Changeset 11380 for trunk/wp-admin/admin-ajax.php

Timestamp:

05/18/2009 03:11:07 PM (17 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-admin/admin-ajax.php (modified) (4 diffs)

trunk/wp-admin/admin-ajax.php

@@ -423 +423 @@
                 }
                 $cat_id = $cat_id['term_id'];
-                $cat_name = wp_specialchars(stripslashes($cat_name));
+                $cat_name = esc_html(stripslashes($cat_name));
                 $x->add( array(
                         'what' => 'link-category',
@@ -899 +899 @@
                         $data = new WP_Error( 'locked', sprintf(
                                 $_POST['post_type'] == 'page' ? __( 'Autosave disabled: %s is currently editing this page.' ) : __( 'Autosave disabled: %s is currently editing this post.' ),
-                                wp_specialchars( $last_user_name )
+                                esc_html( $last_user_name )
                         ) );
 
@@ -1058 +1058 @@
                 $last_user = get_userdata( $last );
                 $last_user_name = $last_user ? $last_user->display_name : __( 'Someone' );
-                printf( $_POST['post_type'] == 'page' ? __( 'Saving is disabled: %s is currently editing this page.' ) : __( 'Saving is disabled: %s is currently editing this post.' ),        wp_specialchars( $last_user_name ) );
+                printf( $_POST['post_type'] == 'page' ? __( 'Saving is disabled: %s is currently editing this page.' ) : __( 'Saving is disabled: %s is currently editing this post.' ),        esc_html( $last_user_name ) );
                 exit;
         }
@@ -1218 +1218 @@
 
                 $html .= '<tr class="found-posts"><td class="found-radio"><input type="radio" id="found-'.$post->ID.'" name="found_post_id" value="' . esc_attr($post->ID) . '"></td>';
-                $html .= '<td><label for="found-'.$post->ID.'">'.wp_specialchars($post->post_title, true).'</label></td><td>'.wp_specialchars($time, true).'</td><td>'.wp_specialchars($stat, true).'</td></tr>'."\n\n";
+                $html .= '<td><label for="found-'.$post->ID.'">'.esc_html( $post->post_title ).'</label></td><td>'.esc_html( $time ).'</td><td>'.esc_html( $stat ).'</td></tr>'."\n\n";
         }
         $html .= '</tbody></table>';