plugin_' . $this->plugin) . '" title="' . attribute_escape(__('Activate this plugin')) . '" target="_parent">' . __('Activate Plugin') . '</a>',
    824             'plugins_page' => '<a href="' . admin_url('plugins.php') . '" title="' . attribute_escape(__('Goto plugins page')) . '" target="_parent">' . __('Return to Plugins page') . '</a>'
     823            'activate_plugin' => '<a href="' . wp_nonce_url('plugins.php?action=activate&amp;plugin=' . $this->plugin, 'activate-plugin_' . $this->plugin) . '" title="' . attr(__('Activate this plugin')) . '" target="_parent">' . __('Activate Plugin') . '</a>',
     824            'plugins_page' => '<a href="' . admin_url('plugins.php') . '" title="' . attr(__('Goto plugins page')) . '" target="_parent">' . __('Return to Plugins page') . '</a>'
    825825        );
    826826        if ( $this->plugin_active )
    … …  
    872872
    873873        $install_actions = array(
    874             'activate_plugin' => '<a href="' . wp_nonce_url('plugins.php?action=activate&amp;plugin=' . $plugin_file, 'activate-plugin_' . $plugin_file) . '" title="' . attribute_escape(__('Activate this plugin')) . '" target="_parent">' . __('Activate Plugin') . '</a>',
     874            'activate_plugin' => '<a href="' . wp_nonce_url('plugins.php?action=activate&amp;plugin=' . $plugin_file, 'activate-plugin_' . $plugin_file) . '" title="' . attr(__('Activate this plugin')) . '" target="_parent">' . __('Activate Plugin') . '</a>',
    875875                            );
    876876
    877877        if ( $this->type == 'web' )
    878             $install_actions['plugins_page'] = '<a href="' . admin_url('plugin-install.php') . '" title="' . attribute_escape(__('Return to Plugin Installer')) . '" target="_parent">' . __('Return to Plugin Installer') . '</a>';
     878            $install_actions['plugins_page'] = '<a href="' . admin_url('plugin-install.php') . '" title="' . attr(__('Return to Plugin Installer')) . '" target="_parent">' . __('Return to Plugin Installer') . '</a>';
    879879        else
    880             $install_actions['plugins_page'] = '<a href="' . admin_url('plugins.php') . '" title="' . attribute_escape(__('Return to Plugins page')) . '" target="_parent">' . __('Return to Plugins page') . '</a>';
     880            $install_actions['plugins_page'] = '<a href="' . admin_url('plugins.php') . '" title="' . attr(__('Return to Plugins page')) . '" target="_parent">' . __('Return to Plugins page') . '</a>';
    881881
    882882
    … …  
    937937
    938938        $install_actions = array(
    939             'preview' => '<a href="' . $preview_link . '" class="thickbox thickbox-preview" title="' . attribute_escape(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>',
    940             'activate' => '<a href="' . $activate_link .  '" class="activatelink" title="' . attribute_escape( sprintf( __('Activate "%s"'), $name ) ) . '">' . __('Activate') . '</a>'
     939            'preview' => '<a href="' . $preview_link . '" class="thickbox thickbox-preview" title="' . attr(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>',
     940            'activate' => '<a href="' . $activate_link .  '" class="activatelink" title="' . attr( sprintf( __('Activate "%s"'), $name ) ) . '">' . __('Activate') . '</a>'
    941941                            );
    942942
    943943        if ( $this->type == 'web' )
    944             $install_actions['themes_page'] = '<a href="' . admin_url('theme-install.php') . '" title="' . attribute_escape(__('Back to Theme Installer')) . '" target="_parent">' . __('Return to Theme Installer.') . '</a>';
     944            $install_actions['themes_page'] = '<a href="' . admin_url('theme-install.php') . '" title="' . attr(__('Back to Theme Installer')) . '" target="_parent">' . __('Return to Theme Installer.') . '</a>';
    945945        else
    946             $install_actions['themes_page'] = '<a href="' . admin_url('themes.php') . '" title="' . attribute_escape(__('Themes page')) . '" target="_parent">' . __('Return to Themes page') . '</a>';
     946            $install_actions['themes_page'] = '<a href="' . admin_url('themes.php') . '" title="' . attr(__('Themes page')) . '" target="_parent">' . __('Return to Themes page') . '</a>';
    947947
    948948        if ( ! $this->result || is_wp_error($this->result) )
    … …  
    996996
    997997        $update_actions =  array(
    998             'preview' => '<a href="' . $preview_link . '" class="thickbox thickbox-preview" title="' . attribute_escape(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>',
    999             'activate' => '<a href="' . $activate_link .  '" class="activatelink" title="' . attribute_escape( sprintf( __('Activate "%s"'), $name ) ) . '">' . __('Activate') . '</a>',
    1000             'themes_page' => '<a href="' . admin_url('themes.php') . '" title="' . attribute_escape(__('Return to Themes page')) . '" target="_parent">' . __('Return to Themes page') . '</a>',
     998            'preview' => '<a href="' . $preview_link . '" class="thickbox thickbox-preview" title="' . attr(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>',
     999            'activate' => '<a href="' . $activate_link .  '" class="activatelink" title="' . attr( sprintf( __('Activate "%s"'), $name ) ) . '">' . __('Activate') . '</a>',
     1000            'themes_page' => '<a href="' . admin_url('themes.php') . '" title="' . attr(__('Return to Themes page')) . '" target="_parent">' . __('Return to Themes page') . '</a>',
    10011001        );
    10021002        if ( ( ! $this->result || is_wp_error($this->result) ) || $stylesheet == get_stylesheet() )

  • trunk/wp-admin/includes/dashboard.php

    r11081 r11109  
    372372        <h4 id="quick-post-title"><label for="title"><?php _e('Title') ?></label></h4>
    373373        <div class="input-text-wrap">
    374             <input type="text" name="post_title" id="title" tabindex="1" autocomplete="off" value="<?php echo attribute_escape( $post->post_title ); ?>" />
     374            <input type="text" name="post_title" id="title" tabindex="1" autocomplete="off" value="<?php echo attr( $post->post_title ); ?>" />
    375375        </div>
    376376
    … …  
    433433            $url = get_edit_post_link( $draft->ID );
    434434            $title = _draft_or_post_title( $draft->ID );
    435             $item = "<h4><a href='$url' title='" . sprintf( __( 'Edit "%s"' ), attribute_escape( $title ) ) . "'>$title</a> <abbr title='" . get_the_time(__('Y/m/d g:i:s A'), $draft) . "'>" . get_the_time( get_option( 'date_format' ), $draft ) . '</abbr></h4>';
     435            $item = "<h4><a href='$url' title='" . sprintf( __( 'Edit "%s"' ), attr( $title ) ) . "'>$title</a> <abbr title='" . get_the_time(__('Y/m/d g:i:s A'), $draft) . "'>" . get_the_time( get_option( 'date_format' ), $draft ) . '</abbr></h4>';
    436436            if ( $the_content = preg_split( '#\s#', strip_tags( $draft->post_content ), 11, PREG_SPLIT_NO_EMPTY ) )
    437437                $item .= '<p>' . join( ' ', array_slice( $the_content, 0, 10 ) ) . ( 10 < count( $the_content ) ? '&hellip;' : '' ) . '</p>';
    … …  
    580580            <div id="inline-<?php echo $comment->comment_ID; ?>" class="hidden">
    581581                <textarea class="comment" rows="3" cols="10"><?php echo $comment->comment_content; ?></textarea>
    582                 <div class="author-email"><?php echo attribute_escape( $comment->comment_author_email ); ?></div>
    583                 <div class="author"><?php echo attribute_escape( $comment->comment_author ); ?></div>
    584                 <div class="author-url"><?php echo attribute_escape( $comment->comment_author_url ); ?></div>
     582                <div class="author-email"><?php echo attr( $comment->comment_author_email ); ?></div>
     583                <div class="author"><?php echo attr( $comment->comment_author ); ?></div>
     584                <div class="author-url"><?php echo attr( $comment->comment_author_url ); ?></div>
    585585                <div class="comment_status"><?php echo $comment->comment_approved; ?></div>
    586586            </div>

  • trunk/wp-admin/includes/file.php

    r11063 r11109  
    732732<tr valign="top">
    733733<th scope="row"><label for="hostname"><?php _e('Hostname') ?></label></th>
    734 <td><input name="hostname" type="text" id="hostname" value="<?php echo attribute_escape($hostname); if ( !empty($port) ) echo ":$port"; ?>"<?php if( defined('FTP_HOST') ) echo ' disabled="disabled"' ?> size="40" /></td>
     734<td><input name="hostname" type="text" id="hostname" value="<?php echo attr($hostname); if ( !empty($port) ) echo ":$port"; ?>"<?php if( defined('FTP_HOST') ) echo ' disabled="disabled"' ?> size="40" /></td>
    735735</tr>
    736736
    737737<tr valign="top">
    738738<th scope="row"><label for="username"><?php _e('Username') ?></label></th>
    739 <td><input name="username" type="text" id="username" value="<?php echo attribute_escape($username) ?>"<?php if( defined('FTP_USER') ) echo ' disabled="disabled"' ?> size="40" /></td>
     739<td><input name="username" type="text" id="username" value="<?php echo attr($username) ?>"<?php if( defined('FTP_USER') ) echo ' disabled="disabled"' ?> size="40" /></td>
    740740</tr>
    741741
    … …  
    751751<label for="private_key"><?php _e('Private Key:') ?></label>
    752752</div></th>
    753 <td><br /><input name="public_key" type="text" id="public_key" value="<?php echo attribute_escape($public_key) ?>"<?php if( defined('FTP_PUBKEY') ) echo ' disabled="disabled"' ?> size="40" /><br /><input name="private_key" type="text" id="private_key" value="<?php echo attribute_escape($private_key) ?>"<?php if( defined('FTP_PRIKEY') ) echo ' disabled="disabled"' ?> size="40" />
     753<td><br /><input name="public_key" type="text" id="public_key" value="<?php echo attr($public_key) ?>"<?php if( defined('FTP_PUBKEY') ) echo ' disabled="disabled"' ?> size="40" /><br /><input name="private_key" type="text" id="private_key" value="<?php echo attr($private_key) ?>"<?php if( defined('FTP_PRIKEY') ) echo ' disabled="disabled"' ?> size="40" />
    754754<div><?php _e('Enter the location on the server where the keys are located. If a passphrase is needed, enter that in the password field above.') ?></div></td>
    755755</tr>
    … …  
    768768
    769769<?php if ( isset( $_POST['version'] ) ) : ?>
    770 <input type="hidden" name="version" value="<?php echo attribute_escape($_POST['version']) ?>" />
     770<input type="hidden" name="version" value="<?php echo attr($_POST['version']) ?>" />
    771771<?php endif; ?>
    772772<?php if ( isset( $_POST['locale'] ) ) : ?>
    773 <input type="hidden" name="locale" value="<?php echo attribute_escape($_POST['locale']) ?>" />
     773<input type="hidden" name="locale" value="<?php echo attr($_POST['locale']) ?>" />
    774774<?php endif; ?>
    775775<p class="submit">

  • trunk/wp-admin/includes/manifest.php

    r11079 r11109  
    2727 * @ignore
    2828 */
    29 function attribute_escape() {}
     29function attr() {}
    3030
    3131/**

