Changeset 11722

Timestamp:

07/20/2009 01:11:14 AM (16 years ago)

Author:

ryan

Message:

Escape , , and for use in attributes by default since so many themes don't escape them. Use wp_get_current_commenter() to get the raw values.

File:

• trunk/wp-includes/comment-template.php (modified) (1 diff)

trunk/wp-includes/comment-template.php

@@ -819 +819 @@
 
     $req = get_option('require_name_email');
+
+    /**
+     * Raw comment author information fetched from the comment cookies.
+     *
+     * @uses wp_get_current_commenter()
+     */
     $commenter = wp_get_current_commenter();
-    extract($commenter, EXTR_SKIP);
+
+    /**
+     * The name of the current comment author escaped for use in attributes.  Use
+     * wp_get_current_commenter() to get the raw value.
+     */
+    $comment_author = esc_attr($commenter['comment_author']);
+
+    /**
+     * The email address of the current comment author escaped for use in attributes.  Use
+     * wp_get_current_commenter() to get the raw value.
+     */ 
+    $comment_author_email = esc_attr($commenter['comment_author_email']);
+
+    /**
+     * The url of the current comment author escaped for use in attributes.  Use
+     * wp_get_current_commenter() to get the raw value.
+     */ 
+    $comment_author_url = esc_url($commenter['comment_author_url']);
 
     /** @todo Use API instead of SELECTs. */