WordPress.org
Get WordPress

Make WordPress Core

Changeset 4656


Ignore:
Timestamp:
12/21/2006 10:10:04 AM (20 years ago)
Author:
markjaquith
Message:

new function for escaping within attributes: attribute_escape()

Files:
70 edited

Legend:

Unmodified
Added
Removed

  • branches/2.0/wp-admin/admin-functions.php

    r4640 r4656  
    290290                $text       = wp_specialchars(stripslashes(urldecode($_REQUEST['text'])));
    291291                $text       = funky_javascript_fix($text);
    292                 $popupurl   = wp_specialchars($_REQUEST['popupurl']);
     292                $popupurl   = attribute_escape(stripslashes($_REQUEST['popupurl']));
    293293        $post_content = '<a href="'.$popupurl.'">'.$post_title.'</a>'."\n$text";
    294294    }
    … …  
    338338function get_user_to_edit($user_id) {
    339339        $user = new WP_User($user_id);
    340         $user->user_login = wp_specialchars($user->user_login, 1);
    341         $user->user_email = wp_specialchars($user->user_email, 1);
    342         $user->user_url = wp_specialchars($user->user_url, 1);
    343         $user->first_name = wp_specialchars($user->first_name, 1);
    344         $user->last_name = wp_specialchars($user->last_name, 1);
    345         $user->display_name = wp_specialchars($user->display_name, 1);
    346         $user->nickname = wp_specialchars($user->nickname, 1);
    347         $user->aim = wp_specialchars($user->aim, 1);
    348         $user->yim = wp_specialchars($user->yim, 1);
    349         $user->jabber = wp_specialchars($user->jabber, 1);
     340        $user->user_login = attribute_escape($user->user_login);
     341        $user->user_email = attribute_escape($user->user_email);
     342        $user->user_url = attribute_escape($user->user_url);
     343        $user->first_name = attribute_escape($user->first_name);
     344        $user->last_name = attribute_escape($user->last_name);
     345        $user->display_name = attribute_escape($user->display_name);
     346        $user->nickname = attribute_escape($user->nickname);
     347        $user->aim = attribute_escape($user->aim);
     348        $user->yim = attribute_escape($user->yim);
     349        $user->jabber = attribute_escape($user->jabber);
    350350        $user->description = wp_specialchars($user->description);
    351351
    … …  
    468468        $link = get_link($link_id);
    469469
    470         $link->link_url = wp_specialchars($link->link_url, 1);
    471         $link->link_name = wp_specialchars($link->link_name, 1);
    472         $link->link_image = wp_specialchars($link->link_image, 1);
    473         $link->link_description = wp_specialchars($link->link_description, 1);
     470        $link->link_url = attribute_escape($link->link_url);
     471        $link->link_name = attribute_escape($link->link_name);
     472        $link->link_image = attribute_escape($link->link_image);
     473        $link->link_description = attribute_escape($link->link_description);
    474474        $link->link_notes = wp_specialchars($link->link_notes);
    475         $link->link_rss = wp_specialchars($link->link_rss, 1);
    476         $link->link_rel = wp_specialchars($link->link_rel, 1);
     475        $link->link_rss = attribute_escape($link->link_rss);
     476        $link->link_rel = attribute_escape($link->link_rel);
    477477        $link->post_category = $link->link_category;
    478478
    … …  
    482482function get_default_link_to_edit() {
    483483        if ( isset($_GET['linkurl']) )
    484                 $link->link_url = wp_specialchars($_GET['linkurl'], 1);
     484                $link->link_url = attribute_escape($_GET['linkurl']);
    485485        else
    486486                $link->link_url = '';
    487487       
    488488        if ( isset($_GET['name']) )
    489                 $link->link_name = wp_specialchars($_GET['name'], 1);
     489                $link->link_name = attribute_escape($_GET['name']);
    490490        else
    491491                $link->link_name = '';
    … …  
    861861                }
    862862
    863                 $entry['meta_key'] = wp_specialchars( $entry['meta_key'], true );
    864                 $entry['meta_value'] = wp_specialchars( $entry['meta_value'], true );
     863                $entry['meta_key'] = attribute_escape( $entry['meta_key']);
     864                $entry['meta_value'] = attribute_escape( $entry['meta_value']);
    865865                echo "
    866866                        <tr class='$style'>
    … …  
    913913
    914914        foreach ($keys as $key) {
    915                 $key = wp_specialchars($key, 1);
     915                $key = attribute_escape($key);
    916916                echo "\n\t<option value='$key'>$key</option>";
    917917        }

  • branches/2.0/wp-admin/bookmarklet.php

    r2972 r4656  
    3838 
    3939$content  = wp_specialchars($_REQUEST['content']);
    40 $popupurl = wp_specialchars($_REQUEST['popupurl']);
     40$popupurl = attribute_escape(stripslashes($_REQUEST['popupurl']));
    4141    if ( !empty($content) ) {
    4242        $post->post_content = wp_specialchars( stripslashes($_REQUEST['content']) );