  • trunk/wp-admin/includes/media.php

    r11052 r11109  
    7979            $href = add_query_arg(array('tab'=>$callback, 's'=>false, 'paged'=>false, 'post_mime_type'=>false, 'm'=>false));
    8080            $link = "<a href='" . clean_url($href) . "'$class>$text</a>";
    81             echo "\t<li id='" . attribute_escape("tab-$callback") . "'>$link</li>\n";
     81            echo "\t<li id='" . attr("tab-$callback") . "'>$link</li>\n";
    8282        }
    8383        echo "</ul>\n";
    … …  
    105105    $html = get_image_tag($id, $htmlalt, $title, $align, $size);
    106106
    107     $rel = $rel ? ' rel="attachment wp-att-'.attribute_escape($id).'"' : '';
     107    $rel = $rel ? ' rel="attachment wp-att-'.attr($id).'"' : '';
    108108
    109109    if ( $url )
    … …  
    425425        if ( !empty($attachment['url']) ) {
    426426            if ( strpos($attachment['url'], 'attachment_id') || false !== strpos($attachment['url'], get_permalink($_POST['post_id'])) )
    427                 $rel = " rel='attachment wp-att-".attribute_escape($send_id)."'";
     427                $rel = " rel='attachment wp-att-".attr($send_id)."'";
    428428            $html = "<a href='{$attachment['url']}'$rel>$html</a>";
    429429        }
    … …  
    460460        if ( !empty($src) && !strpos($src, '://') )
    461461            $src = "http://$src";
    462         $alt = attribute_escape($_POST['insertonly']['alt']);
     462        $alt = attr($_POST['insertonly']['alt']);
    463463        if ( isset($_POST['insertonly']['align']) ) {
    464             $align = attribute_escape($_POST['insertonly']['align']);
     464            $align = attr($_POST['insertonly']['align']);
    465465            $class = " class='align$align'";
    466466        }
    … …  
    554554        if ( !empty($href) && !strpos($href, '://') )
    555555            $href = "http://$href";
    556         $title = attribute_escape($_POST['insertonly']['title']);
     556        $title = attr($_POST['insertonly']['title']);
    557557        if ( empty($title) )
    558558            $title = basename($href);
    … …  
    608608        if ( !empty($href) && !strpos($href, '://') )
    609609            $href = "http://$href";
    610         $title = attribute_escape($_POST['insertonly']['title']);
     610        $title = attr($_POST['insertonly']['title']);
    611611        if ( empty($title) )
    612612            $title = basename($href);
    … …  
    662662        if ( !empty($href) && !strpos($href, '://') )
    663663            $href = "http://$href";
    664         $title = attribute_escape($_POST['insertonly']['title']);
     664        $title = attr($_POST['insertonly']['title']);
    665665        if ( empty($title) )
    666666            $title = basename($href);
    … …  
    826826        $url = $link;
    827827
    828     return "<input type='text' class='urlfield' name='attachments[$post->ID][url]' value='" . attribute_escape($url) . "' /><br />
     828    return "<input type='text' class='urlfield' name='attachments[$post->ID][url]' value='" . attr($url) . "' /><br />
    829829                <button type='button' class='button urlnone' title=''>" . __('None') . "</button>
    830                 <button type='button' class='button urlfile' title='" . attribute_escape($file) . "'>" . __('File URL') . "</button>
    831                 <button type='button' class='button urlpost' title='" . attribute_escape($link) . "'>" . __('Post URL') . "</button>
     830                <button type='button' class='button urlfile' title='" . attr($file) . "'>" . __('File URL') . "</button>
     831                <button type='button' class='button urlpost' title='" . attr($link) . "'>" . __('Post URL') . "</button>
    832832";
    833833}
    … …  
    989989            'label'      => __('File URL'),
    990990            'input'      => 'html',
    991             'html'       => "<input type='text' class='urlfield' readonly='readonly' name='attachments[$post->ID][url]' value='" . attribute_escape($image_url) . "' /><br />",
     991            'html'       => "<input type='text' class='urlfield' readonly='readonly' name='attachments[$post->ID][url]' value='" . attr($image_url) . "' /><br />",
    992992            'value'      => isset($edit_post->post_url) ? $edit_post->post_url : '',
    993993            'helps'      => __('Location of the uploaded file.'),
    … …  
    10861086
    10871087    $filename = basename($post->guid);
    1088     $title = attribute_escape($post->post_title);
     1088    $title = attr($post->post_title);
    10891089
    10901090    if ( $_tags = get_the_tags($attachment_id) ) {
    10911091        foreach ( $_tags as $tag )
    10921092            $tags[] = $tag->name;
    1093         $tags = attribute_escape(join(', ', $tags));
     1093        $tags = attr(join(', ', $tags));
    10941094    }
    10951095
    … …  
    10981098        $keys = array_keys(wp_match_mime_types(array_keys($post_mime_types), $post->post_mime_type));
    10991099        $type = array_shift($keys);
    1100         $type = "<input type='hidden' id='type-of-$attachment_id' value='" . attribute_escape( $type ) . "' />";
     1100        $type = "<input type='hidden' id='type-of-$attachment_id' value='" . attr( $type ) . "' />";
    11011101    }
    11021102
    … …  
    11571157    $delete_href = wp_nonce_url("post.php?action=delete-post&amp;post=$attachment_id", 'delete-post_' . $attachment_id);
    11581158    if ( $send )
    1159         $send = "<input type='submit' class='button' name='send[$attachment_id]' value='" . attribute_escape( __( 'Insert into Post' ) ) . "' />";
     1159        $send = "<input type='submit' class='button' name='send[$attachment_id]' value='" . attr( __( 'Insert into Post' ) ) . "' />";
    11601160    if ( $delete )
    11611161        $delete = "<a href=\"#\" class=\"del-link\" onclick=\"document.getElementById('del_attachment_$attachment_id').style.display='block';return false;\">" . __('Delete') . "</a>";
    … …  
    11951195            $item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . wp_specialchars( $field['value'] ) . "</textarea>";
    11961196        } else {
    1197             $item .= "<input type='text' id='$name' name='$name' value='" . attribute_escape( $field['value'] ) . "'" . $aria_required . "/>";
     1197            $item .= "<input type='text' id='$name' name='$name' value='" . attr( $field['value'] ) . "'" . $aria_required . "/>";
    11981198        }
    11991199        if ( !empty($field['helps']) )
    … …  
    12231223
    12241224    foreach ( $hidden_fields as $name => $value )
    1225         $item .= "\t<input type='hidden' name='$name' id='$name' value='" . attribute_escape( $value ) . "' />\n";
     1225        $item .= "\t<input type='hidden' name='$name' id='$name' value='" . attr( $value ) . "' />\n";
    12261226
    12271227    if ( $post->post_parent < 1 && isset($_REQUEST['post_id']) ) {
    … …  
    13041304            button_image_url: '<?php echo includes_url('images/upload.png'); ?>',
    13051305            button_placeholder_id: "flash-browse-button",
    1306             upload_url : "<?php echo attribute_escape( $flash_action_url ); ?>",
     1306            upload_url : "<?php echo attr( $flash_action_url ); ?>",
    13071307            flash_url : "<?php echo includes_url('js/swfupload/swfupload.swf'); ?>",
    13081308            file_post_name: "async-upload",
    … …  
    13511351<?php do_action('pre-html-upload-ui'); ?>
    13521352    <p id="async-upload-wrap">
    1353     <input type="file" name="async-upload" id="async-upload" /> <input type="submit" class="button" name="html-upload" value="<?php echo attribute_escape(__('Upload')); ?>" /> <a href="#" onclick="return top.tb_remove();"><?php _e('Cancel'); ?></a>
     1353    <input type="file" name="async-upload" id="async-upload" /> <input type="submit" class="button" name="html-upload" value="<?php echo attr(__('Upload')); ?>" /> <a href="#" onclick="return top.tb_remove();"><?php _e('Cancel'); ?></a>
    13541354    </p>
    13551355    <div class="clear"></div>
    … …  
    13811381?>
    13821382
    1383 <form enctype="multipart/form-data" method="post" action="<?php echo attribute_escape($form_action_url); ?>" class="media-upload-form type-form validate" id="<?php echo $type; ?>-form">
     1383<form enctype="multipart/form-data" method="post" action="<?php echo attr($form_action_url); ?>" class="media-upload-form type-form validate" id="<?php echo $type; ?>-form">
    13841384<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" />
    13851385<?php wp_nonce_field('media-form'); ?>
    … …  
    14131413?>
    14141414</div>
    1415 <input type="submit" class="button savebutton" name="save" value="<?php echo attribute_escape( __( 'Save all changes' ) ); ?>" />
     1415<input type="submit" class="button savebutton" name="save" value="<?php echo attr( __( 'Save all changes' ) ); ?>" />
    14161416<?php
    14171417}
    … …  
    14371437?>
    14381438
    1439 <form enctype="multipart/form-data" method="post" action="<?php echo attribute_escape($form_action_url); ?>" class="media-upload-form type-form validate" id="<?php echo $type; ?>-form">
     1439<form enctype="multipart/form-data" method="post" action="<?php echo attr($form_action_url); ?>" class="media-upload-form type-form validate" id="<?php echo $type; ?>-form">
    14401440<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" />
    14411441<?php wp_nonce_field('media-form'); ?>
    … …  
    15711571<a href="#" id="clear"><?php _e('Clear'); ?></a>
    15721572</div>
    1573 <form enctype="multipart/form-data" method="post" action="<?php echo attribute_escape($form_action_url); ?>" class="media-upload-form validate" id="gallery-form">
     1573<form enctype="multipart/form-data" method="post" action="<?php echo attr($form_action_url); ?>" class="media-upload-form validate" id="gallery-form">
    15741574<?php wp_nonce_field('media-form'); ?>
    15751575<?php //media_upload_form( $errors ); ?>
    … …  
    15861586
    15871587<p class="ml-submit">
    1588 <input type="submit" class="button savebutton" style="display:none;" name="save" id="save-all" value="<?php echo attribute_escape( __( 'Save all changes' ) ); ?>" />
     1588<input type="submit" class="button savebutton" style="display:none;" name="save" id="save-all" value="<?php echo attr( __( 'Save all changes' ) ); ?>" />
    15891589<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" />
    1590 <input type="hidden" name="type" value="<?php echo attribute_escape( $GLOBALS['type'] ); ?>" />
    1591 <input type="hidden" name="tab" value="<?php echo attribute_escape( $GLOBALS['tab'] ); ?>" />
     1590<input type="hidden" name="type" value="<?php echo attr( $GLOBALS['type'] ); ?>" />
     1591<input type="hidden" name="tab" value="<?php echo attr( $GLOBALS['tab'] ); ?>" />
    15921592</p>
    15931593
    … …  
    16631663
    16641664<p class="ml-submit">
    1665 <input type="button" class="button" style="display:none;" onmousedown="wpgallery.update();" name="insert-gallery" id="insert-gallery" value="<?php echo attribute_escape( __( 'Insert gallery' ) ); ?>" />
    1666 <input type="button" class="button" style="display:none;" onmousedown="wpgallery.update();" name="update-gallery" id="update-gallery" value="<?php echo attribute_escape( __( 'Update gallery settings' ) ); ?>" />
     1665<input type="button" class="button" style="display:none;" onmousedown="wpgallery.update();" name="insert-gallery" id="insert-gallery" value="<?php echo attr( __( 'Insert gallery' ) ); ?>" />
     1666<input type="button" class="button" style="display:none;" onmousedown="wpgallery.update();" name="update-gallery" id="update-gallery" value="<?php echo attr( __( 'Update gallery settings' ) ); ?>" />
    16671667</p>
    16681668</div>
    … …  
    17001700
    17011701<form id="filter" action="" method="get">
    1702 <input type="hidden" name="type" value="<?php echo attribute_escape( $type ); ?>" />
    1703 <input type="hidden" name="tab" value="<?php echo attribute_escape( $tab ); ?>" />
     1702<input type="hidden" name="type" value="<?php echo attr( $type ); ?>" />
     1703<input type="hidden" name="tab" value="<?php echo attr( $tab ); ?>" />
    17041704<input type="hidden" name="post_id" value="<?php echo (int) $post_id; ?>" />
    1705 <input type="hidden" name="post_mime_type" value="<?php echo isset( $_GET['post_mime_type'] ) ? attribute_escape( $_GET['post_mime_type'] ) : ''; ?>" />
     1705<input type="hidden" name="post_mime_type" value="<?php echo isset( $_GET['post_mime_type'] ) ? attr( $_GET['post_mime_type'] ) : ''; ?>" />
    17061706
    17071707<p id="media-search" class="search-box">
    17081708    <label class="hidden" for="media-search-input"><?php _e('Search Media');?>:</label>
    17091709    <input type="text" id="media-search-input" name="s" value="<?php the_search_query(); ?>" />
    1710     <input type="submit" value="<?php echo attribute_escape( __( 'Search Media' ) ); ?>" class="button" />
     1710    <input type="submit" value="<?php echo attr( __( 'Search Media' ) ); ?>" class="button" />
    17111711</p>
    17121712
    … …  
    17871787        $default = '';
    17881788
    1789     echo "<option$default value='" . attribute_escape( $arc_row->yyear . $arc_row->mmonth ) . "'>";
     1789    echo "<option$default value='" . attr( $arc_row->yyear . $arc_row->mmonth ) . "'>";
    17901790    echo wp_specialchars( $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear" );
    17911791    echo "</option>\n";
    … …  
    17951795<?php } ?>
    17961796
    1797 <input type="submit" id="post-query-submit" value="<?php echo attribute_escape( __( 'Filter &#187;' ) ); ?>" class="button-secondary" />
     1797<input type="submit" id="post-query-submit" value="<?php echo attr( __( 'Filter &#187;' ) ); ?>" class="button-secondary" />
    17981798
    17991799</div>
    … …  
    18031803</form>
    18041804
    1805 <form enctype="multipart/form-data" method="post" action="<?php echo attribute_escape($form_action_url); ?>" class="media-upload-form validate" id="library-form">
     1805<form enctype="multipart/form-data" method="post" action="<?php echo attr($form_action_url); ?>" class="media-upload-form validate" id="library-form">
    18061806
    18071807<?php wp_nonce_field('media-form'); ?>
    … …  
    18251825</div>
    18261826<p class="ml-submit">
    1827 <input type="submit" class="button savebutton" name="save" value="<?php echo attribute_escape( __( 'Save all changes' ) ); ?>" />
     1827<input type="submit" class="button savebutton" name="save" value="<?php echo attr( __( 'Save all changes' ) ); ?>" />
    18281828<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" />
    18291829</p>
    … …  
    19071907            <td></td>
    19081908            <td>
    1909                 <input type="button" class="button" id="go_button" style="color:#bbb;" onclick="addExtImage.insert()" value="' . attribute_escape(__('Insert into Post')) . '" />
     1909                <input type="button" class="button" id="go_button" style="color:#bbb;" onclick="addExtImage.insert()" value="' . attr(__('Insert into Post')) . '" />
    19101910            </td>
    19111911        </tr>
    … …  
    19431943            <td></td>
    19441944            <td>
    1945                 <input type="submit" class="button" name="insertonlybutton" value="' . attribute_escape(__('Insert into Post')) . '" />
     1945                <input type="submit" class="button" name="insertonlybutton" value="' . attr(__('Insert into Post')) . '" />
    19461946            </td>
    19471947        </tr>
    … …  
    19781978            <td></td>
    19791979            <td>
    1980                 <input type="submit" class="button" name="insertonlybutton" value="' . attribute_escape(__('Insert into Post')) . '" />
     1980                <input type="submit" class="button" name="insertonlybutton" value="' . attr(__('Insert into Post')) . '" />
    19811981            </td>
    19821982        </tr>
    … …  
    20132013            <td></td>
    20142014            <td>
    2015                 <input type="submit" class="button" name="insertonlybutton" value="' . attribute_escape(__('Insert into Post')) . '" />
     2015                <input type="submit" class="button" name="insertonlybutton" value="' . attr(__('Insert into Post')) . '" />
    20162016            </td>
    20172017        </tr>

  • trunk/wp-admin/includes/plugin-install.php

    r11013 r11109  
    163163            <option value="tag"<?php selected('tag', $type) ?>><?php _x('Tag', 'Plugin Installer') ?></option>
    164164        </select>
    165         <input type="text" name="s" value="<?php echo attribute_escape($term) ?>" />
    166         <input type="submit" name="search" value="<?php echo attribute_escape(__('Search')) ?>" class="button" />
     165        <input type="text" name="s" value="<?php echo attr($term) ?>" />
     166        <input type="submit" name="search" value="<?php echo attr(__('Search')) ?>" class="button" />
    167167    </form><?php
    168168}
    … …  
    335335
    336336                if( isset($plugin['homepage']) )
    337                     $title = '<a target="_blank" href="' . attribute_escape($plugin['homepage']) . '">' . $title . '</a>';
     337                    $title = '<a target="_blank" href="' . attr($plugin['homepage']) . '">' . $title . '</a>';
    338338
    339339                $action_links = array();
    340340                $action_links[] = '<a href="' . admin_url('plugin-install.php?tab=plugin-information&amp;plugin=' . $plugin['slug'] .
    341341                                    '&amp;TB_iframe=true&amp;width=600&amp;height=800') . '" class="thickbox onclick" title="' .
    342                                     attribute_escape($name) . '">' . __('Install') . '</a>';
     342                                    attr($name) . '">' . __('Install') . '</a>';
    343343
    344344                $action_links = apply_filters('plugin_install_action_links', $action_links, $plugin);
    … …  
    349349                <td class="vers">
    350350                    <div class="star-holder" title="<?php printf(_n('(based on %s rating)', '(based on %s ratings)', $plugin['num_ratings']), number_format_i18n($plugin['num_ratings'])) ?>">
    351                         <div class="star star-rating" style="width: <?php echo attribute_escape($plugin['rating']) ?>px"></div>
     351                        <div class="star star-rating" style="width: <?php echo attr($plugin['rating']) ?>px"></div>
    352352                        <div class="star star5"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('5 stars') ?>" /></div>
    353353                        <div class="star star4"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('4 stars') ?>" /></div>
    … …  
    417417        $href = add_query_arg( array('tab' => $tab, 'section' => $section_name) );
    418418        $href = clean_url($href);
    419         $san_title = attribute_escape(sanitize_title_with_dashes($title));
     419        $san_title = attr(sanitize_title_with_dashes($title));
    420420        echo "\t<li><a name='$san_title' target='' href='$href'$class>$title</a></li>\n";
    421421    }
    … …  
    506506        <h2><?php _e('Average Rating') ?></h2>
    507507        <div class="star-holder" title="<?php printf(_n('(based on %s rating)', '(based on %s ratings)', $api->num_ratings), number_format_i18n($api->num_ratings)); ?>">
    508             <div class="star star-rating" style="width: <?php echo attribute_escape($api->rating) ?>px"></div>
     508            <div class="star star-rating" style="width: <?php echo attr($api->rating) ?>px"></div>
    509509            <div class="star star5"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('5 stars') ?>" /></div>
    510510            <div class="star star4"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('4 stars') ?>" /></div>
    … …  
    531531            $content = links_add_target($content, '_blank');
    532532
    533             $san_title = attribute_escape(sanitize_title_with_dashes($title));
     533            $san_title = attr(sanitize_title_with_dashes($title));
    534534
    535535            $display = ( $section_name == $section ) ? 'block' : 'none';

  • trunk/wp-admin/includes/taxonomy.php

    r10906 r11109  
    223223        $tag_names[] = $tag->name;
    224224    $tags_to_edit = join( ',', $tag_names );
    225     $tags_to_edit = attribute_escape( $tags_to_edit );
     225    $tags_to_edit = attr( $tags_to_edit );
    226226    $tags_to_edit = apply_filters( 'terms_to_edit', $tags_to_edit, $taxonomy );
    227227

