Changeset 11380 for trunk/wp-includes/comment-template.php

Timestamp:

05/18/2009 03:11:07 PM (15 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-includes/comment-template.php (modified) (1 diff)

trunk/wp-includes/comment-template.php

@@ -1079 +1079 @@
 
     $style = isset($_GET['replytocom']) ? '' : ' style="display:none;"';
-    $link = wp_specialchars( remove_query_arg('replytocom') ) . '#respond';
+    $link = esc_html( remove_query_arg('replytocom') ) . '#respond';
     return apply_filters('cancel_comment_reply_link', '<a rel="nofollow" id="cancel-comment-reply-link" href="' . $link . '"' . $style . '>' . $text . '</a>', $link, $text);
 }