  • branches/2.0/wp-admin/categories.php

    r4470 r4656  
    7070                <tr>
    7171                  <th width="33%" scope="row"><?php _e('Category name:') ?></th>
    72                   <td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($category->cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
     72                  <td width="67%"><input name="cat_name" type="text" value="<?php echo attribute_escape($category->cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
    7373<input type="hidden" name="cat_ID" value="<?php echo $category->cat_ID ?>" /></td>
    7474                </tr>
    7575                <tr>
    7676                        <th scope="row"><?php _e('Category slug:') ?></th>
    77                         <td><input name="category_nicename" type="text" value="<?php echo wp_specialchars($category->category_nicename); ?>" size="40" /></td>
     77                        <td><input name="category_nicename" type="text" value="<?php echo attribute_escape($category->category_nicename); ?>" size="40" /></td>
    7878                </tr>
    7979                <tr>
    … …  
    8787                <tr>
    8888                        <th scope="row"><?php _e('Description:') ?></th>
    89                         <td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description, 1); ?></textarea></td>
     89                        <td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description); ?></textarea></td>
    9090                </tr>
    9191                </table>

  • branches/2.0/wp-admin/edit-comments.php

    r3945 r4656  
    88require_once('admin-header.php');
    99if (empty($_GET['mode'])) $mode = 'view';
    10 else $mode = wp_specialchars($_GET['mode'], 1);
     10else $mode = attribute_escape($_GET['mode']);
    1111?>
    1212
    … …  
    3131  <fieldset>
    3232  <legend><?php _e('Show Comments That Contain...') ?></legend>
    33   <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo wp_specialchars($_GET['s'], 1); ?>" size="17" />
     33  <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo attribute_escape($_GET['s']); ?>" size="17" />
    3434  <input type="submit" name="submit" value="<?php _e('Search') ?>"  /> 
    3535  <input type="hidden" name="mode" value="<?php echo $mode; ?>" />

  • branches/2.0/wp-admin/edit-form-advanced.php

    r4632 r4656  
    212212<input name="referredby" type="hidden" id="referredby" value="<?php
    213213if ( !empty($_REQUEST['popupurl']) )
    214         echo wp_specialchars($_REQUEST['popupurl']);
    215 else if ( url_to_postid(wp_get_referer()) == $post_ID )
     214        echo attribute_escape(stripslashes($_REQUEST['popupurl']));
     215else if ( url_to_postid(stripslashes(wp_get_referer())) == $post_ID )
    216216        echo 'redo';
    217217else
    218         echo wp_specialchars(wp_get_referer());
     218        echo attribute_escape(stripslashes(wp_get_referer()));
    219219?>" /></p>
    220220

  • branches/2.0/wp-admin/edit-link-form.php

    r3977 r4656  
    231231          <input type="hidden" name="action" value="editlink" />
    232232          <input type="hidden" name="link_id" value="<?php echo (int) $link_id; ?>" />
    233           <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
     233          <input type="hidden" name="order_by" value="<?php echo attribute_escape($order_by); ?>" />
    234234          <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
    235235<?php else: ?>

  • branches/2.0/wp-admin/edit-page-form.php

    r4242 r4656  
    1515}
    1616
    17 $sendto = wp_get_referer();
     17$sendto = attribute_escape(wp_get_referer());
    1818
    1919if ( 0 != $post_ID && $sendto == get_permalink($post_ID) )
    2020        $sendto = 'redo';
    21 $sendto = wp_specialchars( $sendto );
    2221
    2322?>

  • branches/2.0/wp-admin/edit-pages.php

    r3906 r4656  
    1414  <fieldset>
    1515  <legend><?php _e('Search Pages&hellip;') ?></legend>
    16   <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo wp_specialchars($_GET['s'], 1); ?>" size="17" />
     16  <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo attribute_escape($_GET['s']); ?>" size="17" />
    1717  <input type="submit" name="submit" value="<?php _e('Search') ?>"  />
    1818  </fieldset>

  • branches/2.0/wp-admin/edit.php

    r3805 r4656  
    8080  <fieldset>
    8181  <legend><?php _e('Search Posts&hellip;') ?></legend>
    82   <input type="text" name="s" value="<?php if (isset($s)) echo wp_specialchars($s, 1); ?>" size="17" />
     82  <input type="text" name="s" value="<?php if (isset($s)) echo attribute_escape($s); ?>" size="17" />
    8383  <input type="submit" name="submit" value="<?php _e('Search') ?>"  />
    8484  </fieldset>