  • trunk/wp-admin/includes/template.php

    r11073 r11109  
    119119    $edit_link = "categories.php?action=edit&amp;cat_ID=$category->term_id";
    120120    if ( current_user_can( 'manage_categories' ) ) {
    121         $edit = "<a class='row-title' href='$edit_link' title='" . attribute_escape(sprintf(__('Edit "%s"'), $category->name)) . "'>" . attribute_escape( $name ) . '</a><br />';
     121        $edit = "<a class='row-title' href='$edit_link' title='" . attr(sprintf(__('Edit "%s"'), $category->name)) . "'>" . attr( $name ) . '</a><br />';
    122122        $actions = array();
    123123        $actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
    … …  
    258258        <a accesskey="c" href="#inline-edit" title="<?php _e('Cancel'); ?>" class="cancel button-secondary alignleft"><?php _e('Cancel'); ?></a>
    259259        <?php $update_text = ( $is_tag ) ? __( 'Update Tag' ) : __( 'Update Category' ); ?>
    260         <a accesskey="s" href="#inline-edit" title="<?php echo attribute_escape( $update_text ); ?>" class="save button-primary alignright"><?php echo $update_text; ?></a>
     260        <a accesskey="s" href="#inline-edit" title="<?php echo attr( $update_text ); ?>" class="save button-primary alignright"><?php echo $update_text; ?></a>
    261261        <img class="waiting" style="display:none;" src="images/loading.gif" alt="" />
    262262        <span class="error" style="display:none;"></span>
    … …  
    290290    $edit_link = "link-category.php?action=edit&amp;cat_ID=$category->term_id";
    291291    if ( current_user_can( 'manage_categories' ) ) {
    292         $edit = "<a class='row-title' href='$edit_link' title='" . attribute_escape(sprintf(__('Edit "%s"'), $category->name)) . "'>$name</a><br />";
     292        $edit = "<a class='row-title' href='$edit_link' title='" . attr(sprintf(__('Edit "%s"'), $category->name)) . "'>$name</a><br />";
    293293        $actions = array();
    294294        $actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
    … …  
    650650                    break;
    651651                case 'name':
    652                     $out .= '<td ' . $attributes . '><strong><a class="row-title" href="' . $edit_link . '" title="' . attribute_escape(sprintf(__('Edit "%s"'), $name)) . '">' . $name . '</a></strong><br />';
     652                    $out .= '<td ' . $attributes . '><strong><a class="row-title" href="' . $edit_link . '" title="' . attr(sprintf(__('Edit "%s"'), $name)) . '">' . $name . '</a></strong><br />';
    653653                    $actions = array();
    654654                    $actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
    … …  
    12481248            $update_text = ( $is_page ) ? __( 'Update Page' ) : __( 'Update Post' );
    12491249            ?>
    1250             <a accesskey="s" href="#inline-edit" title="<?php _e('Update'); ?>" class="button-primary save alignright"><?php echo attribute_escape( $update_text ); ?></a>
     1250            <a accesskey="s" href="#inline-edit" title="<?php _e('Update'); ?>" class="button-primary save alignright"><?php echo attr( $update_text ); ?></a>
    12511251            <img class="waiting" style="display:none;" src="images/loading.gif" alt="" />
    12521252        <?php } else {
    12531253            $update_text = ( $is_page ) ? __( 'Update Pages' ) : __( 'Update Posts' );
    12541254        ?>
    1255             <input accesskey="s" class="button-primary alignright" type="submit" name="bulk_edit" value="<?php echo attribute_escape( $update_text ); ?>" />
     1255            <input accesskey="s" class="button-primary alignright" type="submit" name="bulk_edit" value="<?php echo attr( $update_text ); ?>" />
    12561256        <?php } ?>
    12571257        <input type="hidden" name="post_view" value="<?php echo $m; ?>" />
    … …  
    12791279        return;
    12801280
    1281     $title = attribute_escape($post->post_title);
     1281    $title = attr($post->post_title);
    12821282
    12831283    echo '
    … …  
    14281428            $attributes = 'class="post-title column-title"' . $style;
    14291429        ?>
    1430         <td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $post->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $title)); ?>"><?php echo $title ?></a><?php } else { echo $title; }; _post_states($post); ?></strong>
     1430        <td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $post->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $title)); ?>"><?php echo $title ?></a><?php } else { echo $title; }; _post_states($post); ?></strong>
    14311431        <?php
    14321432            if ( 'excerpt' == $mode )
    … …  
    14351435            $actions = array();
    14361436            if ( current_user_can('edit_post', $post->ID) ) {
    1437                 $actions['edit'] = '<a href="' . get_edit_post_link($post->ID, true) . '" title="' . attribute_escape(__('Edit this post')) . '">' . __('Edit') . '</a>';
    1438                 $actions['inline hide-if-no-js'] = '<a href="#" class="editinline" title="' . attribute_escape(__('Edit this post inline')) . '">' . __('Quick&nbsp;Edit') . '</a>';
    1439                 $actions['delete'] = "<a class='submitdelete' title='" . attribute_escape(__('Delete this post')) . "' href='" . wp_nonce_url("post.php?action=delete&amp;post=$post->ID", 'delete-post_' . $post->ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $post->post_status) ? __("You are about to delete this draft '%s'\n 'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this post '%s'\n 'Cancel' to stop, 'OK' to delete."), $post->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . "</a>";
     1437                $actions['edit'] = '<a href="' . get_edit_post_link($post->ID, true) . '" title="' . attr(__('Edit this post')) . '">' . __('Edit') . '</a>';
     1438                $actions['inline hide-if-no-js'] = '<a href="#" class="editinline" title="' . attr(__('Edit this post inline')) . '">' . __('Quick&nbsp;Edit') . '</a>';
     1439                $actions['delete'] = "<a class='submitdelete' title='" . attr(__('Delete this post')) . "' href='" . wp_nonce_url("post.php?action=delete&amp;post=$post->ID", 'delete-post_' . $post->ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $post->post_status) ? __("You are about to delete this draft '%s'\n 'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this post '%s'\n 'Cancel' to stop, 'OK' to delete."), $post->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . "</a>";
    14401440            }
    14411441            if ( in_array($post->post_status, array('pending', 'draft')) ) {
    14421442                if ( current_user_can('edit_post', $post->ID) )
    1443                     $actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attribute_escape(sprintf(__('Preview "%s"'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
     1443                    $actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attr(sprintf(__('Preview "%s"'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
    14441444            } else {
    1445                 $actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attribute_escape(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
     1445                $actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attr(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
    14461446            }
    14471447            $actions = apply_filters('post_row_actions', $actions, $post);
    … …  
    16441644        $edit_link = get_edit_post_link( $page->ID );
    16451645        ?>
    1646         <td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $page->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $title)); ?>"><?php echo $pad; echo $title ?></a><?php } else { echo $pad; echo $title; }; _post_states($page); echo isset($parent_name) ? ' | ' . __('Parent Page: ') . wp_specialchars($parent_name) : ''; ?></strong>
     1646        <td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $page->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $title)); ?>"><?php echo $pad; echo $title ?></a><?php } else { echo $pad; echo $title; }; _post_states($page); echo isset($parent_name) ? ' | ' . __('Parent Page: ') . wp_specialchars($parent_name) : ''; ?></strong>
    16471647        <?php
    16481648        $actions = array();
    16491649        if ( current_user_can('edit_page', $page->ID) ) {
    1650             $actions['edit'] = '<a href="' . $edit_link . '" title="' . attribute_escape(__('Edit this page')) . '">' . __('Edit') . '</a>';
     1650            $actions['edit'] = '<a href="' . $edit_link . '" title="' . attr(__('Edit this page')) . '">' . __('Edit') . '</a>';
    16511651            $actions['inline'] = '<a href="#" class="editinline">' . __('Quick&nbsp;Edit') . '</a>';
    1652             $actions['delete'] = "<a class='submitdelete' title='" . attribute_escape(__('Delete this page')) . "' href='" . wp_nonce_url("page.php?action=delete&amp;post=$page->ID", 'delete-page_' . $page->ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $page->post_status) ? __("You are about to delete this draft '%s'\n 'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this page '%s'\n 'Cancel' to stop, 'OK' to delete."), $page->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . "</a>";
     1652            $actions['delete'] = "<a class='submitdelete' title='" . attr(__('Delete this page')) . "' href='" . wp_nonce_url("page.php?action=delete&amp;post=$page->ID", 'delete-page_' . $page->ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $page->post_status) ? __("You are about to delete this draft '%s'\n 'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this page '%s'\n 'Cancel' to stop, 'OK' to delete."), $page->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . "</a>";
    16531653        }
    16541654        if ( in_array($post->post_status, array('pending', 'draft')) ) {
    16551655            if ( current_user_can('edit_page', $page->ID) )
    1656                 $actions['view'] = '<a href="' . get_permalink($page->ID) . '" title="' . attribute_escape(sprintf(__('Preview "%s"'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
     1656                $actions['view'] = '<a href="' . get_permalink($page->ID) . '" title="' . attr(sprintf(__('Preview "%s"'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
    16571657        } else {
    1658             $actions['view'] = '<a href="' . get_permalink($page->ID) . '" title="' . attribute_escape(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
     1658            $actions['view'] = '<a href="' . get_permalink($page->ID) . '" title="' . attr(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
    16591659        }
    16601660        $actions = apply_filters('page_row_actions', $actions, $page);
    … …  
    21152115                <div id="inline-<?php echo $comment->comment_ID; ?>" class="hidden">
    21162116                <textarea class="comment" rows="3" cols="10"><?php echo $comment->comment_content; ?></textarea>
    2117                 <div class="author-email"><?php if ( $user_can ) echo attribute_escape( $comment->comment_author_email ); ?></div>
    2118                 <div class="author"><?php if ( $user_can ) echo attribute_escape( $comment->comment_author ); ?></div>
    2119                 <div class="author-url"><?php echo attribute_escape( $comment->comment_author_url ); ?></div>
     2117                <div class="author-email"><?php if ( $user_can ) echo attr( $comment->comment_author_email ); ?></div>
     2118                <div class="author"><?php if ( $user_can ) echo attr( $comment->comment_author ); ?></div>
     2119                <div class="author-url"><?php echo attr( $comment->comment_author_url ); ?></div>
    21202120                <div class="comment_status"><?php echo $comment->comment_approved; ?></div>
    21212121                </div>
    … …  
    24182418    }
    24192419
    2420     $entry['meta_key'] = attribute_escape($entry['meta_key']);
     2420    $entry['meta_key'] = attr($entry['meta_key']);
    24212421    $entry['meta_value'] = htmlspecialchars($entry['meta_value']); // using a <textarea />
    24222422    $entry['meta_id'] = (int) $entry['meta_id'];
    … …  
    24282428
    24292429    $r .= "\n\t\t<div class='submit'><input name='deletemeta[{$entry['meta_id']}]' type='submit' ";
    2430     $r .= "class='delete:the-list:meta-{$entry['meta_id']}::_ajax_nonce=$delete_nonce deletemeta' tabindex='6' value='".attribute_escape(__( 'Delete' ))."' />";
    2431     $r .= "\n\t\t<input name='updatemeta' type='submit' tabindex='6' value='".attribute_escape(__( 'Update' ))."' class='add:the-list:meta-{$entry['meta_id']}::_ajax_nonce=$update_nonce updatemeta' /></div>";
     2430    $r .= "class='delete:the-list:meta-{$entry['meta_id']}::_ajax_nonce=$delete_nonce deletemeta' tabindex='6' value='".attr(__( 'Delete' ))."' />";
     2431    $r .= "\n\t\t<input name='updatemeta' type='submit' tabindex='6' value='".attr(__( 'Update' ))."' class='add:the-list:meta-{$entry['meta_id']}::_ajax_nonce=$update_nonce updatemeta' /></div>";
    24322432    $r .= wp_nonce_field( 'change-meta', '_ajax_nonce', false, false );
    24332433    $r .= "</td>";
    … …  
    24732473
    24742474    foreach ( $keys as $key ) {
    2475         $key = attribute_escape( $key );
     2475        $key = attr( $key );
    24762476        echo "\n<option value='$key'>$key</option>";
    24772477    }
    … …  
    27832783    else :
    27842784?>
    2785 <form enctype="multipart/form-data" id="import-upload-form" method="post" action="<?php echo attribute_escape($action) ?>">
     2785<form enctype="multipart/form-data" id="import-upload-form" method="post" action="<?php echo attr($action) ?>">
    27862786<p>
    27872787<?php wp_nonce_field('import-upload'); ?>
    … …  
    28062806function wp_remember_old_slug() {
    28072807    global $post;
    2808     $name = attribute_escape($post->post_name); // just in case
     2808    $name = attr($post->post_name); // just in case
    28092809    if ( strlen($name) )
    28102810        echo '<input type="hidden" id="wp-old-slug" name="wp-old-slug" value="' . $name . '" />';
    … …  
    31723172 * Display the post password.
    31733173 *
    3174  * The password is passed through {@link attribute_escape()} to ensure that it
     3174 * The password is passed through {@link attr()} to ensure that it
    31753175 * is safe for placing in an html attribute.
    31763176 *
    3177  * @uses attribute_escape
     3177 * @uses attr
    31783178 * @since 2.7.0
    31793179 */
    31803180function the_post_password() {
    31813181    global $post;
    3182     if ( isset( $post->post_password ) ) echo attribute_escape( $post->post_password );
     3182    if ( isset( $post->post_password ) ) echo attr( $post->post_password );
    31833183}
    31843184
    … …  
    32983298 * should only be used when {@link the_search_query()} cannot.
    32993299 *
    3300  * @uses attribute_escape
     3300 * @uses attr
    33013301 * @since 2.7.0
    33023302 *
    33033303 */
    33043304function _admin_search_query() {
    3305     echo isset($_GET['s']) ? attribute_escape( stripslashes( $_GET['s'] ) ) : '';
     3305    echo isset($_GET['s']) ? attr( stripslashes( $_GET['s'] ) ) : '';
    33063306}
    33073307

  • trunk/wp-admin/includes/theme-install.php

    r11013 r11109  
    159159    <option value="tag" <?php selected('tag', $type) ?>><?php _e('Tag'); ?></option>
    160160    </select>
    161     <input type="text" name="s" size="30" value="<?php echo attribute_escape($term) ?>" />
    162     <input type="submit" name="search" value="<?php echo attribute_escape(__('Search')); ?>" class="button" />
     161    <input type="text" name="s" size="30" value="<?php echo attr($term) ?>" />
     162    <input type="submit" name="search" value="<?php echo attr(__('Search')); ?>" class="button" />
    163163</form>
    164164<?php
    … …  
    203203                $feature_name = $trans[$feature];
    204204            $feature_name = wp_specialchars( $feature_name );
    205             $feature = attribute_escape($feature);
     205            $feature = attr($feature);
    206206?>
    207207
    … …  
    219219</div>
    220220<br class="clear" />
    221 <input type="submit" name="search" value="<?php echo attribute_escape(__('Find Themes')); ?>" class="button" />
     221<input type="submit" name="search" value="<?php echo attr(__('Find Themes')); ?>" class="button" />
    222222</form>
    223223<?php
    … …  
    302302        $actions = array();
    303303        $actions[] = '<a href="' . admin_url('theme-install.php?tab=theme-information&amp;theme=' . $theme->slug .
    304                                         '&amp;TB_iframe=true&amp;tbWidth=500&amp;tbHeight=350') . '" class="thickbox thickbox-preview onclick" title="' . attribute_escape(sprintf(__('Install "%s"'), $name)) . '">' . __('Install') . '</a>';
    305         $actions[] = '<a href="' . $preview_link . '" class="thickbox thickbox-preview onclick previewlink" title="' . attribute_escape(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>';
     304                                        '&amp;TB_iframe=true&amp;tbWidth=500&amp;tbHeight=350') . '" class="thickbox thickbox-preview onclick" title="' . attr(sprintf(__('Install "%s"'), $name)) . '">' . __('Install') . '</a>';
     305        $actions[] = '<a href="' . $preview_link . '" class="thickbox thickbox-preview onclick previewlink" title="' . attr(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>';
    306306        $actions = apply_filters('theme_install_action_links', $actions, $theme);
    307307    }
    … …  
    311311<a class='thickbox thickbox-preview screenshot'
    312312    href='<? echo clean_url($preview_link); ?>'
    313     title='<?php echo attribute_escape(sprintf(__('Preview "%s"'), $name)); ?>'>
     313    title='<?php echo attr(sprintf(__('Preview "%s"'), $name)); ?>'>
    314314<img src='<?php echo clean_url($theme->screenshot_url); ?>' width='150' />
    315315</a>
    … …  
    332332<?php endif; ?>
    333333<div class="star-holder" title="<?php printf(_n('(based on %s rating)', '(based on %s ratings)', $theme->num_ratings), number_format_i18n($theme->num_ratings)) ?>">
    334     <div class="star star-rating" style="width: <?php echo attribute_escape($theme->rating) ?>px"></div>
     334    <div class="star star-rating" style="width: <?php echo attr($theme->rating) ?>px"></div>
    335335    <div class="star star5"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('5 stars') ?>" /></div>
    336336    <div class="star star4"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('4 stars') ?>" /></div>

