Changeset 16431 for trunk/wp-admin/includes/template.php

Timestamp:

11/17/2010 05:12:01 PM (14 years ago)

Author:

markjaquith

Message:

esc_textarea() and application for obvious textarea escaping. props alexkingorg. fixes #15454

File:

• trunk/wp-admin/includes/template.php (modified) (2 diffs)

trunk/wp-admin/includes/template.php

@@ -484 +484 @@
 
     $entry['meta_key'] = esc_attr($entry['meta_key']);
-    $entry['meta_value'] = htmlspecialchars($entry['meta_value']); // using a <textarea />
+    $entry['meta_value'] = esc_textarea( $entry['meta_value'] ); // using a <textarea />
     $entry['meta_id'] = (int) $entry['meta_id'];
 
@@ -719 +719 @@
     <tr>
         <th scope="row"><?php _e( 'URL' ) ?></th>
-        <td><textarea rows="1" cols="40" type="text" class="attachmentlinks" readonly="readonly"><?php echo wp_get_attachment_url(); ?></textarea></td>
+        <td><textarea rows="1" cols="40" type="text" class="attachmentlinks" readonly="readonly"><?php echo esc_textarea( wp_get_attachment_url() ); ?></textarea></td>
     </tr>
 <?php if ( $icon ) : ?>