Changeset 11380 for trunk/wp-includes/widgets.php

Timestamp:

05/18/2009 03:11:07 PM (16 years ago)

Author:

markjaquith

Message:

deprecate wp_specialchars() in favor of esc_html(). Encode quotes for esc_html() as in esc_attr(), to improve plugin security.

File:

• trunk/wp-includes/widgets.php (modified) (1 diff)

trunk/wp-includes/widgets.php

@@ -602 +602 @@
 
     if ( isset($wp_registered_widgets[$id]['description']) )
-        return wp_specialchars( $wp_registered_widgets[$id]['description'] );
+        return esc_html( $wp_registered_widgets[$id]['description'] );
 }