  • branches/2.0/wp-admin/inline-uploading.php

    r4416 r4656  
    241241                        $ypadding = (96 - $image['uheight']) / 2;
    242242                        $style .= "#target{$ID} img { padding: {$ypadding}px {$xpadding}px; }\n";
    243                         $title = wp_specialchars($image['post_title'], ENT_QUOTES);
     243                        $title = attribute_escape($image['post_title']);
    244244                        $script .= "aa[{$ID}] = '<a id=\"p{$ID}\" rel=\"attachment\" class=\"imagelink\" href=\"$href\" onclick=\"doPopup({$ID});return false;\" title=\"{$title}\">';
    245245ab[{$ID}] = '<a class=\"imagelink\" href=\"{$image['guid']}\" onclick=\"doPopup({$ID});return false;\" title=\"{$title}\">';
    … …  
    261261";
    262262                } else {
    263                         $title = wp_specialchars($attachment['post_title'], ENT_QUOTES);
     263                        $title = attribute_escape($attachment['post_title']);
    264264                        $filename = basename($attachment['guid']);
    265265                        $icon = get_attachment_icon($ID);

  • branches/2.0/wp-admin/link-categories.php

    r4341 r4656  
    125125<tr>
    126126        <th width="33%" scope="row"><?php _e('Name:') ?></th>
    127         <td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($row->cat_name)?>" size="30" /></td>
     127        <td width="67%"><input name="cat_name" type="text" value="<?php echo attribute_escape($row->cat_name)?>" size="30" /></td>
    128128</tr>
    129129<tr>

  • branches/2.0/wp-admin/link-manager.php

    r4470 r4656  
    328328    <input type="hidden" name="link_id" value="" />
    329329    <input type="hidden" name="action" value="" />
    330     <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
     330    <input type="hidden" name="order_by" value="<?php echo attribute_escape($order_by); ?>" />
    331331    <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
    332332  <table id="the-list-x" width="100%" cellpadding="3" cellspacing="3">
    … …  
    358358    if ($links) {
    359359        foreach ($links as $link) {
    360             $link->link_name = wp_specialchars($link->link_name);
     360            $link->link_name = attribute_escape($link->link_name);
    361361            $link->link_category = wp_specialchars($link->link_category);
    362362            $link->link_description = wp_specialchars($link->link_description);
    363             $link->link_url = wp_specialchars($link->link_url);
     363            $link->link_url = attribute_escape($link->link_url);
    364364            $short_url = str_replace('http://', '', $link->link_url);
    365365            $short_url = str_replace('www.', '', $short_url);

  • branches/2.0/wp-admin/options-misc.php

    r4229 r4656  
    1818<tr valign="top">
    1919<th scope="row"><?php _e('Store uploads in this folder'); ?>:</th>
    20 <td><input name="upload_path" type="text" id="upload_path" class="code" value="<?php echo wp_specialchars(str_replace(ABSPATH, '', get_settings('upload_path')), 1); ?>" size="40" />
     20<td><input name="upload_path" type="text" id="upload_path" class="code" value="<?php echo attribute_escape(str_replace(ABSPATH, '', get_settings('upload_path'))); ?>" size="40" />
    2121<br />
    2222<?php _e('Default is <code>wp-content/uploads</code>'); ?>

  • branches/2.0/wp-admin/options-permalink.php

    r4229 r4656  
    149149<br />
    150150</p>
    151 <p id="customstructure"><?php _e('Custom structure'); ?>: <input name="permalink_structure" id="permalink_structure" type="text" class="code" style="width: 60%;" value="<?php echo wp_specialchars($permalink_structure, 1); ?>" size="50" /></p>
     151<p id="customstructure"><?php _e('Custom structure'); ?>: <input name="permalink_structure" id="permalink_structure" type="text" class="code" style="width: 60%;" value="<?php echo attribute_escape($permalink_structure); ?>" size="50" /></p>
    152152
    153153<h3><?php _e('Optional'); ?></h3>
    … …  
    158158<?php endif; ?>
    159159        <p>
    160   <?php _e('Category base'); ?>: <input name="category_base" type="text" class="code"  value="<?php echo wp_specialchars($category_base, 1); ?>" size="30" />
     160  <?php _e('Category base'); ?>: <input name="category_base" type="text" class="code"  value="<?php echo attribute_escape($category_base); ?>" size="30" />
    161161     </p>
    162162    <p class="submit">

  • branches/2.0/wp-admin/options.php

    r4384 r4656  
    183183  </table>
    184184<?php $options_to_update = implode(',', $options_to_update); ?>
    185 <p class="submit"><input type="hidden" name="page_options" value="<?php echo wp_specialchars($options_to_update, true); ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p>
     185<p class="submit"><input type="hidden" name="page_options" value="<?php echo attribute_escape($options_to_update); ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p>
    186186  </form>
    187187</div>