  • trunk/wp-admin/includes/user.php

    r11096 r11109  
    367367function get_user_to_edit( $user_id ) {
    368368    $user = new WP_User( $user_id );
    369     $user->user_login   = attribute_escape($user->user_login);
    370     $user->user_email   = attribute_escape($user->user_email);
     369    $user->user_login   = attr($user->user_login);
     370    $user->user_email   = attr($user->user_email);
    371371    $user->user_url     = clean_url($user->user_url);
    372     $user->first_name   = attribute_escape($user->first_name);
    373     $user->last_name    = attribute_escape($user->last_name);
    374     $user->display_name = attribute_escape($user->display_name);
    375     $user->nickname     = attribute_escape($user->nickname);
    376     $user->aim          = isset( $user->aim ) && !empty( $user->aim ) ? attribute_escape($user->aim) : '';
    377     $user->yim          = isset( $user->yim ) && !empty( $user->yim ) ? attribute_escape($user->yim) : '';
    378     $user->jabber       = isset( $user->jabber ) && !empty( $user->jabber ) ? attribute_escape($user->jabber) : '';
     372    $user->first_name   = attr($user->first_name);
     373    $user->last_name    = attr($user->last_name);
     374    $user->display_name = attr($user->display_name);
     375    $user->nickname     = attr($user->nickname);
     376    $user->aim          = isset( $user->aim ) && !empty( $user->aim ) ? attr($user->aim) : '';
     377    $user->yim          = isset( $user->yim ) && !empty( $user->yim ) ? attr($user->yim) : '';
     378    $user->jabber       = isset( $user->jabber ) && !empty( $user->jabber ) ? attr($user->jabber) : '';
    379379    $user->description  = isset( $user->description ) && !empty( $user->description ) ? wp_specialchars($user->description) : '';
    380380

  • trunk/wp-admin/link-manager.php

    r10943 r11109  
    166166    foreach ($links as $link) {
    167167        $link = sanitize_bookmark($link);
    168         $link->link_name = attribute_escape($link->link_name);
     168        $link->link_name = attr($link->link_name);
    169169        $link->link_category = wp_get_link_cats($link->link_id);
    170170        $short_url = str_replace('http://', '', $link->link_url);
    … …  
    195195                case 'name':
    196196
    197                     echo "<td $attributes><strong><a class='row-title' href='$edit_link' title='" . attribute_escape(sprintf(__('Edit "%s"'), $link->link_name)) . "'>$link->link_name</a></strong><br />";
     197                    echo "<td $attributes><strong><a class='row-title' href='$edit_link' title='" . attr(sprintf(__('Edit "%s"'), $link->link_name)) . "'>$link->link_name</a></strong><br />";
    198198                    $actions = array();
    199199                    $actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';

  • trunk/wp-admin/load-scripts.php

    r11013 r11109  
    3636 * @ignore
    3737 */
    38 function attribute_escape() {}
     38function attr() {}
    3939
    4040/**

  • trunk/wp-admin/load-styles.php

    r11013 r11109  
    3636 * @ignore
    3737 */
    38 function attribute_escape() {}
     38function attr() {}
    3939
    4040/**

  • trunk/wp-admin/media-upload.php

    r10150 r11109  
    7979    <div id="media-items"> </div>
    8080    <p>
    81     <input type="submit" class="button savebutton" name="save" value="<?php echo attribute_escape( __( 'Save all changes' ) ); ?>" />
     81    <input type="submit" class="button savebutton" name="save" value="<?php echo attr( __( 'Save all changes' ) ); ?>" />
    8282    </p>
    8383    </form>

  • trunk/wp-admin/menu.php

    r11092 r11109  
    4040            continue;
    4141
    42         $submenu['edit.php'][$i] = array( attribute_escape($tax->label), 'manage_categories', 'edit-tags.php?taxonomy=' . $tax->name );
     42        $submenu['edit.php'][$i] = array( attr($tax->label), 'manage_categories', 'edit-tags.php?taxonomy=' . $tax->name );
    4343        ++$i;
    4444    }

  • trunk/wp-admin/options-discussion.php

    r10689 r11109  
    5555<label for="close_comments_for_old_posts">
    5656<input name="close_comments_for_old_posts" type="checkbox" id="close_comments_for_old_posts" value="1" <?php checked('1', get_option('close_comments_for_old_posts')); ?> />
    57 <?php printf( __('Automatically close comments on articles older than %s days'), '</label><input name="close_comments_days_old" type="text" id="close_comments_days_old" value="' . attribute_escape(get_option('close_comments_days_old')) . '" class="small-text" />') ?>
     57<?php printf( __('Automatically close comments on articles older than %s days'), '</label><input name="close_comments_days_old" type="text" id="close_comments_days_old" value="' . attr(get_option('close_comments_days_old')) . '" class="small-text" />') ?>
    5858<br />
    5959<label for="thread_comments">
    … …  
    8484$default_comments_page .= '>' . __('first') . '</option></select>';
    8585
    86 printf( __('Break comments into pages with %1$s comments per page and the %2$s page displayed by default'), '</label><label for="comments_per_page"><input name="comments_per_page" type="text" id="comments_per_page" value="' . attribute_escape(get_option('comments_per_page')) . '" class="small-text" />', $default_comments_page );
     86printf( __('Break comments into pages with %1$s comments per page and the %2$s page displayed by default'), '</label><label for="comments_per_page"><input name="comments_per_page" type="text" id="comments_per_page" value="' . attr(get_option('comments_per_page')) . '" class="small-text" />', $default_comments_page );
    8787
    8888?></label>

  • trunk/wp-admin/options-general.php

    r10971 r11109  
    211211
    212212    foreach ( $date_formats as $format ) {
    213         echo "\t<label title='" . attribute_escape($format) . "'><input type='radio' name='date_format' value='" . attribute_escape($format) . "'";
     213        echo "\t<label title='" . attr($format) . "'><input type='radio' name='date_format' value='" . attr($format) . "'";
    214214        if ( get_option('date_format') === $format ) { // checked() uses "==" rather than "==="
    215215            echo " checked='checked'";
    … …  
    221221    echo '  <label><input type="radio" name="date_format" id="date_format_custom_radio" value="\c\u\s\t\o\m"';
    222222    checked( $custom );
    223     echo '/> ' . __('Custom:') . ' </label><input type="text" name="date_format_custom" value="' . attribute_escape( get_option('date_format') ) . '" class="small-text" /> ' . date_i18n( get_option('date_format') ) . "\n";
     223    echo '/> ' . __('Custom:') . ' </label><input type="text" name="date_format_custom" value="' . attr( get_option('date_format') ) . '" class="small-text" /> ' . date_i18n( get_option('date_format') ) . "\n";
    224224
    225225    echo "\t<p>" . __('<a href="http://codex.wordpress.org/Formatting_Date_and_Time">Documentation on date formatting</a>. Click &quot;Save Changes&quot; to update sample output.') . "</p>\n";
    … …  
    243243
    244244    foreach ( $time_formats as $format ) {
    245         echo "\t<label title='" . attribute_escape($format) . "'><input type='radio' name='time_format' value='" . attribute_escape($format) . "'";
     245        echo "\t<label title='" . attr($format) . "'><input type='radio' name='time_format' value='" . attr($format) . "'";
    246246        if ( get_option('time_format') === $format ) { // checked() uses "==" rather than "==="
    247247            echo " checked='checked'";
    … …  
    253253    echo '  <label><input type="radio" name="time_format" id="time_format_custom_radio" value="\c\u\s\t\o\m"';
    254254    checked( $custom );
    255     echo '/> ' . __('Custom:') . ' </label><input type="text" name="time_format_custom" value="' . attribute_escape( get_option('time_format') ) . '" class="small-text" /> ' . date_i18n( get_option('time_format') ) . "\n";
     255    echo '/> ' . __('Custom:') . ' </label><input type="text" name="time_format_custom" value="' . attr( get_option('time_format') ) . '" class="small-text" /> ' . date_i18n( get_option('time_format') ) . "\n";
    256256?>
    257257    </fieldset>

  • trunk/wp-admin/options-misc.php

    r11046 r11109  
    2828<tr valign="top">
    2929<th scope="row"><label for="upload_path"><?php _e('Store uploads in this folder'); ?></label></th>
    30 <td><input name="upload_path" type="text" id="upload_path" value="<?php echo attribute_escape(str_replace(ABSPATH, '', get_option('upload_path'))); ?>" class="regular-text code" />
     30<td><input name="upload_path" type="text" id="upload_path" value="<?php echo attr(str_replace(ABSPATH, '', get_option('upload_path'))); ?>" class="regular-text code" />
    3131<span class="setting-description"><?php _e('Default is <code>wp-content/uploads</code>'); ?></span>
    3232</td>
    … …  
    3535<tr valign="top">
    3636<th scope="row"><label for="upload_url_path"><?php _e('Full URL path to files'); ?></label></th>
    37 <td><input name="upload_url_path" type="text" id="upload_url_path" value="<?php echo attribute_escape( get_option('upload_url_path')); ?>" class="regular-text code" />
     37<td><input name="upload_url_path" type="text" id="upload_url_path" value="<?php echo attr( get_option('upload_url_path')); ?>" class="regular-text code" />
    3838<span class="setting-description"><?php _e('Configuring this is optional. By default, it should be blank.'); ?></span>
    3939</td>

  • trunk/wp-admin/options-permalink.php

    r10150 r11109  
    174174        </th>
    175175        <td>
    176             <input name="permalink_structure" id="permalink_structure" type="text" value="<?php echo attribute_escape($permalink_structure); ?>" class="regular-text code" />
     176            <input name="permalink_structure" id="permalink_structure" type="text" value="<?php echo attr($permalink_structure); ?>" class="regular-text code" />
    177177        </td>
    178178    </tr>
    … …  
    189189    <tr>
    190190        <th><label for="category_base"><?php _e('Category base'); ?></label></th>
    191         <td><input name="category_base" id="category_base" type="text" value="<?php echo attribute_escape($category_base); ?>" class="regular-text code" /></td>
     191        <td><input name="category_base" id="category_base" type="text" value="<?php echo attr($category_base); ?>" class="regular-text code" /></td>
    192192    </tr>
    193193    <tr>
    194194        <th><label for="tag_base"><?php _e('Tag base'); ?></label></th>
    195         <td><input name="tag_base" id="tag_base" type="text" value="<?php echo attribute_escape($tag_base); ?>" class="regular-text code" /></td>
     195        <td><input name="tag_base" id="tag_base" type="text" value="<?php echo attr($tag_base); ?>" class="regular-text code" /></td>
    196196    </tr>
    197197    <?php do_settings_fields('permalink', 'optional'); ?>

  • trunk/wp-admin/options.php

    r10964 r11109  
    100100foreach ( (array) $options as $option) :
    101101    $disabled = '';
    102     $option->option_name = attribute_escape($option->option_name);
     102    $option->option_name = attr($option->option_name);
    103103    if ( is_serialized($option->option_value) ) {
    104104        if ( is_serialized_string($option->option_value) ) {
    … …  
    123123
    124124    if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>" . wp_specialchars($value) . "</textarea>";
    125     else echo "<input class='regular-text $class' type='text' name='$option->option_name' id='$option->option_name' value='" . attribute_escape($value) . "'$disabled />";
     125    else echo "<input class='regular-text $class' type='text' name='$option->option_name' id='$option->option_name' value='" . attr($value) . "'$disabled />";
    126126
    127127    echo "</td>

  • trunk/wp-admin/plugin-editor.php

    r10879 r11109  
    117117            $docs_select .= '<option value="">' . __( 'Function Name...' ) . '</option>';
    118118            foreach ( $functions as $function) {
    119                 $docs_select .= '<option value="' . attribute_escape( $function ) . '">' . htmlspecialchars( $function ) . '()</option>';
     119                $docs_select .= '<option value="' . attr( $function ) . '">' . htmlspecialchars( $function ) . '()</option>';
    120120            }
    121121            $docs_select .= '</select>';
    … …  
    133133    <?php
    134134        if ( wp_verify_nonce($_GET['_error_nonce'], 'plugin-activation-error_' . $file) ) { ?>
    135     <iframe style="border:0" width="100%" height="70px" src="<?php bloginfo('wpurl'); ?>/wp-admin/plugins.php?action=error_scrape&amp;plugin=<?php echo attribute_escape($file); ?>&amp;_wpnonce=<?php echo attribute_escape($_GET['_error_nonce']); ?>"></iframe>
     135    <iframe style="border:0" width="100%" height="70px" src="<?php bloginfo('wpurl'); ?>/wp-admin/plugins.php?action=error_scrape&amp;plugin=<?php echo attr($file); ?>&amp;_wpnonce=<?php echo attr($_GET['_error_nonce']); ?>"></iframe>
    136136    <?php } ?>
    137137</div>
    … …  
    151151        else
    152152            $selected = '';
    153         $plugin_name = attribute_escape($plugin_name);
    154         $plugin_key = attribute_escape($plugin_key);
     153        $plugin_name = attr($plugin_name);
     154        $plugin_key = attr($plugin_key);
    155155        echo "\n\t<option value=\"$plugin_key\" $selected>$plugin_name</option>";
    156156    }
    … …  
    209209        </div>
    210210        <?php if ( count( $functions ) ) : ?>
    211         <div id="documentation"><label for="docs-list"><?php _e('Documentation:') ?></label> <?php echo $docs_select ?> <input type="button" class="button" value=" <?php echo attribute_escape(__( 'Lookup' )) ?> " onclick="if ( '' != jQuery('#docs-list').val() ) { window.open( 'http://api.wordpress.org/core/handbook/1.0/?function=' + escape( jQuery( '#docs-list' ).val() ) + '&locale=<?php echo urlencode( get_locale() ) ?>&version=<?php echo urlencode( $wp_version ) ?>&redirect=true'); }" /></div>
     211        <div id="documentation"><label for="docs-list"><?php _e('Documentation:') ?></label> <?php echo $docs_select ?> <input type="button" class="button" value=" <?php echo attr(__( 'Lookup' )) ?> " onclick="if ( '' != jQuery('#docs-list').val() ) { window.open( 'http://api.wordpress.org/core/handbook/1.0/?function=' + escape( jQuery( '#docs-list' ).val() ) + '&locale=<?php echo urlencode( get_locale() ) ?>&version=<?php echo urlencode( $wp_version ) ?>&redirect=true'); }" /></div>
    212212        <?php endif; ?>
    213213<?php if ( is_writeable($real_file) ) : ?>

  • trunk/wp-admin/plugins.php

    r11055 r11109  
    140140                    <?php
    141141                        foreach ( (array)$plugins as $plugin )
    142                             echo '<input type="hidden" name="checked[]" value="' . attribute_escape($plugin) . '" />';
     142                            echo '<input type="hidden" name="checked[]" value="' . attr($plugin) . '" />';
    143143                    ?>
    144144                    <?php wp_nonce_field('bulk-manage-plugins') ?>
    … …  
    195195    <?php
    196196        if ( wp_verify_nonce($_GET['_error_nonce'], 'plugin-activation-error_' . $plugin) ) { ?>
    197     <iframe style="border:0" width="100%" height="70px" src="<?php echo admin_url('plugins.php?action=error_scrape&amp;plugin=' . attribute_escape($plugin) . '&amp;_wpnonce=' . attribute_escape($_GET['_error_nonce'])); ?>"></iframe>
     197    <iframe style="border:0" width="100%" height="70px" src="<?php echo admin_url('plugins.php?action=error_scrape&amp;plugin=' . attr($plugin) . '&amp;_wpnonce=' . attr($_GET['_error_nonce'])); ?>"></iframe>
    198198    <?php
    199199        }
    … …  
    370370        echo "
    371371    <tr class='$class'>
    372         <th scope='row' class='check-column'><input type='checkbox' name='checked[]' value='" . attribute_escape($plugin_file) . "' /></th>
     372        <th scope='row' class='check-column'><input type='checkbox' name='checked[]' value='" . attr($plugin_file) . "' /></th>
    373373        <td class='plugin-title'><strong>{$plugin_data['Title']}</strong>";
    374374        $i = 0;
    … …  
    433433<form method="post" action="<?php echo admin_url('plugins.php') ?>">
    434434<?php wp_nonce_field('bulk-manage-plugins') ?>
    435 <input type="hidden" name="plugin_status" value="<?php echo attribute_escape($status) ?>" />
    436 <input type="hidden" name="paged" value="<?php echo attribute_escape($page) ?>" />
     435<input type="hidden" name="plugin_status" value="<?php echo attr($status) ?>" />
     436<input type="hidden" name="paged" value="<?php echo attr($page) ?>" />
    437437
    438438<ul class="subsubsub">

