Changeset 11380 for trunk/wp-admin/includes/media.php

Timestamp:

05/18/2009 03:11:07 PM (17 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-admin/includes/media.php (modified) (3 diffs)

trunk/wp-admin/includes/media.php

@@ -1199 +1199 @@
                         $item .= $field[$field['input']];
                 elseif ( $field['input'] == 'textarea' ) {
-                        $item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . wp_specialchars( $field['value'] ) . "</textarea>";
+                        $item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . esc_html( $field['value'] ) . "</textarea>";
                 } else {
                         $item .= "<input type='text' id='$name' name='$name' value='" . esc_attr( $field['value'] ) . "'" . $aria_required . "/>";
@@ -1420 +1420 @@
                 echo get_media_items( $id, $errors );
         } else {
-                echo '<div id="media-upload-error">'.wp_specialchars($id->get_error_message()).'</div>';
+                echo '<div id="media-upload-error">'.esc_html($id->get_error_message()).'</div>';
                 exit;
         }
@@ -1803 +1803 @@
 
         echo "<option$default value='" . esc_attr( $arc_row->yyear . $arc_row->mmonth ) . "'>";
-        echo wp_specialchars( $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear" );
+        echo esc_html( $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear" );
         echo "</option>\n";
 }