  • branches/2.0/wp-admin/post.php

    r4470 r4656  
    8282        <div id='preview' class='wrap'>
    8383        <h2 id="preview-post"><?php _e('Post Preview (updated when post is saved)'); ?> <small class="quickjump"><a href="#write-post"><?php _e('edit &uarr;'); ?></a></small></h2>
    84                 <iframe src="<?php echo wp_specialchars(apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
     84                <iframe src="<?php echo attribute_escape(apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
    8585        </div>
    8686        <?php

  • branches/2.0/wp-admin/templates.php

    r4416 r4656  
    112112echo '<ol>';
    113113foreach ($recents as $recent) :
    114         echo "<li><a href='templates.php?file=" . wp_specialchars($recent, true) . "'>" . get_file_description(basename($recent)) . "</a></li>";
     114        echo "<li><a href='templates.php?file=" . attribute_escape($recent) . "'>" . get_file_description(basename($recent)) . "</a></li>";
    115115endforeach;
    116116echo '</ol>';

  • branches/2.0/wp-admin/theme-editor.php

    r4269 r4656  
    102102                if ($theme_name == $theme) $selected = " selected='selected'";
    103103                else $selected = '';
    104                 $theme_name = wp_specialchars($theme_name, true);
     104                $theme_name = attribute_escape($theme_name);
    105105                echo "\n\t<option value=\"$theme_name\" $selected>$theme_name</option>";
    106106        }

  • branches/2.0/wp-admin/upgrade.php

    r3923 r4656  
    6868
    6969        case 0:
    70         $goback = wp_specialchars(wp_get_referer());
     70        $goback = attribute_escape(stripslashes(wp_get_referer()));
    7171?>
    7272<p><?php _e('This file upgrades you from any previous version of WordPress to the latest. It may take a while though, so be patient.'); ?></p>
    … …  
    8787                $backto = __get_option('home');
    8888        else
    89                 $backto = wp_specialchars( $_GET['backto'] , 1 );
     89                $backto = attribute_escape(stripslashes($_GET['backto']));
    9090?>
    9191<h2><?php _e('Step 1'); ?></h2>

  • branches/2.0/wp-content/themes/classic/comments-popup.php

    r3903 r4656  
    6161           <label for="author"><?php _e("Name"); ?></label>
    6262        <input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
    63         <input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER["REQUEST_URI"]); ?>" />
     63        <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($_SERVER["REQUEST_URI"]); ?>" />
    6464        </p>
    6565

  • branches/2.0/wp-content/themes/default/comments-popup.php

    r3925 r4656  
    6161           <label for="author">Name</label>
    6262        <input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
    63         <input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER["REQUEST_URI"]); ?>" />
     63        <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($_SERVER["REQUEST_URI"]); ?>" />
    6464        </p>
    6565

  • branches/2.0/wp-content/themes/default/searchform.php

    r3134 r4656  
    11<form method="get" id="searchform" action="<?php bloginfo('home'); ?>/">
    2 <div><input type="text" value="<?php echo wp_specialchars($s, 1); ?>" name="s" id="s" />
     2<div><input type="text" value="<?php echo attribute_escape($s); ?>" name="s" id="s" />
    33<input type="submit" id="searchsubmit" value="Search" />
    44</div>

  • branches/2.0/wp-includes/comment-functions.php

    r4300 r4656  
    316316                        echo ' class="'.$CSSclass.'"';
    317317                }
    318                 $title = wp_specialchars(apply_filters('the_title', get_the_title()), true);
     318                $title = attribute_escape(apply_filters('the_title', get_the_title()));
    319319                echo ' title="' . sprintf( __('Comment on %s'), $title ) .'">';
    320320                comments_number($zero, $one, $more, $number);
    … …  
    898898                $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]);
    899899                $comment_author = stripslashes($comment_author);
    900                 $comment_author = wp_specialchars($comment_author, true);
     900                $comment_author = attribute_escape($comment_author);
    901901                $_COOKIE['comment_author_'.COOKIEHASH] = $comment_author;
    902902        }
    … …  
    905905                $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]);
    906906                $comment_author_email = stripslashes($comment_author_email);
    907                 $comment_author_email = wp_specialchars($comment_author_email, true);   
     907                $comment_author_email = attribute_escape($comment_author_email);       
    908908                $_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email;
    909909        }
    … …  
    912912                $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
    913913                $comment_author_url = stripslashes($comment_author_url);
    914                 $comment_author_url = wp_specialchars($comment_author_url, true);
     914                $comment_author_url = attribute_escape($comment_author_url);
    915915                $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
    916916        }