  • trunk/wp-admin/press-this.php

    r11013 r11109  
    136136        <div class="titlediv">
    137137        <div class="titlewrap">
    138             <input id="this_photo_description" name="photo_description" class="tbtitle text" onkeypress="if(event.keyCode==13) image_selector();" value="<?php echo attribute_escape($title);?>"/>
    139         </div>
    140         </div>
    141 
    142         <p class="centered"><input type="hidden" name="this_photo" value="<?php echo attribute_escape($image); ?>" id="this_photo" />
    143             <a href="#" class="select"><img src="<?php echo clean_url($image); ?>" alt="<?php echo attribute_escape(__('Click to insert.')); ?>" title="<?php echo attribute_escape(__('Click to insert.')); ?>" /></a></p>
     138            <input id="this_photo_description" name="photo_description" class="tbtitle text" onkeypress="if(event.keyCode==13) image_selector();" value="<?php echo attr($title);?>"/>
     139        </div>
     140        </div>
     141
     142        <p class="centered"><input type="hidden" name="this_photo" value="<?php echo attr($image); ?>" id="this_photo" />
     143            <a href="#" class="select"><img src="<?php echo clean_url($image); ?>" alt="<?php echo attr(__('Click to insert.')); ?>" title="<?php echo attr(__('Click to insert.')); ?>" /></a></p>
    144144
    145145        <p id="options"><a href="#" class="select button"><?php _e('Insert Image'); ?></a> <a href="#" class="cancel button"><?php _e('Cancel'); ?></a></p>
    … …  
    169169        <div id="titlediv">
    170170            <div class="titlewrap">
    171             <input id="this_photo_description" name="photo_description" class="tbtitle text" onkeypress="if(event.keyCode==13) image_selector();" value="<?php echo attribute_escape($title);?>"/>
     171            <input id="this_photo_description" name="photo_description" class="tbtitle text" onkeypress="if(event.keyCode==13) image_selector();" value="<?php echo attr($title);?>"/>
    172172            </div>
    173173        </div>
    … …  
    378378        switch(tab_name) {
    379379            case 'video' :
    380                 jQuery('#extra_fields').load('<?php echo clean_url($_SERVER['PHP_SELF']); ?>', { ajax: 'video', s: '<?php echo attribute_escape($selection); ?>'}, function() {
     380                jQuery('#extra_fields').load('<?php echo clean_url($_SERVER['PHP_SELF']); ?>', { ajax: 'video', s: '<?php echo attr($selection); ?>'}, function() {
    381381                    <?php
    382382                    $content = '';
    … …  
    517517        <div id="titlediv">
    518518            <div class="titlewrap">
    519                 <input name="title" id="title" class="text" value="<?php echo attribute_escape($title);?>"/>
     519                <input name="title" id="title" class="text" value="<?php echo attr($title);?>"/>
    520520            </div>
    521521        </div>

  • trunk/wp-admin/theme-editor.php

    r10835 r11109  
    126126    if ($theme_name == $theme) $selected = " selected='selected'";
    127127    else $selected = '';
    128     $theme_name = attribute_escape($theme_name);
     128    $theme_name = attr($theme_name);
    129129    echo "\n\t<option value=\"$theme_name\" $selected>$theme_name</option>";
    130130}

  • trunk/wp-admin/themes.php

    r11008 r11109  
    189189    $preview_link = clean_url( get_option('home') . '/');
    190190    $preview_link = htmlspecialchars( add_query_arg( array('preview' => 1, 'template' => $template, 'stylesheet' => $stylesheet, 'TB_iframe' => 'true' ), $preview_link ) );
    191     $preview_text = attribute_escape( sprintf( __('Preview of "%s"'), $title ) );
     191    $preview_text = attr( sprintf( __('Preview of "%s"'), $title ) );
    192192    $tags = $themes[$theme_name]['Tags'];
    193193    $thickbox_class = 'thickbox thickbox-preview';
    194194    $activate_link = wp_nonce_url("themes.php?action=activate&amp;template=".urlencode($template)."&amp;stylesheet=".urlencode($stylesheet), 'switch-theme_' . $template);
    195     $activate_text = attribute_escape( sprintf( __('Activate "%s"'), $title ) );
     195    $activate_text = attr( sprintf( __('Activate "%s"'), $title ) );
    196196    $actions = array();
    197197    $actions[] = '<a href="' . $activate_link .  '" class="activatelink" title="' . $activate_text . '">' . __('Activate') . '</a>';
    198     $actions[] = '<a href="' . $preview_link . '" class="thickbox thickbox-preview" title="' . attribute_escape(sprintf(__('Preview "%s"'), $theme_name)) . '">' . __('Preview') . '</a>';
     198    $actions[] = '<a href="' . $preview_link . '" class="thickbox thickbox-preview" title="' . attr(sprintf(__('Preview "%s"'), $theme_name)) . '">' . __('Preview') . '</a>';
    199199    if ( current_user_can('update_themes') )
    200200        $actions[] = '<a class="submitdelete deletion" href="' . wp_nonce_url("themes.php?action=delete&amp;template=$stylesheet", 'delete-theme_' . $stylesheet) . '" onclick="' . "if ( confirm('" . js_escape(sprintf( __("You are about to delete this theme '%s'\n  'Cancel' to stop, 'OK' to delete."), $theme_name )) . "') ) {return true;}return false;" . '">' . __('Delete') . '</a>';

  • trunk/wp-admin/tools.php

    r10855 r11109  
    8585    <p><?php _e('Use Press This to clip text, images and videos from any web page. Then edit and add more straight from Press This before you save or publish it in a post on your blog.'); ?></p>
    8686    <p><?php _e('Drag-and-drop the following link to your bookmarks bar or right click it and add it to your favorites for a posting shortcut.') ?></p>
    87     <p class="pressthis"><a href="<?php echo htmlspecialchars( get_shortcut_link() ); ?>" title="<?php echo attribute_escape(__('Press This')) ?>"><?php _e('Press This') ?></a></p>
     87    <p class="pressthis"><a href="<?php echo htmlspecialchars( get_shortcut_link() ); ?>" title="<?php echo attr(__('Press This')) ?>"><?php _e('Press This') ?></a></p>
    8888</div>
    8989<?php endif; ?>

  • trunk/wp-admin/update-core.php

    r10583 r11109  
    4747    if ( 'en_US' != $update->locale )
    4848        if ( !isset( $update->dismissed ) || !$update->dismissed )
    49             echo '<input id="dismiss" class="button" type="submit" value="' . attribute_escape(__('Hide this update')) . '" name="dismiss" />';
     49            echo '<input id="dismiss" class="button" type="submit" value="' . attr(__('Hide this update')) . '" name="dismiss" />';
    5050        else
    51             echo '<input id="undismiss" class="button" type="submit" value="' . attribute_escape(__('Bring back this update')) . '" name="undismiss" />';
     51            echo '<input id="undismiss" class="button" type="submit" value="' . attr(__('Bring back this update')) . '" name="undismiss" />';
    5252    echo '</p>';
    5353    echo '</form>';

  • trunk/wp-admin/upload.php

    r10943 r11109  
    330330        <td class="media-icon"><?php
    331331        if ( $thumb = wp_get_attachment_image( $post->ID, array(80, 60), true ) ) { ?>
    332             <a href="media.php?action=edit&amp;attachment_id=<?php echo $post->ID; ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php echo $thumb; ?></a>
     332            <a href="media.php?action=edit&amp;attachment_id=<?php echo $post->ID; ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php echo $thumb; ?></a>
    333333<?php   } ?></td>
    334334
    335         <td class="media column-media"><strong><a href="<?php echo get_edit_post_link( $post->ID ); ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php echo $att_title; ?></a></strong><br />
     335        <td class="media column-media"><strong><a href="<?php echo get_edit_post_link( $post->ID ); ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php echo $att_title; ?></a></strong><br />
    336336        <?php echo strtoupper(preg_replace('/^.*?\.(\w+)$/', '$1', get_attached_file($post->ID))); ?>
    337337
    … …  
    343343        if ( current_user_can('delete_post', $post->ID) )
    344344            $actions['delete'] = "<a class='submitdelete' href='" . wp_nonce_url("post.php?action=delete&amp;post=$post->ID", 'delete-post_' . $post->ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $post->post_status) ? __("You are about to delete this attachment '%s'\n  'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this attachment '%s'\n  'Cancel' to stop, 'OK' to delete."), $post->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . "</a>";
    345         $actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attribute_escape(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
     345        $actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attr(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
    346346        if ( current_user_can('edit_post', $post->ID) )
    347347            $actions['attach'] = '<a href="#the-list" onclick="findPosts.open(\'media[]\',\''.$post->ID.'\');return false;">'.__('Attach').'</a>';

  • trunk/wp-admin/users.php

    r10943 r11109  
    2929
    3030if ( empty($_REQUEST) ) {
    31     $referer = '<input type="hidden" name="wp_http_referer" value="'. attribute_escape(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
     31    $referer = '<input type="hidden" name="wp_http_referer" value="'. attr(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
    3232} elseif ( isset($_REQUEST['wp_http_referer']) ) {
    3333    $redirect = remove_query_arg(array('wp_http_referer', 'updated', 'delete_count'), stripslashes($_REQUEST['wp_http_referer']));
    34     $referer = '<input type="hidden" name="wp_http_referer" value="' . attribute_escape($redirect) . '" />';
     34    $referer = '<input type="hidden" name="wp_http_referer" value="' . attr($redirect) . '" />';
    3535} else {
    3636    $redirect = 'users.php';
    … …  
    292292<p class="search-box">
    293293    <label class="hidden" for="user-search-input"><?php _e( 'Search Users' ); ?>:</label>
    294     <input type="text" id="user-search-input" name="usersearch" value="<?php echo attribute_escape($wp_user_search->search_term); ?>" />
     294    <input type="text" id="user-search-input" name="usersearch" value="<?php echo attr($wp_user_search->search_term); ?>" />
    295295    <input type="submit" value="<?php _e( 'Search Users' ); ?>" class="button" />
    296296</p>
    … …  
    389389    foreach ( array('user_login' => 'user_login', 'first_name' => 'user_firstname', 'last_name' => 'user_lastname', 'email' => 'user_email', 'url' => 'user_uri', 'role' => 'user_role') as $formpost => $var ) {
    390390        $var = 'new_' . $var;
    391         $$var = isset($_REQUEST[$formpost]) ? attribute_escape(stripslashes($_REQUEST[$formpost])) : '';
     391        $$var = isset($_REQUEST[$formpost]) ? attr(stripslashes($_REQUEST[$formpost])) : '';
    392392    }
    393393    unset($name);

  • trunk/wp-admin/widgets.php

    r11041 r11109  
    357357    if ( 'wp_inactive_widgets' == $sidebar )
    358358        continue; ?>
    359     <div id="<?php echo attribute_escape( $sidebar ); ?>" class="widgets-holder-wrap">
     359    <div id="<?php echo attr( $sidebar ); ?>" class="widgets-holder-wrap">
    360360    <h3 class="sidebar-name"><?php echo wp_specialchars( $registered_sidebar['name'] ); ?>
    361361    <span><img src="images/loading-publish.gif" class="ajax-feedback" title="" alt="" /></span></h3>

  • trunk/wp-app.php

    r11108 r11109  
    353353            $this->auth_required( __( 'Sorry, you do not have the right to access this blog.' ) );
    354354
    355         $entries_url = attribute_escape($this->get_entries_url());
    356         $categories_url = attribute_escape($this->get_categories_url());
    357         $media_url = attribute_escape($this->get_attachments_url());
     355        $entries_url = attr($this->get_entries_url());
     356        $categories_url = attr($this->get_categories_url());
     357        $media_url = attr($this->get_attachments_url());
    358358        foreach ($this->media_content_types as $med) {
    359359            $accepted_media_types = $accepted_media_types . "<accept>" . $med . "</accept>";
    … …  
    393393            $this->auth_required( __( 'Sorry, you do not have the right to access this blog.' ) );
    394394
    395         $home = attribute_escape(get_bloginfo_rss('home'));
     395        $home = attr(get_bloginfo_rss('home'));
    396396
    397397        $categories = "";
    398398        $cats = get_categories("hierarchical=0&hide_empty=0");
    399399        foreach ((array) $cats as $cat) {
    400             $categories .= "    <category term=\"" . attribute_escape($cat->name) .  "\" />\n";
     400            $categories .= "    <category term=\"" . attr($cat->name) .  "\" />\n";
    401401}
    402402        $output = <<<EOD
    … …  
    13331333
    13341334        log_app('Status','302: Redirect');
    1335         $escaped_url = attribute_escape($url);
     1335        $escaped_url = attr($url);
    13361336        $content = <<<EOD
    13371337<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

  • trunk/wp-content/themes/classic/comments-popup.php

    r11067 r11109  
    6565<form action="<?php echo get_option('siteurl'); ?>/wp-comments-post.php" method="post" id="commentform">
    6666<?php if ( is_user_logged_in() ) : ?>
    67 <p><?php printf(__('Logged in as %s.'), '<a href="'.get_option('siteurl').'/wp-admin/profile.php">'.$user_identity.'</a>'); ?> <a href="<?php echo wp_logout_url(); ?>" title="<?php echo attribute_escape(__('Log out of this account')); ?>"><?php _e('Log out &raquo;'); ?></a></p>
     67<p><?php printf(__('Logged in as %s.'), '<a href="'.get_option('siteurl').'/wp-admin/profile.php">'.$user_identity.'</a>'); ?> <a href="<?php echo wp_logout_url(); ?>" title="<?php echo attr(__('Log out of this account')); ?>"><?php _e('Log out &raquo;'); ?></a></p>
    6868<?php else : ?>
    6969    <p>
    … …  
    9191    <p>
    9292      <input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
    93       <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($_SERVER["REQUEST_URI"]); ?>" />
     93      <input type="hidden" name="redirect_to" value="<?php echo attr($_SERVER["REQUEST_URI"]); ?>" />
    9494      <input name="submit" type="submit" tabindex="5" value="<?php _e("Say It!"); ?>" />
    9595    </p>

  • trunk/wp-content/themes/classic/comments.php

    r11067 r11109  
    6969<p><textarea name="comment" id="comment" cols="100%" rows="10" tabindex="4"></textarea></p>
    7070
    71 <p><input name="submit" type="submit" id="submit" tabindex="5" value="<?php echo attribute_escape(__('Submit Comment')); ?>" />
     71<p><input name="submit" type="submit" id="submit" tabindex="5" value="<?php echo attr(__('Submit Comment')); ?>" />
    7272<input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
    7373</p>

  • trunk/wp-content/themes/default/comments-popup.php

    r10978 r11109  
    9090    <p>
    9191      <input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
    92       <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($_SERVER["REQUEST_URI"]); ?>" />
     92      <input type="hidden" name="redirect_to" value="<?php echo attr($_SERVER["REQUEST_URI"]); ?>" />
    9393      <input name="submit" type="submit" tabindex="5" value="Say It!" />
    9494    </p>

