Changeset 11380 for trunk/wp-admin/includes/post.php

Timestamp:

05/18/2009 03:11:07 PM (16 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-admin/includes/post.php (modified) (3 diffs)

trunk/wp-admin/includes/post.php

@@ -320 +320 @@
 function get_default_post_to_edit() {
     if ( !empty( $_REQUEST['post_title'] ) )
-        $post_title = wp_specialchars( stripslashes( $_REQUEST['post_title'] ));
+        $post_title = esc_html( stripslashes( $_REQUEST['post_title'] ));
     else if ( !empty( $_REQUEST['popuptitle'] ) ) {
-        $post_title = wp_specialchars( stripslashes( $_REQUEST['popuptitle'] ));
+        $post_title = esc_html( stripslashes( $_REQUEST['popuptitle'] ));
         $post_title = funky_javascript_fix( $post_title );
     } else {
@@ -330 +330 @@
     $post_content = '';
     if ( !empty( $_REQUEST['content'] ) )
-        $post_content = wp_specialchars( stripslashes( $_REQUEST['content'] ));
+        $post_content = esc_html( stripslashes( $_REQUEST['content'] ));
     else if ( !empty( $post_title ) ) {
-        $text       = wp_specialchars( stripslashes( urldecode( $_REQUEST['text'] ) ) );
+        $text       = esc_html( stripslashes( urldecode( $_REQUEST['text'] ) ) );
         $text       = funky_javascript_fix( $text);
         $popupurl   = clean_url($_REQUEST['popupurl']);
@@ -339 +339 @@
 
     if ( !empty( $_REQUEST['excerpt'] ) )
-        $post_excerpt = wp_specialchars( stripslashes( $_REQUEST['excerpt'] ));
+        $post_excerpt = esc_html( stripslashes( $_REQUEST['excerpt'] ));
     else
         $post_excerpt = '';