  • branches/2.0/wp-includes/functions-formatting.php

    r4387 r4656  
    10511051        return preg_replace("/\r?\n/", "\\n", addslashes($text));
    10521052}
     1053
     1054// Escaping for HTML attributes like
     1055function attribute_escape($text) {
     1056        return wp_specialchars($text, true);
     1057}
     1058
    10531059?>

  • branches/2.0/wp-includes/functions.php

    r4581 r4656  
    350350
    351351function form_option($option) {
    352         echo wp_specialchars( get_option($option), 1 );
     352        echo attribute_escape( get_option($option));
    353353}
    354354
    … …  
    23632363
    23642364function wp_referer_field() {
    2365         $ref = wp_specialchars($_SERVER['REQUEST_URI']);
     2365        $ref = attribute_escape(stripslashes($_SERVER['REQUEST_URI']));
    23662366        echo '<input type="hidden" name="_wp_http_referer" value="'. $ref . '" />';
    23672367        if ( wp_get_original_referer() ) {
    2368                 $original_ref = wp_specialchars(stripslashes(wp_get_original_referer()));
     2368                $original_ref = attribute_escape(stripslashes(wp_get_original_referer()));
    23692369                echo '<input type="hidden" name="_wp_original_http_referer" value="'. $original_ref . '" />';
    23702370        }
    … …  
    23722372
    23732373function wp_original_referer_field() {
    2374         echo '<input type="hidden" name="_wp_original_http_referer" value="' . wp_specialchars(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
     2374        echo '<input type="hidden" name="_wp_original_http_referer" value="' . attribute_escape(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
    23752375}
    23762376
    … …  
    24572457        $adminurl = get_settings('siteurl') . '/wp-admin';
    24582458        if ( wp_get_referer() )
    2459                 $adminurl = wp_get_referer();
     2459                $adminurl = attribute_escape(stripslashes(wp_get_referer()));
    24602460
    24612461        $title = __('WordPress Confirmation');
    … …  
    24692469                        $v = substr(strstr($a, '='), 1);
    24702470                        $k = substr($a, 0, -(strlen($v)+1));
    2471                         $html .= "\t\t<input type='hidden' name='" . wp_specialchars( urldecode($k), 1 ) . "' value='" . wp_specialchars( urldecode($v), 1 ) . "' />\n";
     2471                        $html .= "\t\t<input type='hidden' name='" . attribute_escape( urldecode($k)) . "' value='" . attribute_escape( urldecode($v)) . "' />\n";
    24722472                }
    24732473                $html .= "\t\t<input type='hidden' name='_wpnonce' value='" . wp_create_nonce($action) . "' />\n";
    24742474                $html .= "\t\t<div id='message' class='confirm fade'>\n\t\t<p>" . wp_explain_nonce($action) . "</p>\n\t\t<p><a href='$adminurl'>" . __('No') . "</a> <input type='submit' value='" . __('Yes') . "' /></p>\n\t\t</div>\n\t</form>\n";
    24752475        } else {
    2476                 $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_explain_nonce($action) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] ) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
     2476                $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_explain_nonce($action) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . attribute_escape(add_query_arg('_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'])) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
    24772477        }
    24782478        $html .= "</body>\n</html>";

  • branches/2.0/wp-includes/links.php

    r3762 r4656  
    213213                $the_link = '#';
    214214                if (!empty($row->link_url))
    215                         $the_link = wp_specialchars($row->link_url);
     215                        $the_link = attribute_escape($row->link_url);
    216216
    217217                $rel = $row->link_rel;
    … …  
    220220                }
    221221
    222                 $desc = wp_specialchars($row->link_description, ENT_QUOTES);
    223                 $name = wp_specialchars($row->link_name, ENT_QUOTES);
     222                $desc = attribute_escape($row->link_description);
     223                $name = attribute_escape($row->link_name);
    224224                $title = $desc;
    225225

  • branches/2.0/wp-includes/template-functions-author.php

    r4496 r4656  
    132132        global $authordata;
    133133
    134         echo '<a href="' . get_author_link(0, $authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars(get_the_author())) . '">' . get_the_author() . '</a>';
     134        echo '<a href="' . get_author_link(0, $authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), attribute_escape(get_the_author())) . '">' . get_the_author() . '</a>';
    135135}
    136136
    … …  
    198198                                $link = $name;
    199199                } else {
    200                         $link = '<a href="' . get_author_link(0, $author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars($author->display_name)) . '">' . $name . '</a>';
     200                        $link = '<a href="' . get_author_link(0, $author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), attribute_escape($author->display_name)) . '">' . $name . '</a>';
    201201
    202202                        if ( (! empty($feed_image)) || (! empty($feed)) ) {

