Changeset 11380 for trunk/wp-admin/edit-form-advanced.php

Timestamp:

05/18/2009 03:11:07 PM (15 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-admin/edit-form-advanced.php (modified) (4 diffs)

trunk/wp-admin/edit-form-advanced.php

@@ -167 +167 @@
 }
 
-?><?php echo wp_specialchars( $visibility_trans ); ?></span> <?php if ( $can_publish ) { ?> <a href="#visibility" class="edit-visibility hide-if-no-js"><?php _e('Edit'); ?></a>
+?><?php echo esc_html( $visibility_trans ); ?></span> <?php if ( $can_publish ) { ?> <a href="#visibility" class="edit-visibility hide-if-no-js"><?php _e('Edit'); ?></a>
 
 <div id="post-visibility-select" class="hide-if-js">
@@ -391 +391 @@
         $already_pinged = explode("\n", trim($post->pinged));
         foreach ($already_pinged as $pinged_url) {
-            $pings .= "\n\t<li>" . wp_specialchars($pinged_url) . "</li>";
+            $pings .= "\n\t<li>" . esc_html($pinged_url) . "</li>";
         }
         $pings .= '</ul>';
@@ -550 +550 @@
 <div class="wrap">
 <?php screen_icon(); ?>
-<h2><?php echo wp_specialchars( $title ); ?></h2>
+<h2><?php echo esc_html( $title ); ?></h2>
 <?php if ( $notice ) : ?>
 <div id="notice" class="error"><p><?php echo $notice ?></p></div>
@@ -623 +623 @@
         if ( $last_id = get_post_meta($post_ID, '_edit_last', true) ) {
             $last_user = get_userdata($last_id);
-            printf(__('Last edited by %1$s on %2$s at %3$s'), wp_specialchars( $last_user->display_name ), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
+            printf(__('Last edited by %1$s on %2$s at %3$s'), esc_html( $last_user->display_name ), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));
         } else {
             printf(__('Last edited on %1$s at %2$s'), mysql2date(get_option('date_format'), $post->post_modified), mysql2date(get_option('time_format'), $post->post_modified));