Changeset 11380 for trunk/wp-admin/includes/dashboard.php

Timestamp:

05/18/2009 03:11:07 PM (15 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-admin/includes/dashboard.php (modified) (4 diffs)

trunk/wp-admin/includes/dashboard.php

@@ -582 +582 @@
                     $type = ucwords( $comment->comment_type );
                 endswitch;
-                $type = wp_specialchars( $type );
+                $type = esc_html( $type );
             ?>
             <div class="dashboard-comment-wrap">
@@ -647 +647 @@
         $site_link = clean_url( strip_tags( $author->get_link() ) );
 
-        if ( !$publisher = wp_specialchars( strip_tags( $author->get_name() ) ) )
+        if ( !$publisher = esc_html( strip_tags( $author->get_name() ) ) )
             $publisher = __( 'Somebody' );
         if ( $site_link )
@@ -668 +668 @@
                 /* translators: incoming links feed, %4$s is the date */
                 $text .= ' ' . __( 'on %4$s' );
-            $date = wp_specialchars( strip_tags( $item->get_date() ) );
+            $date = esc_html( strip_tags( $item->get_date() ) );
             $date = strtotime( $date );
             $date = gmdate( get_option( 'date_format' ), $date );
@@ -814 +814 @@
         else // but let's make it forward compatible if things change
             $title = $item->get_title();
-        $title = wp_specialchars( $title );
-
-        $description = wp_specialchars( strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset'))) );
+        $title = esc_html( $title );
+
+        $description = esc_html( strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset'))) );
 
         $ilink = wp_nonce_url('plugin-install.php?tab=plugin-information&plugin=' . $slug, 'install-plugin_' . $slug) .