  • trunk/wp-content/themes/default/functions.php

    r10623 r11109  
    167167    }
    168168    function PopupWindow_populate(contents) {
    169         contents += '<br /><p style="text-align:center;margin-top:0px;"><input type="button" class="button-secondary" value="<?php echo attribute_escape(__('Close Color Picker')); ?>" onclick="cp.hidePopup(\'prettyplease\')"></input></p>';
     169        contents += '<br /><p style="text-align:center;margin-top:0px;"><input type="button" class="button-secondary" value="<?php echo attr(__('Close Color Picker')); ?>" onclick="cp.hidePopup(\'prettyplease\')"></input></p>';
    170170        this.contents = contents;
    171171        this.populated = false;
    … …  
    381381            <form method="post" action="">
    382382                <?php wp_nonce_field('kubrick-header'); ?>
    383                 <div class="zerosize"><input type="submit" name="defaultsubmit" value="<?php echo attribute_escape(__('Save')); ?>" /></div>
    384                     <label for="njfontcolor"><?php _e('Font Color:'); ?></label><input type="text" name="njfontcolor" id="njfontcolor" value="<?php echo attribute_escape(kubrick_header_color()); ?>" /> <?php printf(__('Any CSS color (%s or %s or %s)'), '<code>red</code>', '<code>#FF0000</code>', '<code>rgb(255, 0, 0)</code>'); ?><br />
    385                     <label for="njuppercolor"><?php _e('Upper Color:'); ?></label><input type="text" name="njuppercolor" id="njuppercolor" value="#<?php echo attribute_escape(kubrick_upper_color()); ?>" /> <?php printf(__('HEX only (%s or %s)'), '<code>#FF0000</code>', '<code>#F00</code>'); ?><br />
    386                 <label for="njlowercolor"><?php _e('Lower Color:'); ?></label><input type="text" name="njlowercolor" id="njlowercolor" value="#<?php echo attribute_escape(kubrick_lower_color()); ?>" /> <?php printf(__('HEX only (%s or %s)'), '<code>#FF0000</code>', '<code>#F00</code>'); ?><br />
    387                 <input type="hidden" name="hi" id="hi" value="<?php echo attribute_escape(kubrick_header_image()); ?>" />
    388                 <input type="submit" name="toggledisplay" id="toggledisplay" value="<?php echo attribute_escape(__('Toggle Text')); ?>" />
    389                 <input type="submit" name="defaults" value="<?php echo attribute_escape(__('Use Defaults')); ?>" />
     383                <div class="zerosize"><input type="submit" name="defaultsubmit" value="<?php echo attr(__('Save')); ?>" /></div>
     384                    <label for="njfontcolor"><?php _e('Font Color:'); ?></label><input type="text" name="njfontcolor" id="njfontcolor" value="<?php echo attr(kubrick_header_color()); ?>" /> <?php printf(__('Any CSS color (%s or %s or %s)'), '<code>red</code>', '<code>#FF0000</code>', '<code>rgb(255, 0, 0)</code>'); ?><br />
     385                    <label for="njuppercolor"><?php _e('Upper Color:'); ?></label><input type="text" name="njuppercolor" id="njuppercolor" value="#<?php echo attr(kubrick_upper_color()); ?>" /> <?php printf(__('HEX only (%s or %s)'), '<code>#FF0000</code>', '<code>#F00</code>'); ?><br />
     386                <label for="njlowercolor"><?php _e('Lower Color:'); ?></label><input type="text" name="njlowercolor" id="njlowercolor" value="#<?php echo attr(kubrick_lower_color()); ?>" /> <?php printf(__('HEX only (%s or %s)'), '<code>#FF0000</code>', '<code>#F00</code>'); ?><br />
     387                <input type="hidden" name="hi" id="hi" value="<?php echo attr(kubrick_header_image()); ?>" />
     388                <input type="submit" name="toggledisplay" id="toggledisplay" value="<?php echo attr(__('Toggle Text')); ?>" />
     389                <input type="submit" name="defaults" value="<?php echo attr(__('Use Defaults')); ?>" />
    390390                <input type="submit" class="defbutton" name="submitform" value="&nbsp;&nbsp;<?php _e('Save'); ?>&nbsp;&nbsp;" />
    391391                <input type="hidden" name="action" value="save" />
    … …  
    394394        </div>
    395395        <div id="jsForm">
    396             <form style="display:inline;" method="post" name="hicolor" id="hicolor" action="<?php echo attribute_escape($_SERVER['REQUEST_URI']); ?>">
     396            <form style="display:inline;" method="post" name="hicolor" id="hicolor" action="<?php echo attr($_SERVER['REQUEST_URI']); ?>">
    397397                <?php wp_nonce_field('kubrick-header'); ?>
    398     <input type="button"  class="button-secondary" onclick="tgt=document.getElementById('fontcolor');colorSelect(tgt,'pick1');return false;" name="pick1" id="pick1" value="<?php echo attribute_escape(__('Font Color')); ?>"></input>
    399         <input type="button" class="button-secondary" onclick="tgt=document.getElementById('uppercolor');colorSelect(tgt,'pick2');return false;" name="pick2" id="pick2" value="<?php echo attribute_escape(__('Upper Color')); ?>"></input>
    400         <input type="button" class="button-secondary" onclick="tgt=document.getElementById('lowercolor');colorSelect(tgt,'pick3');return false;" name="pick3" id="pick3" value="<?php echo attribute_escape(__('Lower Color')); ?>"></input>
    401                 <input type="button" class="button-secondary" name="revert" value="<?php echo attribute_escape(__('Revert')); ?>" onclick="kRevert()" />
    402                 <input type="button" class="button-secondary" value="<?php echo attribute_escape(__('Advanced')); ?>" onclick="toggleAdvanced()" />
     398    <input type="button"  class="button-secondary" onclick="tgt=document.getElementById('fontcolor');colorSelect(tgt,'pick1');return false;" name="pick1" id="pick1" value="<?php echo attr(__('Font Color')); ?>"></input>
     399        <input type="button" class="button-secondary" onclick="tgt=document.getElementById('uppercolor');colorSelect(tgt,'pick2');return false;" name="pick2" id="pick2" value="<?php echo attr(__('Upper Color')); ?>"></input>
     400        <input type="button" class="button-secondary" onclick="tgt=document.getElementById('lowercolor');colorSelect(tgt,'pick3');return false;" name="pick3" id="pick3" value="<?php echo attr(__('Lower Color')); ?>"></input>
     401                <input type="button" class="button-secondary" name="revert" value="<?php echo attr(__('Revert')); ?>" onclick="kRevert()" />
     402                <input type="button" class="button-secondary" value="<?php echo attr(__('Advanced')); ?>" onclick="toggleAdvanced()" />
    403403                <input type="hidden" name="action" value="save" />
    404                 <input type="hidden" name="fontdisplay" id="fontdisplay" value="<?php echo attribute_escape(kubrick_header_display()); ?>" />
    405                 <input type="hidden" name="fontcolor" id="fontcolor" value="<?php echo attribute_escape(kubrick_header_color()); ?>" />
    406                 <input type="hidden" name="uppercolor" id="uppercolor" value="<?php echo attribute_escape(kubrick_upper_color()); ?>" />
    407                 <input type="hidden" name="lowercolor" id="lowercolor" value="<?php echo attribute_escape(kubrick_lower_color()); ?>" />
    408                 <input type="hidden" name="headerimage" id="headerimage" value="<?php echo attribute_escape(kubrick_header_image()); ?>" />
    409                 <p class="submit"><input type="submit" name="submitform" class="button-primary" value="<?php echo attribute_escape(__('Update Header')); ?>" onclick="cp.hidePopup('prettyplease')" /></p>
     404                <input type="hidden" name="fontdisplay" id="fontdisplay" value="<?php echo attr(kubrick_header_display()); ?>" />
     405                <input type="hidden" name="fontcolor" id="fontcolor" value="<?php echo attr(kubrick_header_color()); ?>" />
     406                <input type="hidden" name="uppercolor" id="uppercolor" value="<?php echo attr(kubrick_upper_color()); ?>" />
     407                <input type="hidden" name="lowercolor" id="lowercolor" value="<?php echo attr(kubrick_lower_color()); ?>" />
     408                <input type="hidden" name="headerimage" id="headerimage" value="<?php echo attr(kubrick_header_image()); ?>" />
     409                <p class="submit"><input type="submit" name="submitform" class="button-primary" value="<?php echo attr(__('Update Header')); ?>" onclick="cp.hidePopup('prettyplease')" /></p>
    410410            </form>
    411411            <div id="colorPickerDiv" style="z-index: 100;background:#eee;border:1px solid #ccc;position:absolute;visibility:hidden;"> </div>
    … …  
    413413                <form id="jsAdvanced" style="display:none;" action="">
    414414                    <?php wp_nonce_field('kubrick-header'); ?>
    415                     <label for="advfontcolor"><?php _e('Font Color (CSS):'); ?> </label><input type="text" id="advfontcolor" onchange="advUpdate(this.value, 'fontcolor')" value="<?php echo attribute_escape(kubrick_header_color()); ?>" /><br />
    416                     <label for="advuppercolor"><?php _e('Upper Color (HEX):');?> </label><input type="text" id="advuppercolor" onchange="advUpdate(this.value, 'uppercolor')" value="#<?php echo attribute_escape(kubrick_upper_color()); ?>" /><br />
    417                     <label for="advlowercolor"><?php _e('Lower Color (HEX):'); ?> </label><input type="text" id="advlowercolor" onchange="advUpdate(this.value, 'lowercolor')" value="#<?php echo attribute_escape(kubrick_lower_color()); ?>" /><br />
    418                     <input type="button" class="button-secondary" name="default" value="<?php echo attribute_escape(__('Select Default Colors')); ?>" onclick="kDefaults()" /><br />
    419                     <input type="button" class="button-secondary" onclick="toggleDisplay();return false;" name="pick" id="pick" value="<?php echo attribute_escape(__('Toggle Text Display')); ?>"></input><br />
     415                    <label for="advfontcolor"><?php _e('Font Color (CSS):'); ?> </label><input type="text" id="advfontcolor" onchange="advUpdate(this.value, 'fontcolor')" value="<?php echo attr(kubrick_header_color()); ?>" /><br />
     416                    <label for="advuppercolor"><?php _e('Upper Color (HEX):');?> </label><input type="text" id="advuppercolor" onchange="advUpdate(this.value, 'uppercolor')" value="#<?php echo attr(kubrick_upper_color()); ?>" /><br />
     417                    <label for="advlowercolor"><?php _e('Lower Color (HEX):'); ?> </label><input type="text" id="advlowercolor" onchange="advUpdate(this.value, 'lowercolor')" value="#<?php echo attr(kubrick_lower_color()); ?>" /><br />
     418                    <input type="button" class="button-secondary" name="default" value="<?php echo attr(__('Select Default Colors')); ?>" onclick="kDefaults()" /><br />
     419                    <input type="button" class="button-secondary" onclick="toggleDisplay();return false;" name="pick" id="pick" value="<?php echo attr(__('Toggle Text Display')); ?>"></input><br />
    420420                </form>
    421421            </div>

  • trunk/wp-includes/author-template.php

    r10810 r11109  
    422422        '<a href="%1$s" title="%2$s">%3$s</a>',
    423423        get_author_posts_url( $authordata->ID, $authordata->user_nicename ),
    424         sprintf( __( 'Posts by %s' ), attribute_escape( get_the_author() ) ),
     424        sprintf( __( 'Posts by %s' ), attr( get_the_author() ) ),
    425425        get_the_author()
    426426    );
    … …  
    545545                $link = $name;
    546546        } else {
    547             $link = '<a href="' . get_author_posts_url($author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), attribute_escape($author->display_name)) . '">' . $name . '</a>';
     547            $link = '<a href="' . get_author_posts_url($author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), attr($author->display_name)) . '">' . $name . '</a>';
    548548
    549549            if ( (! empty($feed_image)) || (! empty($feed)) ) {

  • trunk/wp-includes/bookmark-template.php

    r10712 r11109  
    7373            $the_link = clean_url($bookmark->link_url);
    7474
    75         $desc = attribute_escape(sanitize_bookmark_field('link_description', $bookmark->link_description, $bookmark->link_id, 'display'));
    76         $name = attribute_escape(sanitize_bookmark_field('link_name', $bookmark->link_name, $bookmark->link_id, 'display'));
     75        $desc = attr(sanitize_bookmark_field('link_description', $bookmark->link_description, $bookmark->link_id, 'display'));
     76        $name = attr(sanitize_bookmark_field('link_name', $bookmark->link_name, $bookmark->link_id, 'display'));
    7777        $title = $desc;
    7878

  • trunk/wp-includes/bookmark.php

    r11064 r11109  
    346346            $value = format_to_edit($value);
    347347        } else {
    348             $value = attribute_escape($value);
     348            $value = attr($value);
    349349        }
    350350    } else if ( 'db' == $context ) {
    … …  
    356356
    357357    if ( 'attribute' == $context )
    358         $value = attribute_escape($value);
     358        $value = attr($value);
    359359    else if ( 'js' == $context )
    360360        $value = js_escape($value);

  • trunk/wp-includes/category-template.php

    r11037 r11109  
    662662        $tag_id = isset($tags[ $key ]->id) ? $tags[ $key ]->id : $key;
    663663        $tag_name = $tags[ $key ]->name;
    664         $a[] = "<a href='$tag_link' class='tag-link-$tag_id' title='" . attribute_escape( $topic_count_text_callback( $count ) ) . "'$rel style='font-size: " .
     664        $a[] = "<a href='$tag_link' class='tag-link-$tag_id' title='" . attr( $topic_count_text_callback( $count ) ) . "'$rel style='font-size: " .
    665665            ( $smallest + ( ( $count - $min_count ) * $font_step ) )
    666666            . "$unit;'>$tag_name</a>";

  • trunk/wp-includes/class.wp-styles.php

    r10918 r11109  
    4949
    5050        if ( isset($this->registered[$handle]->args) )
    51             $media = attribute_escape( $this->registered[$handle]->args );
     51            $media = attr( $this->registered[$handle]->args );
    5252        else
    5353            $media = 'all';
    … …  
    5555        $href = $this->_css_href( $this->registered[$handle]->src, $ver, $handle );
    5656        $rel = isset($this->registered[$handle]->extra['alt']) && $this->registered[$handle]->extra['alt'] ? 'alternate stylesheet' : 'stylesheet';
    57         $title = isset($this->registered[$handle]->extra['title']) ? "title='" . attribute_escape( $this->registered[$handle]->extra['title'] ) . "'" : '';
     57        $title = isset($this->registered[$handle]->extra['title']) ? "title='" . attr( $this->registered[$handle]->extra['title'] ) . "'" : '';
    5858
    5959        $end_cond = $tag = '';

  • trunk/wp-includes/classes.php

    r11013 r11109  
    11881188        $css_class = implode(' ', apply_filters('page_css_class', $css_class, $page));
    11891189
    1190         $output .= $indent . '<li class="' . $css_class . '"><a href="' . get_page_link($page->ID) . '" title="' . attribute_escape(apply_filters('the_title', $page->post_title)) . '">' . $link_before . apply_filters('the_title', $page->post_title) . $link_after . '</a>';
     1190        $output .= $indent . '<li class="' . $css_class . '"><a href="' . get_page_link($page->ID) . '" title="' . attr(apply_filters('the_title', $page->post_title)) . '">' . $link_before . apply_filters('the_title', $page->post_title) . $link_after . '</a>';
    11911191
    11921192        if ( !empty($show_date) ) {
    … …  
    13261326        extract($args);
    13271327
    1328         $cat_name = attribute_escape( $category->name);
     1328        $cat_name = attr( $category->name);
    13291329        $cat_name = apply_filters( 'list_cats', $cat_name, $category );
    13301330        $link = '<a href="' . get_category_link( $category->term_id ) . '" ';
    … …  
    13321332            $link .= 'title="' . sprintf(__( 'View all posts filed under %s' ), $cat_name) . '"';
    13331333        else
    1334             $link .= 'title="' . attribute_escape( apply_filters( 'category_description', $category->description, $category )) . '"';
     1334            $link .= 'title="' . attr( apply_filters( 'category_description', $category->description, $category )) . '"';
    13351335        $link .= '>';
    13361336        $link .= $cat_name . '</a>';

  • trunk/wp-includes/comment-template.php

    r11060 r11109  
    946946        echo ' class="'.$css_class.'" ';
    947947    }
    948     $title = attribute_escape( get_the_title() );
     948    $title = attr( get_the_title() );
    949949
    950950    echo apply_filters( 'comments_popup_link_attributes', '' );

  • trunk/wp-includes/comment.php

    r10810 r11109  
    370370        $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]);
    371371        $comment_author = stripslashes($comment_author);
    372         $comment_author = attribute_escape($comment_author);
     372        $comment_author = attr($comment_author);
    373373        $_COOKIE['comment_author_'.COOKIEHASH] = $comment_author;
    374374    }
    … …  
    377377        $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]);
    378378        $comment_author_email = stripslashes($comment_author_email);
    379         $comment_author_email = attribute_escape($comment_author_email);
     379        $comment_author_email = attr($comment_author_email);
    380380        $_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email;
    381381    }

