Changeset 11380 for trunk/wp-admin/includes/media.php

Timestamp:

05/18/2009 03:11:07 PM (16 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-admin/includes/media.php (modified) (3 diffs)

trunk/wp-admin/includes/media.php

@@ -1199 +1199 @@
             $item .= $field[$field['input']];
         elseif ( $field['input'] == 'textarea' ) {
-            $item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . wp_specialchars( $field['value'] ) . "</textarea>";
+            $item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . esc_html( $field['value'] ) . "</textarea>";
         } else {
             $item .= "<input type='text' id='$name' name='$name' value='" . esc_attr( $field['value'] ) . "'" . $aria_required . "/>";
@@ -1420 +1420 @@
         echo get_media_items( $id, $errors );
     } else {
-        echo '<div id="media-upload-error">'.wp_specialchars($id->get_error_message()).'</div>';
+        echo '<div id="media-upload-error">'.esc_html($id->get_error_message()).'</div>';
         exit;
     }
@@ -1803 +1803 @@
 
     echo "<option$default value='" . esc_attr( $arc_row->yyear . $arc_row->mmonth ) . "'>";
-    echo wp_specialchars( $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear" );
+    echo esc_html( $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear" );
     echo "</option>\n";
 }