  • branches/2.0/wp-includes/template-functions-category.php

    r4280 r4656  
    324324                        $link = '<a href="'.get_category_link($category->cat_ID).'" ';
    325325                        if ( $use_desc_for_title == 0 || empty($category->category_description) )
    326                                 $link .= 'title="'. sprintf(__("View all posts filed under %s"), wp_specialchars($category->cat_name)) . '"';
     326                                $link .= 'title="'. sprintf(__("View all posts filed under %s"), attribute_escape($category->cat_name)) . '"';
    327327                        else
    328                                 $link .= 'title="' . wp_specialchars(apply_filters('category_description',$category->category_description,$category)) . '"';
     328                                $link .= 'title="' . attribute_escape(apply_filters('category_description',$category->category_description,$category)) . '"';
    329329                        $link .= '>';
    330330                        $link .= apply_filters('list_cats', $category->cat_name, $category).'</a>';

  • branches/2.0/wp-includes/template-functions-general.php

    r4641 r4656  
    264264function get_archives_link($url, $text, $format = 'html', $before = '', $after = '') {
    265265        $text = wptexturize($text);
    266         $title_text = wp_specialchars($text, 1);
     266        $title_text = attribute_escape($text);
    267267
    268268        if ('link' == $format)

  • branches/2.0/wp-includes/template-functions-post.php

    r4604 r4656  
    419419        foreach ( $page_tree[$parent]['children'] as $page_id ) {
    420420                $cur_page = $page_tree[$page_id];
    421                 $title = wp_specialchars($cur_page['title']);
     421                $title = attribute_escape($cur_page['title']);
    422422
    423423                $css_class = 'page_item';

  • branches/2.0/wp-links-opml.php

    r3470 r4656  
    4545             } // end if not first time
    4646?>
    47         <outline type="category" title="<?php echo wp_specialchars($result->cat_name); ?>">
     47        <outline type="category" title="<?php echo attribute_escape($result->cat_name); ?>">
    4848<?php
    4949             $prev_cat_id = $result->link_category;
    5050        } // end if new category
    5151?>
    52             <outline text="<?php echo wp_specialchars($result->link_name); ?>" type="link" xmlUrl="<?php echo wp_specialchars($result->link_rss); ?>" htmlUrl="<?php echo wp_specialchars($result->link_url); ?>" updated="<?php if ('0000-00-00 00:00:00' != $result->link_updated) echo $result->link_updated; ?>" />
     52            <outline text="<?php echo attribute_escape($result->link_name); ?>" type="link" xmlUrl="<?php echo attribute_escape($result->link_rss); ?>" htmlUrl="<?php echo attribute_escape($result->link_url); ?>" updated="<?php if ('0000-00-00 00:00:00' != $result->link_updated) echo $result->link_updated; ?>" />
    5353<?php
    5454        } // end foreach

  • branches/2.0/wp-login.php

    r4581 r4656  
    232232
    233233<form name="loginform" id="loginform" action="wp-login.php" method="post">
    234 <p><label><?php _e('Username:') ?><br /><input type="text" name="log" id="log" value="<?php echo wp_specialchars(stripslashes($user_login), 1); ?>" size="20" tabindex="1" /></label></p>
     234<p><label><?php _e('Username:') ?><br /><input type="text" name="log" id="log" value="<?php echo attribute_escape(stripslashes($user_login)); ?>" size="20" tabindex="1" /></label></p>
    235235<p><label><?php _e('Password:') ?><br /> <input type="password" name="pwd" id="pwd" value="" size="20" tabindex="2" /></label></p>
    236236<p>
    … …  
    239239<p class="submit">
    240240        <input type="submit" name="submit" id="submit" value="<?php _e('Login'); ?> &raquo;" tabindex="4" />
    241         <input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($redirect_to); ?>" />
     241        <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($redirect_to); ?>" />
    242242</p>
    243243</form>

  • branches/2.0/wp-register.php

    r3630 r4656  
    114114<form method="post" action="wp-register.php" id="registerform">
    115115        <p><input type="hidden" name="action" value="register" />
    116         <label for="user_login"><?php _e('Username:') ?></label><br /> <input type="text" name="user_login" id="user_login" size="20" maxlength="20" value="<?php echo wp_specialchars($user_login); ?>" /><br /></p>
    117         <p><label for="user_email"><?php _e('E-mail:') ?></label><br /> <input type="text" name="user_email" id="user_email" size="25" maxlength="100" value="<?php echo wp_specialchars($user_email); ?>" /></p>
     116        <label for="user_login"><?php _e('Username:') ?></label><br /> <input type="text" name="user_login" id="user_login" size="20" maxlength="20" value="<?php echo attribute_escape($user_login); ?>" /><br /></p>
     117        <p><label for="user_email"><?php _e('E-mail:') ?></label><br /> <input type="text" name="user_email" id="user_email" size="25" maxlength="100" value="<?php echo attribute_escape($user_email); ?>" /></p>
    118118        <p><?php _e('A password will be emailed to you.') ?></p>
    119119        <p class="submit"><input type="submit" value="<?php _e('Register') ?> &raquo;" id="submit" name="submit" /></p>