  • trunk/wp-includes/default-widgets.php

    r11094 r11109  
    6161        //Defaults
    6262        $instance = wp_parse_args( (array) $instance, array( 'sortby' => 'post_title', 'title' => '', 'exclude' => '') );
    63         $title = attribute_escape( $instance['title'] );
    64         $exclude = attribute_escape( $instance['exclude'] );
     63        $title = attr( $instance['title'] );
     64        $exclude = attr( $instance['exclude'] );
    6565    ?>
    6666        <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo $title; ?>" /></label></p>
    … …  
    211211        if ( $d ) {
    212212?>
    213         <select name="archive-dropdown" onchange='document.location.href=this.options[this.selectedIndex].value;'> <option value=""><?php echo attribute_escape(__('Select Month')); ?></option> <?php wp_get_archives("type=monthly&format=option&show_post_count=$c"); ?> </select>
     213        <select name="archive-dropdown" onchange='document.location.href=this.options[this.selectedIndex].value;'> <option value=""><?php echo attr(__('Select Month')); ?></option> <?php wp_get_archives("type=monthly&format=option&show_post_count=$c"); ?> </select>
    214214<?php
    215215        } else {
    … …  
    240240        $dropdown = $instance['dropdown'] ? 'checked="checked"' : '';
    241241?>
    242         <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo attribute_escape($title); ?>" /></label></p>
     242        <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo attr($title); ?>" /></label></p>
    243243        <p>
    244244            <label for="<?php echo $this->get_field_id('count'); ?>"><input class="checkbox" type="checkbox" <?php echo $count; ?> id="<?php echo $this->get_field_id('count'); ?>" name="<?php echo $this->get_field_name('count'); ?>" /> <?php _e('Show post counts'); ?></label>
    … …  
    274274            <?php wp_register(); ?>
    275275            <li><?php wp_loginout(); ?></li>
    276             <li><a href="<?php bloginfo('rss2_url'); ?>" title="<?php echo attribute_escape(__('Syndicate this site using RSS 2.0')); ?>"><?php _e('Entries <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
    277             <li><a href="<?php bloginfo('comments_rss2_url'); ?>" title="<?php echo attribute_escape(__('The latest comments to all posts in RSS')); ?>"><?php _e('Comments <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
    278             <li><a href="http://wordpress.org/" title="<?php echo attribute_escape(__('Powered by WordPress, state-of-the-art semantic personal publishing platform.')); ?>">WordPress.org</a></li>
     276            <li><a href="<?php bloginfo('rss2_url'); ?>" title="<?php echo attr(__('Syndicate this site using RSS 2.0')); ?>"><?php _e('Entries <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
     277            <li><a href="<?php bloginfo('comments_rss2_url'); ?>" title="<?php echo attr(__('The latest comments to all posts in RSS')); ?>"><?php _e('Comments <abbr title="Really Simple Syndication">RSS</abbr>'); ?></a></li>
     278            <li><a href="http://wordpress.org/" title="<?php echo attr(__('Powered by WordPress, state-of-the-art semantic personal publishing platform.')); ?>">WordPress.org</a></li>
    279279            <?php wp_meta(); ?>
    280280            </ul>
    … …  
    294294        $title = strip_tags($instance['title']);
    295295?>
    296             <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo attribute_escape($title); ?>" /></label></p>
     296            <p><label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title:'); ?> <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo attr($title); ?>" /></label></p>
    297297<?php
    298298    }
    … …  
    334334        <p><label for="<?php echo $this->get_field_id('title'); ?>">
    335335        <?php _e('Title:'); ?>
    336         <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo attribute_escape($title); ?>" />
     336        <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo attr($title); ?>" />
    337337        </label></p>
    338338<?php
    … …  
    382382        <p><label for="<?php echo $this->get_field_id('title'); ?>">
    383383        <?php _e('Title:'); ?>
    384         <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo attribute_escape($title); ?>" />
     384        <input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo attr($title); ?>" />
    385385        </label></p>
    386386
    … …  
    464464        //Defaults
    465465        $instance = wp_parse_args( (array) $instance, array( 'title' => '') );
    466         $title = attribute_escape( $instance['title'] );
     466        $title = attr( $instance['title'] );
    467467        $count = (bool) $instance['count'];
    468468        $hierarchical = (bool) $instance['hierarchical'];
    … …  
    567567
    568568    function form( $instance ) {
    569         $title = attribute_escape($instance['title']);
     569        $title = attr($instance['title']);
    570570        if ( !$number = (int) $instance['number'] )
    571571            $number = 5;
    … …  
    654654
    655655    function form( $instance ) {
    656         $title = attribute_escape($instance['title']);
     656        $title = attr($instance['title']);
    657657        if ( !$number = (int) $instance['number'] )
    658658            $number = 5;
    … …  
    703703
    704704        if ( ! is_wp_error($rss) ) {
    705             $desc = attribute_escape(strip_tags(@html_entity_decode($rss->get_description(), ENT_QUOTES, get_option('blog_charset'))));
     705            $desc = attr(strip_tags(@html_entity_decode($rss->get_description(), ENT_QUOTES, get_option('blog_charset'))));
    706706            if ( empty($title) )
    707707                $title = htmlentities(strip_tags($rss->get_title()));
    … …  
    717717        $url = clean_url(strip_tags($url));
    718718        $icon = includes_url('images/rss.png');
    719         $title = "<a class='rsswidget' href='$url' title='" . attribute_escape(__('Syndicate this content')) ."'><img style='background:orange;color:white;border:none;' width='14' height='14' src='$icon' alt='RSS' /></a> <a class='rsswidget' href='$link' title='$desc'>$title</a>";
     719        $title = "<a class='rsswidget' href='$url' title='" . attr(__('Syndicate this content')) ."'><img style='background:orange;color:white;border:none;' width='14' height='14' src='$icon' alt='RSS' /></a> <a class='rsswidget' href='$link' title='$desc'>$title</a>";
    720720
    721721        echo $before_widget;
    … …  
    788788            $link = substr($link, 1);
    789789        $link = clean_url(strip_tags($link));
    790         $title = attribute_escape(strip_tags($item->get_title()));
     790        $title = attr(strip_tags($item->get_title()));
    791791        if ( empty($title) )
    792792            $title = __('Untitled');
    793793
    794         $desc = str_replace(array("\n", "\r"), ' ', attribute_escape(strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset')))));
     794        $desc = str_replace(array("\n", "\r"), ' ', attr(strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset')))));
    795795        $desc = wp_html_excerpt( $desc, 360 ) . ' [&hellip;]';
    796796        $desc = wp_specialchars( $desc );
    … …  
    851851    extract( $inputs, EXTR_SKIP);
    852852
    853     $number = attribute_escape( $number );
    854     $title  = attribute_escape( $title );
    855     $url    = attribute_escape( $url );
     853    $number = attr( $number );
     854    $title  = attr( $title );
     855    $url    = attr( $url );
    856856    $items  = (int) $items;
    857857    if ( $items < 1 || 20 < $items )
    … …  
    985985    <p><label for="<?php echo $this->get_field_id('title'); ?>">
    986986    <?php _e('Title:') ?>
    987     <input type="text" class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" value="<?php echo attribute_escape( $instance['title'] ); ?>" />
     987    <input type="text" class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" value="<?php echo attr( $instance['title'] ); ?>" />
    988988    </label></p>
    989989<?php

  • trunk/wp-includes/deprecated.php

    r10959 r11109  
    10071007            $rel = ' rel="' . $rel . '"';
    10081008
    1009         $desc = attribute_escape(sanitize_bookmark_field('link_description', $row->link_description, $row->link_id, 'display'));
    1010         $name = attribute_escape(sanitize_bookmark_field('link_name', $row->link_name, $row->link_id, 'display'));
     1009        $desc = attr(sanitize_bookmark_field('link_description', $row->link_description, $row->link_id, 'display'));
     1010        $name = attr(sanitize_bookmark_field('link_name', $row->link_name, $row->link_id, 'display'));
    10111011        $title = $desc;
    10121012

  • trunk/wp-includes/feed-atom-comments.php

    r11013 r11109  
    1919            printf(ent2ncr(__('Comments on: %s')), get_the_title_rss());
    2020        elseif ( is_search() )
    21             printf(ent2ncr(__('Comments for %1$s searching on %2$s')), get_bloginfo_rss( 'name' ), attribute_escape(get_search_query()));
     21            printf(ent2ncr(__('Comments for %1$s searching on %2$s')), get_bloginfo_rss( 'name' ), attr(get_search_query()));
    2222        else
    2323            printf(ent2ncr(__('Comments for %s')), get_bloginfo_rss( 'name' ) . get_wp_title_rss());
    … …  
    3333    <id><?php echo get_post_comments_feed_link('', 'atom'); ?></id>
    3434<?php } elseif(is_search()) { ?>
    35     <link rel="alternate" type="<?php bloginfo_rss('html_type'); ?>" href="<?php echo get_option('home') . '?s=' . attribute_escape(get_search_query()); ?>" />
     35    <link rel="alternate" type="<?php bloginfo_rss('html_type'); ?>" href="<?php echo get_option('home') . '?s=' . attr(get_search_query()); ?>" />
    3636    <link rel="self" type="application/atom+xml" href="<?php echo get_search_comments_feed_link('', 'atom'); ?>" />
    3737    <id><?php echo get_search_comments_feed_link('', 'atom'); ?></id>

  • trunk/wp-includes/feed-rss2-comments.php

    r10377 r11109  
    2121            printf(ent2ncr(__('Comments on: %s')), get_the_title_rss());
    2222        elseif ( is_search() )
    23             printf(ent2ncr(__('Comments for %s searching on %s')), get_bloginfo_rss( 'name' ), attribute_escape($wp_query->query_vars['s']));
     23            printf(ent2ncr(__('Comments for %s searching on %s')), get_bloginfo_rss( 'name' ), attr($wp_query->query_vars['s']));
    2424        else
    2525            printf(ent2ncr(__('Comments for %s')), get_bloginfo_rss( 'name' ) . get_wp_title_rss());

  • trunk/wp-includes/feed.php

    r11081 r11109  
    339339            $the_list .= "\t\t<dc:subject><![CDATA[$cat_name]]></dc:subject>\n";
    340340        elseif ( 'atom' == $type )
    341             $the_list .= sprintf( '<category scheme="%1$s" term="%2$s" />', attribute_escape( apply_filters( 'get_bloginfo_rss', get_bloginfo( 'url' ) ) ), attribute_escape( $cat_name ) );
     341            $the_list .= sprintf( '<category scheme="%1$s" term="%2$s" />', attr( apply_filters( 'get_bloginfo_rss', get_bloginfo( 'url' ) ) ), attr( $cat_name ) );
    342342        else
    343343            $the_list .= "\t\t<category><![CDATA[" . @html_entity_decode( $cat_name, ENT_COMPAT, get_option('blog_charset') ) . "]]></category>\n";

  • trunk/wp-includes/formatting.php

    r11103 r11109  
    12711271    $smiley = trim(reset($smiley));
    12721272    $img = $wpsmiliestrans[$smiley];
    1273     $smiley_masked = attribute_escape($smiley);
     1273    $smiley_masked = attr($smiley);
    12741274
    12751275    return " <img src='$siteurl/wp-includes/images/smilies/$img' alt='$smiley_masked' class='wp-smiley' /> ";

  • trunk/wp-includes/functions.php

    r11059 r11109  
    386386 * Print option value after sanitizing for forms.
    387387 *
    388  * @uses attribute_escape Sanitizes value.
     388 * @uses attr Sanitizes value.
    389389 * @since 1.5.0
    390390 * @package WordPress
    … …  
    394394 */
    395395function form_option( $option ) {
    396     echo attribute_escape (get_option( $option ) );
     396    echo attr (get_option( $option ) );
    397397}
    398398
    … …  
    17421742 */
    17431743function wp_nonce_field( $action = -1, $name = "_wpnonce", $referer = true , $echo = true ) {
    1744     $name = attribute_escape( $name );
     1744    $name = attr( $name );
    17451745    $nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" value="' . wp_create_nonce( $action ) . '" />';
    17461746    if ( $echo )
    … …  
    17671767 */
    17681768function wp_referer_field( $echo = true) {
    1769     $ref = attribute_escape( $_SERVER['REQUEST_URI'] );
     1769    $ref = attr( $_SERVER['REQUEST_URI'] );
    17701770    $referer_field = '<input type="hidden" name="_wp_http_referer" value="'. $ref . '" />';
    17711771
    … …  
    17931793    $jump_back_to = ( 'previous' == $jump_back_to ) ? wp_get_referer() : $_SERVER['REQUEST_URI'];
    17941794    $ref = ( wp_get_original_referer() ) ? wp_get_original_referer() : $jump_back_to;
    1795     $orig_referer_field = '<input type="hidden" name="_wp_original_http_referer" value="' . attribute_escape( stripslashes( $ref ) ) . '" />';
     1795    $orig_referer_field = '<input type="hidden" name="_wp_original_http_referer" value="' . attr( stripslashes( $ref ) ) . '" />';
    17961796    if ( $echo )
    17971797        echo $orig_referer_field;

  • trunk/wp-includes/general-template.php

    r11101 r11109  
    121121    $form = '<form role="search" method="get" id="searchform" action="' . get_option('home') . '/" >
    122122    <div><label class="hidden" for="s">' . __('Search for:') . '</label>
    123     <input type="text" value="' . attribute_escape(apply_filters('the_search_query', get_search_query())) . '" name="s" id="s" />
    124     <input type="submit" id="searchsubmit" value="'.attribute_escape(__('Search')).'" />
     123    <input type="text" value="' . attr(apply_filters('the_search_query', get_search_query())) . '" name="s" id="s" />
     124    <input type="submit" id="searchsubmit" value="'.attr(__('Search')).'" />
    125125    </div>
    126126    </form>';
    … …  
    689689function get_archives_link($url, $text, $format = 'html', $before = '', $after = '') {
    690690    $text = wptexturize($text);
    691     $title_text = attribute_escape($text);
     691    $title_text = attr($text);
    692692    $url = clean_url($url);
    693693
    … …  
    14351435    $args = wp_parse_args( $args, $defaults );
    14361436
    1437     echo '<link rel="alternate" type="' . feed_content_type() . '" title="' . attribute_escape(sprintf( $args['feedtitle'], get_bloginfo('name') )) . '" href="' . get_feed_link() . "\" />\n";
    1438     echo '<link rel="alternate" type="' . feed_content_type() . '" title="' . attribute_escape(sprintf( $args['comstitle'], get_bloginfo('name') )) . '" href="' . get_feed_link( 'comments_' . get_default_feed() ) . "\" />\n";
     1437    echo '<link rel="alternate" type="' . feed_content_type() . '" title="' . attr(sprintf( $args['feedtitle'], get_bloginfo('name') )) . '" href="' . get_feed_link() . "\" />\n";
     1438    echo '<link rel="alternate" type="' . feed_content_type() . '" title="' . attr(sprintf( $args['comstitle'], get_bloginfo('name') )) . '" href="' . get_feed_link( 'comments_' . get_default_feed() ) . "\" />\n";
    14391439}
    14401440
    … …  
    14681468
    14691469        if ( comments_open() || pings_open() || $post->comment_count > 0 ) {
    1470             $title = attribute_escape(sprintf( $args['singletitle'], get_bloginfo('name'), $args['separator'], wp_specialchars( get_the_title() ) ));
     1470            $title = attr(sprintf( $args['singletitle'], get_bloginfo('name'), $args['separator'], wp_specialchars( get_the_title() ) ));
    14711471            $href = get_post_comments_feed_link( $post->ID );
    14721472        }
    … …  
    14741474        $cat_id = intval( get_query_var('cat') );
    14751475
    1476         $title = attribute_escape(sprintf( $args['cattitle'], get_bloginfo('name'), $args['separator'], get_cat_name( $cat_id ) ));
     1476        $title = attr(sprintf( $args['cattitle'], get_bloginfo('name'), $args['separator'], get_cat_name( $cat_id ) ));
    14771477        $href = get_category_feed_link( $cat_id );
    14781478    } elseif ( is_tag() ) {
    … …  
    14801480        $tag = get_tag( $tag_id );
    14811481
    1482         $title = attribute_escape(sprintf( $args['tagtitle'], get_bloginfo('name'), $args['separator'], $tag->name ));
     1482        $title = attr(sprintf( $args['tagtitle'], get_bloginfo('name'), $args['separator'], $tag->name ));
    14831483        $href = get_tag_feed_link( $tag_id );
    14841484    } elseif ( is_author() ) {
    14851485        $author_id = intval( get_query_var('author') );
    14861486
    1487         $title = attribute_escape(sprintf( $args['authortitle'], get_bloginfo('name'), $args['separator'], get_author_name( $author_id ) ));
     1487        $title = attr(sprintf( $args['authortitle'], get_bloginfo('name'), $args['separator'], get_author_name( $author_id ) ));
    14881488        $href = get_author_feed_link( $author_id );
    14891489    } elseif ( is_search() ) {
    1490         $title = attribute_escape(sprintf( $args['searchtitle'], get_bloginfo('name'), $args['separator'], get_search_query() ));
     1490        $title = attr(sprintf( $args['searchtitle'], get_bloginfo('name'), $args['separator'], get_search_query() ));
    14911491        $href = get_search_feed_link();
    14921492    }
    … …  
    16791679 * Display the contents of the search query variable.
    16801680 *
    1681  * The search query string is passed through {@link attribute_escape()}
     1681 * The search query string is passed through {@link attr()}
    16821682 * to ensure that it is safe for placing in an html attribute.
    16831683 *
    1684  * @uses attribute_escape
     1684 * @uses attr
    16851685 * @since 2.1.0
    16861686 */
    16871687function the_search_query() {
    1688     echo attribute_escape( apply_filters( 'the_search_query', get_search_query() ) );
     1688    echo attr( apply_filters( 'the_search_query', get_search_query() ) );
    16891689}
    16901690

