Changeset 13978

Timestamp:

04/03/2010 11:38:38 PM (15 years ago)

Author:

nacin

Message:

Have get_search_query() escape by default, like it's echoing counterpart the_search_query(). see #12780

Location:

trunk

Files:

• wp-admin/edit.php (modified) (1 diff)
• wp-admin/upload.php (modified) (1 diff)
• wp-includes/feed-atom-comments.php (modified) (2 diffs)
• wp-includes/general-template.php (modified) (3 diffs)
• wp-includes/link-template.php (modified) (1 diff)

trunk/wp-admin/edit.php

@@ -168 +168 @@
 <h2><?php echo esc_html( $title ); ?> <a href="<?php echo $post_new_file ?>" class="button add-new-h2"><?php echo esc_html_x('Add New', 'post'); ?></a> <?php
 if ( isset($_GET['s']) && $_GET['s'] )
-    printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( get_search_query() ) ); ?>
+    printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', get_search_query() ); ?>
 </h2>
 

trunk/wp-admin/upload.php

@@ -169 +169 @@
 <h2><?php echo esc_html( $title ); ?> <a href="media-new.php" class="button add-new-h2"><?php echo esc_html_x('Add New', 'file'); ?></a> <?php
 if ( isset($_GET['s']) && $_GET['s'] )
-    printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( get_search_query() ) ); ?>
+    printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', get_search_query() ); ?>
 </h2>
 

trunk/wp-includes/feed-atom-comments.php

@@ -19 +19 @@
             printf(ent2ncr(__('Comments on %s')), get_the_title_rss());
         elseif ( is_search() )
-            printf(ent2ncr(__('Comments for %1$s searching on %2$s')), get_bloginfo_rss( 'name' ), esc_attr(get_search_query()));
+            printf(ent2ncr(__('Comments for %1$s searching on %2$s')), get_bloginfo_rss( 'name' ), get_search_query() );
         else
             printf(ent2ncr(__('Comments for %s')), get_bloginfo_rss( 'name' ) . get_wp_title_rss());
@@ -32 +32 @@
     <id><?php echo get_post_comments_feed_link('', 'atom'); ?></id>
 <?php } elseif(is_search()) { ?>
-    <link rel="alternate" type="<?php bloginfo_rss('html_type'); ?>" href="<?php echo home_url() . '?s=' . esc_attr(get_search_query()); ?>" />
+    <link rel="alternate" type="<?php bloginfo_rss('html_type'); ?>" href="<?php echo home_url() . '?s=' . get_search_query(); ?>" />
     <link rel="self" type="application/atom+xml" href="<?php echo get_search_comments_feed_link('', 'atom'); ?>" />
     <id><?php echo get_search_comments_feed_link('', 'atom'); ?></id>

trunk/wp-includes/general-template.php

@@ -157 +157 @@
     $form = '<form role="search" method="get" id="searchform" action="' . home_url() . '/" >
     <div><label class="screen-reader-text" for="s">' . __('Search for:') . '</label>
-    <input type="text" value="' . esc_attr(apply_filters('the_search_query', get_search_query())) . '" name="s" id="s" />
+    <input type="text" value="' . get_search_query() . '" name="s" id="s" />
     <input type="submit" id="searchsubmit" value="'. esc_attr__('Search') .'" />
     </div>
@@ -1643 +1643 @@
         $href = get_author_feed_link( $author_id );
     } elseif ( is_search() ) {
-        $title = esc_attr(sprintf( $args['searchtitle'], get_bloginfo('name'), $args['separator'], get_search_query() ));
+        $title = esc_attr(sprintf( $args['searchtitle'], get_bloginfo('name'), $args['separator'], get_search_query( false ) ));
         $href = get_search_feed_link();
     }
@@ -1826 +1826 @@
  * Retrieve the contents of the search WordPress query variable.
  *
- * @since 2.3.0
- *
- * @return string
- */
-function get_search_query() {
-    return apply_filters( 'get_search_query', get_query_var( 's' ) );
-}
-
-/**
- * Display the contents of the search query variable.
- *
  * The search query string is passed through {@link esc_attr()}
  * to ensure that it is safe for placing in an html attribute.
  *
- * @uses attr
+ * @since 2.3.0
+ * @uses esc_attr()
+ *
+ * @param bool $escaped Whether the result is escaped. Default true.
+ *  Only use when you are later escaping it. Do not use unescaped.
+ * @return string
+ */
+function get_search_query( $escaped = true ) {
+    $query = apply_filters( 'get_search_query', get_query_var( 's' ) );
+    if ( $escaped )
+        $query = esc_attr( $query );
+    return $query;
+}
+
+/**
+ * Display the contents of the search query variable.
+ *
+ * The search query string is passed through {@link esc_attr()}
+ * to ensure that it is safe for placing in an html attribute.
+ *
+ * @uses esc_attr()
  * @since 2.1.0
  */
 function the_search_query() {
-    echo esc_attr( apply_filters( 'the_search_query', get_search_query() ) );
+    echo esc_attr( apply_filters( 'the_search_query', get_search_query( false ) ) );
 }
 

trunk/wp-includes/link-template.php

@@ -687 +687 @@
 
     if ( empty($query) )
-        $search = get_search_query();
+        $search = get_search_query( false );
     else
         $search = stripslashes($query);