Changeset 11380 for trunk/wp-admin/includes/post.php

Timestamp:

05/18/2009 03:11:07 PM (17 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-admin/includes/post.php (modified) (3 diffs)

trunk/wp-admin/includes/post.php

@@ -320 +320 @@
 function get_default_post_to_edit() {
         if ( !empty( $_REQUEST['post_title'] ) )
-                $post_title = wp_specialchars( stripslashes( $_REQUEST['post_title'] ));
+                $post_title = esc_html( stripslashes( $_REQUEST['post_title'] ));
         else if ( !empty( $_REQUEST['popuptitle'] ) ) {
-                $post_title = wp_specialchars( stripslashes( $_REQUEST['popuptitle'] ));
+                $post_title = esc_html( stripslashes( $_REQUEST['popuptitle'] ));
                 $post_title = funky_javascript_fix( $post_title );
         } else {
@@ -330 +330 @@
         $post_content = '';
         if ( !empty( $_REQUEST['content'] ) )
-                $post_content = wp_specialchars( stripslashes( $_REQUEST['content'] ));
+                $post_content = esc_html( stripslashes( $_REQUEST['content'] ));
         else if ( !empty( $post_title ) ) {
-                $text       = wp_specialchars( stripslashes( urldecode( $_REQUEST['text'] ) ) );
+                $text       = esc_html( stripslashes( urldecode( $_REQUEST['text'] ) ) );
                 $text       = funky_javascript_fix( $text);
                 $popupurl   = clean_url($_REQUEST['popupurl']);
@@ -339 +339 @@
 
         if ( !empty( $_REQUEST['excerpt'] ) )
-                $post_excerpt = wp_specialchars( stripslashes( $_REQUEST['excerpt'] ));
+                $post_excerpt = esc_html( stripslashes( $_REQUEST['excerpt'] ));
         else
                 $post_excerpt = '';