  • trunk/wp-includes/link-template.php

    r11069 r11109  
    620620function get_search_feed_link($search_query = '', $feed = '') {
    621621    if ( empty($search_query) )
    622         $search = attribute_escape(get_search_query());
     622        $search = attr(get_search_query());
    623623    else
    624         $search = attribute_escape(stripslashes($search_query));
     624        $search = attr(stripslashes($search_query));
    625625
    626626    if ( empty($feed) )
    … …  
    645645function get_search_comments_feed_link($search_query = '', $feed = '') {
    646646    if ( empty($search_query) )
    647         $search = attribute_escape(get_search_query());
     647        $search = attr(get_search_query());
    648648    else
    649         $search = attribute_escape(stripslashes($search_query));
     649        $search = attr(stripslashes($search_query));
    650650
    651651    if ( empty($feed) )
    … …  
    731731    }
    732732
    733     $link = '<a class="post-edit-link" href="' . get_edit_post_link( $post->ID ) . '" title="' . attribute_escape( __( 'Edit post' ) ) . '">' . $link . '</a>';
     733    $link = '<a class="post-edit-link" href="' . get_edit_post_link( $post->ID ) . '" title="' . attr( __( 'Edit post' ) ) . '">' . $link . '</a>';
    734734    echo $before . apply_filters( 'edit_post_link', $link, $post->ID ) . $after;
    735735}
    … …  
    941941
    942942    $link = $previous ? "<link rel='prev' title='" : "<link rel='next' title='";
    943     $link .= attribute_escape( $title );
     943    $link .= attr( $title );
    944944    $link .= "' href='" . get_permalink($post) . "' />\n";
    945945
    … …  
    10651065
    10661066    $link = $start ? "<link rel='start' title='" : "<link rel='end' title='";
    1067     $link .= attribute_escape($title);
     1067    $link .= attr($title);
    10681068    $link .= "' href='" . get_permalink($post) . "' />\n";
    10691069
    … …  
    10931093 */
    10941094function get_index_rel_link() {
    1095     $link = "<link rel='index' title='" . attribute_escape(get_bloginfo('name')) . "' href='" . get_bloginfo('siteurl') . "' />\n";
     1095    $link = "<link rel='index' title='" . attr(get_bloginfo('name')) . "' href='" . get_bloginfo('siteurl') . "' />\n";
    10961096    return apply_filters( "index_rel_link", $link );
    10971097}
    … …  
    11281128
    11291129    $link = "<link rel='up' title='";
    1130     $link .= attribute_escape( $title );
     1130    $link .= attr( $title );
    11311131    $link .= "' href='" . get_permalink($post) . "' />\n";
    11321132

  • trunk/wp-includes/media.php

    r10744 r11109  
    201201    $hwstring = image_hwstring($width, $height);
    202202
    203     $class = 'align'.attribute_escape($align).' size-'.attribute_escape($size).' wp-image-'.$id;
     203    $class = 'align'.attr($align).' size-'.attr($size).' wp-image-'.$id;
    204204    $class = apply_filters('get_image_tag_class', $class, $id, $align, $size);
    205205
    206     $html = '<img src="'.attribute_escape($img_src).'" alt="'.attribute_escape($alt).'" title="'.attribute_escape($title).'" '.$hwstring.'class="'.$class.'" />';
     206    $html = '<img src="'.attr($img_src).'" alt="'.attr($alt).'" title="'.attr($title).'" '.$hwstring.'class="'.$class.'" />';
    207207
    208208    $html = apply_filters( 'get_image_tag', $html, $id, $alt, $title, $align, $size );
    … …  
    543543            );
    544544        $attr = apply_filters( 'wp_get_attachment_image_attributes', $attr, $attachment );
    545         $attr = array_map( 'attribute_escape', $attr );
     545        $attr = array_map( 'attr', $attr );
    546546        $html = rtrim("<img $hwstring");
    547547        foreach ( $attr as $name => $value ) {

  • trunk/wp-includes/pluggable.php

    r11057 r11109  
    15001500        $safe_alt = '';
    15011501    else
    1502         $safe_alt = attribute_escape( $alt );
     1502        $safe_alt = attr( $alt );
    15031503
    15041504    if ( !is_numeric($size) )

  • trunk/wp-includes/post-template.php

    r11054 r11109  
    6464 *
    6565 * The title before it is displayed will have the tags stripped and {@link
    66  * attribute_escape()} before it is passed to the user or displayed. The default
     66 * attr()} before it is passed to the user or displayed. The default
    6767 * as with {@link the_title()}, is to display the title.
    6868 *
    … …  
    8484
    8585    $title = $before . $title . $after;
    86     $title = attribute_escape(strip_tags($title));
     86    $title = attr(strip_tags($title));
    8787
    8888    if ( $echo )
    … …  
    925925        $url = get_attachment_link($_post->ID);
    926926
    927     $post_title = attribute_escape($_post->post_title);
     927    $post_title = attr($_post->post_title);
    928928
    929929    if ( $text ) {
    930         $link_text = attribute_escape($text);
     930        $link_text = attr($text);
    931931    } elseif ( ( is_int($size) && $size != 0 ) or ( is_string($size) && $size != 'none' ) or $size != false ) {
    932932        $link_text = wp_get_attachment_image($id, $size, $icon);
    … …  
    962962        $url = get_attachment_link($_post->ID);
    963963
    964     $post_title = attribute_escape($_post->post_title);
     964    $post_title = attr($_post->post_title);
    965965
    966966    $innerHTML = get_attachment_innerHTML($_post->ID, $fullsize, $max_dims);
    … …  
    10581058    }
    10591059
    1060     $post_title = attribute_escape($post->post_title);
     1060    $post_title = attr($post->post_title);
    10611061
    10621062    $icon = "<img src='$src' title='$post_title' alt='$post_title' $constraint/>";
    … …  
    10861086
    10871087
    1088     $innerHTML = attribute_escape($post->post_title);
     1088    $innerHTML = attr($post->post_title);
    10891089
    10901090    return apply_filters('attachment_innerHTML', $innerHTML, $post->ID);

  • trunk/wp-includes/post.php

    r11108 r11109  
    870870                $value = format_to_edit($value);
    871871        } else {
    872             $value = attribute_escape($value);
     872            $value = attr($value);
    873873        }
    874874    } else if ( 'db' == $context ) {
    … …  
    889889
    890890    if ( 'attribute' == $context )
    891         $value = attribute_escape($value);
     891        $value = attr($value);
    892892    else if ( 'js' == $context )
    893893        $value = js_escape($value);

  • trunk/wp-includes/rss.php

    r11016 r11109  
    874874                '<li><a href="%1$s" title="%2$s">%3$s</a></li>',
    875875                clean_url( $item['link'] ),
    876                 attribute_escape( strip_tags( $item['description'] ) ),
     876                attr( strip_tags( $item['description'] ) ),
    877877                htmlentities( $item['title'] )
    878878            );

  • trunk/wp-includes/script-loader.php

    r11093 r11109  
    7575        'quickLinks' => __('(Quick Links)'),
    7676        'wordLookup' => __('Enter a word to look up:'),
    77         'dictionaryLookup' => attribute_escape(__('Dictionary lookup')),
    78         'lookup' => attribute_escape(__('lookup')),
    79         'closeAllOpenTags' => attribute_escape(__('Close all open tags')),
    80         'closeTags' => attribute_escape(__('close tags')),
     77        'dictionaryLookup' => attr(__('Dictionary lookup')),
     78        'lookup' => attr(__('lookup')),
     79        'closeAllOpenTags' => attr(__('Close all open tags')),
     80        'closeTags' => attr(__('close tags')),
    8181        'enterURL' => __('Enter the URL'),
    8282        'enterImageURL' => __('Enter the URL of the image'),
    … …  
    213213        $scripts->add_data( 'ajaxcat', 'group', 1 );
    214214        $scripts->localize( 'ajaxcat', 'catL10n', array(
    215             'add' => attribute_escape(__('Add')),
     215            'add' => attr(__('Add')),
    216216            'how' => __('Separate multiple categories with commas.'),
    217217            'l10n_print_after' => 'try{convertEntities(catL10n);}catch(e){};'
    … …  
    267267        $scripts->localize( 'post', 'postL10n', array(
    268268            'tagsUsed' =>  __('Tags used on this post:'),
    269             'add' => attribute_escape(__('Add')),
    270             'addTag' => attribute_escape(__('Add new tag')),
     269            'add' => attr(__('Add')),
     270            'addTag' => attr(__('Add new tag')),
    271271            'separate' => __('Separate tags with commas'),
    272272            'cancel' => __('Cancel'),
    … …  
    605605        $ver = md5("$wp_scripts->concat_version");
    606606        $src = $wp_scripts->base_url . "/wp-admin/load-scripts.php?c={$zip}&load=" . trim($wp_scripts->concat, ', ') . "&ver=$ver";
    607         echo "<script type='text/javascript' src='" . attribute_escape($src) . "'></script>\n";
     607        echo "<script type='text/javascript' src='" . attr($src) . "'></script>\n";
    608608    }
    609609
    … …  
    672672            $ver = md5("$wp_styles->concat_version{$dir}");
    673673            $href = $wp_styles->base_url . "/wp-admin/load-styles.php?c={$zip}&dir={$dir}&load=" . trim($wp_styles->concat, ', ') . "&ver=$ver";
    674             echo "<link rel='stylesheet' href='" . attribute_escape($href) . "' type='text/css' media='all' />\n";
     674            echo "<link rel='stylesheet' href='" . attr($href) . "' type='text/css' media='all' />\n";
    675675        }
    676676

  • trunk/wp-includes/taxonomy.php

    r11068 r11109  
    992992            $value = format_to_edit($value);
    993993        else
    994             $value = attribute_escape($value);
     994            $value = attr($value);
    995995    } else if ( 'db' == $context ) {
    996996        $value = apply_filters("pre_term_$field", $value, $taxonomy);
    … …  
    10101010
    10111011    if ( 'attribute' == $context )
    1012         $value = attribute_escape($value);
     1012        $value = attr($value);
    10131013    else if ( 'js' == $context )
    10141014        $value = js_escape($value);
    … …  
    22612261
    22622262        foreach ( $terms as $term )
    2263             $links[] = "<a href='" . attribute_escape(get_term_link($term, $taxonomy)) . "'>$term->name</a>";
     2263            $links[] = "<a href='" . attr(get_term_link($term, $taxonomy)) . "'>$term->name</a>";
    22642264
    22652265        if ( $links )

  • trunk/wp-includes/theme.php

    r11061 r11109  
    933933    if ( 0 === strpos($link, 'preview=1') )
    934934        $link = "?$link";
    935     return $matches[1] . attribute_escape( $link ) . $matches[4];
     935    return $matches[1] . attr( $link ) . $matches[4];
    936936}
    937937

  • trunk/wp-includes/update.php

    r10939 r11109  
    6363        $returns = explode("\n", $entry);
    6464        $new_option = new stdClass();
    65         $new_option->response = attribute_escape( $returns[0] );
     65        $new_option->response = attr( $returns[0] );
    6666        if ( isset( $returns[1] ) )
    6767            $new_option->url = clean_url( $returns[1] );
    … …  
    6969            $new_option->package = clean_url( $returns[2] );
    7070        if ( isset( $returns[3] ) )
    71             $new_option->current = attribute_escape( $returns[3] );
     71            $new_option->current = attr( $returns[3] );
    7272        if ( isset( $returns[4] ) )
    73             $new_option->locale = attribute_escape( $returns[4] );
     73            $new_option->locale = attr( $returns[4] );
    7474        $new_options[] = $new_option;
    7575    }

  • trunk/wp-links-opml.php

    r7991 r11109  
    3030<opml version="1.0">
    3131    <head>
    32         <title>Links for <?php echo attribute_escape(get_bloginfo('name', 'display').$cat_name); ?></title>
     32        <title>Links for <?php echo attr(get_bloginfo('name', 'display').$cat_name); ?></title>
    3333        <dateCreated><?php echo gmdate("D, d M Y H:i:s"); ?> GMT</dateCreated>
    3434    </head>
    … …  
    4545
    4646?>
    47 <outline type="category" title="<?php echo attribute_escape($catname); ?>">
     47<outline type="category" title="<?php echo attr($catname); ?>">
    4848<?php
    4949
    5050    $bookmarks = get_bookmarks("category={$cat->term_id}");
    5151    foreach ((array) $bookmarks as $bookmark) {
    52         $title = attribute_escape(apply_filters('link_title', $bookmark->link_name));
     52        $title = attr(apply_filters('link_title', $bookmark->link_name));
    5353?>
    54     <outline text="<?php echo $title; ?>" type="link" xmlUrl="<?php echo attribute_escape($bookmark->link_rss); ?>" htmlUrl="<?php echo attribute_escape($bookmark->link_url); ?>" updated="<?php if ('0000-00-00 00:00:00' != $bookmark->link_updated) echo $bookmark->link_updated; ?>" />
     54    <outline text="<?php echo $title; ?>" type="link" xmlUrl="<?php echo attr($bookmark->link_rss); ?>" htmlUrl="<?php echo attr($bookmark->link_url); ?>" updated="<?php if ('0000-00-00 00:00:00' != $bookmark->link_updated) echo $bookmark->link_updated; ?>" />
    5555<?php
    5656

  • trunk/wp-login.php

    r11104 r11109  
    308308    <p>
    309309        <label><?php _e('Username or E-mail:') ?><br />
    310         <input type="text" name="user_login" id="user_login" class="input" value="<?php echo attribute_escape($user_login); ?>" size="20" tabindex="10" /></label>
     310        <input type="text" name="user_login" id="user_login" class="input" value="<?php echo attr($user_login); ?>" size="20" tabindex="10" /></label>
    311311    </p>
    312312<?php do_action('lostpassword_form'); ?>
    … …  
    375375    <p>
    376376        <label><?php _e('Username') ?><br />
    377         <input type="text" name="user_login" id="user_login" class="input" value="<?php echo attribute_escape(stripslashes($user_login)); ?>" size="20" tabindex="10" /></label>
     377        <input type="text" name="user_login" id="user_login" class="input" value="<?php echo attr(stripslashes($user_login)); ?>" size="20" tabindex="10" /></label>
    378378    </p>
    379379    <p>
    380380        <label><?php _e('E-mail') ?><br />
    381         <input type="text" name="user_email" id="user_email" class="input" value="<?php echo attribute_escape(stripslashes($user_email)); ?>" size="25" tabindex="20" /></label>
     381        <input type="text" name="user_email" id="user_email" class="input" value="<?php echo attr(stripslashes($user_email)); ?>" size="25" tabindex="20" /></label>
    382382    </p>
    383383<?php do_action('register_form'); ?>
    … …  
    461461
    462462    if ( isset($_POST['log']) )
    463         $user_login = ( 'incorrect_password' == $errors->get_error_code() || 'empty_password' == $errors->get_error_code() ) ? attribute_escape(stripslashes($_POST['log'])) : '';
     463        $user_login = ( 'incorrect_password' == $errors->get_error_code() || 'empty_password' == $errors->get_error_code() ) ? attr(stripslashes($_POST['log'])) : '';
    464464?>
    465465
    … …  
    478478    <p class="submit">
    479479        <input type="submit" name="wp-submit" id="wp-submit" value="<?php _ea('Log In'); ?>" tabindex="100" />
    480         <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($redirect_to); ?>" />
     480        <input type="hidden" name="redirect_to" value="<?php echo attr($redirect_to); ?>" />
    481481        <input type="hidden" name="testcookie" value="1" />
    482482    </p>
Note: See TracChangeset for help on using the changeset viewer.