  • trunk/wp-admin/admin-ajax.php

    r4583 r4656  
    1414
    1515function wp_ajax_meta_row( $pid, $mid, $key, $value ) {
    16         $value = wp_specialchars($value, true);
     16        $value = attribute_escape($value);
    1717        $key_js = addslashes(wp_specialchars($key, 'double'));
    18         $key = wp_specialchars($key, true);
     18        $key = attribute_escape($key);
    1919        $r .= "<tr id='meta-$mid'><td valign='top'>";
    2020        $r .= "<input name='meta[$mid][key]' tabindex='6' onkeypress='return killSubmit(\"theList.ajaxUpdater(&#039;meta&#039;,&#039;meta-$mid&#039;);\",event);' type='text' size='20' value='$key' />";
    … …  
    142142                $level++;
    143143        }
    144         $cat_full_name = wp_specialchars( $cat_full_name, 1 );
     144        $cat_full_name = attribute_escape( $cat_full_name);
    145145
    146146        $x = new WP_Ajax_Response( array(

  • trunk/wp-admin/admin-functions.php

    r4651 r4656  
    324324                $text       = wp_specialchars( stripslashes( urldecode( $_REQUEST['text'] ) ) );
    325325                $text       = funky_javascript_fix( $text);
    326                 $popupurl   = wp_specialchars( $_REQUEST['popupurl'] );
     326                $popupurl   = attribute_escape($_REQUEST['popupurl']);
    327327        $post_content = '<a href="'.$popupurl.'">'.$post_title.'</a>'."\n$text";
    328328    }
    … …  
    381381function get_user_to_edit( $user_id ) {
    382382        $user = new WP_User( $user_id );
    383         $user->user_login = wp_specialchars( $user->user_login, 1 );
    384         $user->user_email = wp_specialchars( $user->user_email, 1 );
    385         $user->user_url = wp_specialchars( $user->user_url, 1 );
    386         $user->first_name = wp_specialchars( $user->first_name, 1 );
    387         $user->last_name = wp_specialchars( $user->last_name, 1 );
    388         $user->display_name = wp_specialchars( $user->display_name, 1 );
    389         $user->nickname = wp_specialchars( $user->nickname, 1 );
    390         $user->aim = wp_specialchars( $user->aim, 1 );
    391         $user->yim = wp_specialchars( $user->yim, 1 );
    392         $user->jabber = wp_specialchars( $user->jabber, 1 );
     383        $user->user_login = attribute_escape( $user->user_login);
     384        $user->user_email = attribute_escape( $user->user_email);
     385        $user->user_url = attribute_escape( $user->user_url);
     386        $user->first_name = attribute_escape( $user->first_name);
     387        $user->last_name = attribute_escape( $user->last_name);
     388        $user->display_name = attribute_escape( $user->display_name);
     389        $user->nickname = attribute_escape( $user->nickname);
     390        $user->aim = attribute_escape( $user->aim);
     391        $user->yim = attribute_escape( $user->yim);
     392        $user->jabber = attribute_escape( $user->jabber);
    393393        $user->description = wp_specialchars( $user->description );
    394394
    … …  
    528528        $link = get_link( $link_id );
    529529
    530         $link->link_url = wp_specialchars( $link->link_url, 1 );
    531         $link->link_name = wp_specialchars( $link->link_name, 1 );
    532         $link->link_image = wp_specialchars( $link->link_image, 1 );
    533         $link->link_description = wp_specialchars( $link->link_description, 1 );
     530        $link->link_url = attribute_escape( $link->link_url);
     531        $link->link_name = attribute_escape( $link->link_name);
     532        $link->link_image = attribute_escape( $link->link_image);
     533        $link->link_description = attribute_escape( $link->link_description);
    534534        $link->link_notes = wp_specialchars( $link->link_notes );
    535         $link->link_rss = wp_specialchars( $link->link_rss, 1 );
    536         $link->link_rel = wp_specialchars( $link->link_rel, 1 );
     535        $link->link_rss = attribute_escape( $link->link_rss);
     536        $link->link_rel = attribute_escape( $link->link_rel);
    537537        $link->post_category = $link->link_category;
    538538
    … …  
    542542function get_default_link_to_edit() {
    543543        if ( isset( $_GET['linkurl'] ) )
    544                 $link->link_url = wp_specialchars( $_GET['linkurl'], 1 );
     544                $link->link_url = attribute_escape( $_GET['linkurl']);
    545545        else
    546546                $link->link_url = '';
    547547
    548548        if ( isset( $_GET['name'] ) )
    549                 $link->link_name = wp_specialchars( $_GET['name'], 1 );
     549                $link->link_name = attribute_escape( $_GET['name']);
    550550        else
    551551                $link->link_name = '';
    … …  
    832832        $r .= "</td>\n\t\t<td>";
    833833        if ( current_user_can( 'edit_user', $user_object->ID ) ) {
    834                 $edit_link = wp_specialchars( add_query_arg( 'wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), "user-edit.php?user_id=$user_object->ID" ) );
     834                $edit_link = attribute_escape( add_query_arg( 'wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), "user-edit.php?user_id=$user_object->ID" ));
    835835                $r .= "<a href='$edit_link' class='edit'>".__( 'Edit' )."</a>";
    836836        }
    … …  
    912912
    913913                $key_js = js_escape( $entry['meta_key'] );
    914                 $entry['meta_key'] = wp_specialchars( $entry['meta_key'], true );
    915                 $entry['meta_value'] = wp_specialchars( $entry['meta_value'], true );
     914                $entry['meta_key'] = attribute_escape( $entry['meta_key']);
     915                $entry['meta_value'] = attribute_escape( $entry['meta_value']);
    916916                $r .= "\n\t<tr id='meta-{$entry['meta_id']}' class='$style'>";
    917917                $r .= "\n\t\t<td valign='top'><input name='meta[{$entry['meta_id']}][key]' tabindex='6' type='text' size='20' value='{$entry['meta_key']}' /></td>";
    … …  
    966966
    967967        foreach ( $keys as $key ) {
    968                 $key = wp_specialchars( $key, 1 );
     968                $key = attribute_escape( $key);
    969969                echo "\n\t<option value='$key'>$key</option>";
    970970        }
    … …  
    19931993function wp_remember_old_slug() {
    19941994        global $post;
    1995         $name = wp_specialchars($post->post_name); // just in case
     1995        $name = attribute_escape($post->post_name); // just in case
    19961996        if ( strlen($name) )
    19971997                echo '<input type="hidden" id="wp-old-slug" name="wp-old-slug" value="' . $name . '" />';

