Changeset 11380 for trunk/wp-admin/includes/dashboard.php

Timestamp:

05/18/2009 03:11:07 PM (17 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-admin/includes/dashboard.php (modified) (4 diffs)

trunk/wp-admin/includes/dashboard.php

@@ -582 +582 @@
                                         $type = ucwords( $comment->comment_type );
                                 endswitch;
-                                $type = wp_specialchars( $type );
+                                $type = esc_html( $type );
                         ?>
                         <div class="dashboard-comment-wrap">
@@ -647 +647 @@
                 $site_link = clean_url( strip_tags( $author->get_link() ) );
 
-                if ( !$publisher = wp_specialchars( strip_tags( $author->get_name() ) ) )
+                if ( !$publisher = esc_html( strip_tags( $author->get_name() ) ) )
                         $publisher = __( 'Somebody' );
                 if ( $site_link )
@@ -668 +668 @@
                                 /* translators: incoming links feed, %4$s is the date */
                                 $text .= ' ' . __( 'on %4$s' );
-                        $date = wp_specialchars( strip_tags( $item->get_date() ) );
+                        $date = esc_html( strip_tags( $item->get_date() ) );
                         $date = strtotime( $date );
                         $date = gmdate( get_option( 'date_format' ), $date );
@@ -814 +814 @@
                 else // but let's make it forward compatible if things change
                         $title = $item->get_title();
-                $title = wp_specialchars( $title );
-
-                $description = wp_specialchars( strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset'))) );
+                $title = esc_html( $title );
+
+                $description = esc_html( strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset'))) );
 
                 $ilink = wp_nonce_url('plugin-install.php?tab=plugin-information&plugin=' . $slug, 'install-plugin_' . $slug) .