Changeset 11722 for trunk/wp-includes/comment-template.php

Timestamp:

07/20/2009 01:11:14 AM (17 years ago)

Author:

ryan

Message:

Escape , , and for use in attributes by default since so many themes don't escape them. Use wp_get_current_commenter() to get the raw values.

File:

• trunk/wp-includes/comment-template.php (modified) (1 diff)

trunk/wp-includes/comment-template.php

@@ -819 +819 @@
 
         $req = get_option('require_name_email');
+
+        /**
+         * Raw comment author information fetched from the comment cookies.
+         *
+         * @uses wp_get_current_commenter()
+         */
         $commenter = wp_get_current_commenter();
-        extract($commenter, EXTR_SKIP);
+
+        /**
+         * The name of the current comment author escaped for use in attributes.  Use
+         * wp_get_current_commenter() to get the raw value.
+         */
+        $comment_author = esc_attr($commenter['comment_author']);
+
+        /**
+         * The email address of the current comment author escaped for use in attributes.  Use
+         * wp_get_current_commenter() to get the raw value.
+         */     
+        $comment_author_email = esc_attr($commenter['comment_author_email']);
+
+        /**
+         * The url of the current comment author escaped for use in attributes.  Use
+         * wp_get_current_commenter() to get the raw value.
+         */     
+        $comment_author_url = esc_url($commenter['comment_author_url']);
 
         /** @todo Use API instead of SELECTs. */