Changeset 13978 for trunk/wp-includes/general-template.php

Timestamp:

04/03/2010 11:38:38 PM (15 years ago)

Author:

nacin

Message:

Have get_search_query() escape by default, like it's echoing counterpart the_search_query(). see #12780

File:

• trunk/wp-includes/general-template.php (modified) (3 diffs)

trunk/wp-includes/general-template.php

@@ -157 +157 @@
     $form = '<form role="search" method="get" id="searchform" action="' . home_url() . '/" >
     <div><label class="screen-reader-text" for="s">' . __('Search for:') . '</label>
-    <input type="text" value="' . esc_attr(apply_filters('the_search_query', get_search_query())) . '" name="s" id="s" />
+    <input type="text" value="' . get_search_query() . '" name="s" id="s" />
     <input type="submit" id="searchsubmit" value="'. esc_attr__('Search') .'" />
     </div>
@@ -1643 +1643 @@
         $href = get_author_feed_link( $author_id );
     } elseif ( is_search() ) {
-        $title = esc_attr(sprintf( $args['searchtitle'], get_bloginfo('name'), $args['separator'], get_search_query() ));
+        $title = esc_attr(sprintf( $args['searchtitle'], get_bloginfo('name'), $args['separator'], get_search_query( false ) ));
         $href = get_search_feed_link();
     }
@@ -1826 +1826 @@
  * Retrieve the contents of the search WordPress query variable.
  *
- * @since 2.3.0
- *
- * @return string
- */
-function get_search_query() {
-    return apply_filters( 'get_search_query', get_query_var( 's' ) );
-}
-
-/**
- * Display the contents of the search query variable.
- *
  * The search query string is passed through {@link esc_attr()}
  * to ensure that it is safe for placing in an html attribute.
  *
- * @uses attr
+ * @since 2.3.0
+ * @uses esc_attr()
+ *
+ * @param bool $escaped Whether the result is escaped. Default true.
+ *  Only use when you are later escaping it. Do not use unescaped.
+ * @return string
+ */
+function get_search_query( $escaped = true ) {
+    $query = apply_filters( 'get_search_query', get_query_var( 's' ) );
+    if ( $escaped )
+        $query = esc_attr( $query );
+    return $query;
+}
+
+/**
+ * Display the contents of the search query variable.
+ *
+ * The search query string is passed through {@link esc_attr()}
+ * to ensure that it is safe for placing in an html attribute.
+ *
+ * @uses esc_attr()
  * @since 2.1.0
  */
 function the_search_query() {
-    echo esc_attr( apply_filters( 'the_search_query', get_search_query() ) );
+    echo esc_attr( apply_filters( 'the_search_query', get_search_query( false ) ) );
 }