Changeset 11380 for trunk/wp-includes/functions.php

Timestamp:

05/18/2009 03:11:07 PM (17 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-includes/functions.php (modified) (5 diffs)

trunk/wp-includes/functions.php

@@ -380 +380 @@
         $protected = array( 'alloptions', 'notoptions' );
         if ( in_array( $option, $protected ) )
-                die( sprintf( __( '%s is a protected WP option and may not be modified' ), wp_specialchars( $option ) ) );
+                die( sprintf( __( '%s is a protected WP option and may not be modified' ), esc_html( $option ) ) );
 }
 
@@ -1594 +1594 @@
         $hook = 'do_feed_' . $feed;
         if ( !has_action($hook) ) {
-                $message = sprintf( __( 'ERROR: %s is not a valid feed template' ), wp_specialchars($feed));
+                $message = sprintf( __( 'ERROR: %s is not a valid feed template' ), esc_html($feed));
                 wp_die($message);
         }
@@ -1719 +1719 @@
 function wp_nonce_url( $actionurl, $action = -1 ) {
         $actionurl = str_replace( '&', '&', $actionurl );
-        return wp_specialchars( add_query_arg( '_wpnonce', wp_create_nonce( $action ), $actionurl ) );
+        return esc_html( add_query_arg( '_wpnonce', wp_create_nonce( $action ), $actionurl ) );
 }
 
@@ -2309 +2309 @@
                                                 $object = call_user_func( $lookup, $object );
                                 }
-                                return sprintf( $trans[$verb][$noun][0], wp_specialchars($object) );
+                                return sprintf( $trans[$verb][$noun][0], esc_html($object) );
                         } else {
                                 return $trans[$verb][$noun][0];
@@ -2335 +2335 @@
 function wp_nonce_ays( $action ) {
         $title = __( 'WordPress Failure Notice' );
-        $html = wp_specialchars( wp_explain_nonce( $action ) );
+        $html = esc_html( wp_explain_nonce( $action ) );
         if ( wp_get_referer() )
                 $html .= "</p><p><a href='" . clean_url( remove_query_arg( 'updated', wp_get_referer() ) ) . "'>" . __( 'Please try again.' ) . "</a>";