  • trunk/wp-admin/bookmarklet.php

    r4495 r4656  
    3838
    3939$content  = wp_specialchars($_REQUEST['content']);
    40 $popupurl = wp_specialchars($_REQUEST['popupurl']);
     40$popupurl = attribute_escape($_REQUEST['popupurl']);
    4141if ( !empty($content) ) {
    4242        $post->post_content = wp_specialchars( stripslashes($_REQUEST['content']) );

  • trunk/wp-admin/edit-category-form.php

    r4595 r4656  
    2727                <tr>
    2828                        <th width="33%" scope="row" valign="top"><label for="cat_name"><?php _e('Category name:') ?></label></th>
    29                         <td width="67%"><input name="cat_name" id="cat_name" type="text" value="<?php echo wp_specialchars($category->cat_name); ?>" size="40" /></td>
     29                        <td width="67%"><input name="cat_name" id="cat_name" type="text" value="<?php echo attribute_escape($category->cat_name); ?>" size="40" /></td>
    3030                </tr>
    3131                <tr>
    3232                        <th scope="row" valign="top"><label for="category_nicename"><?php _e('Category slug:') ?></label></th>
    33                         <td><input name="category_nicename" id="category_nicename" type="text" value="<?php echo wp_specialchars($category->category_nicename); ?>" size="40" /></td>
     33                        <td><input name="category_nicename" id="category_nicename" type="text" value="<?php echo attribute_escape($category->category_nicename); ?>" size="40" /></td>
    3434                </tr>
    3535                <tr>
    … …  
    4141                <tr>
    4242                        <th scope="row" valign="top"><label for="category_description"><?php _e('Description: (optional)') ?></label></th>
    43                         <td><textarea name="category_description" id="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description, 1); ?></textarea></td>
     43                        <td><textarea name="category_description" id="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description); ?></textarea></td>
    4444                </tr>
    4545        </table>

  • trunk/wp-admin/edit-comments.php

    r4655 r4656  
    88require_once('admin-header.php');
    99if (empty($_GET['mode'])) $mode = 'view';
    10 else $mode = wp_specialchars($_GET['mode'], 1);
     10else $mode = attribute_escape($_GET['mode']);
    1111?>
    1212
    … …  
    4343  <fieldset>
    4444  <legend><?php _e('Show Comments That Contain...') ?></legend>
    45   <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo wp_specialchars($_GET['s'], 1); ?>" size="17" />
     45  <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo attribute_escape($_GET['s']); ?>" size="17" />
    4646  <input type="submit" name="submit" value="<?php _e('Search') ?>"  /> 
    4747  <input type="hidden" name="mode" value="<?php echo $mode; ?>" />

  • trunk/wp-admin/edit-form-advanced.php

    r4621 r4656  
    169169<input name="referredby" type="hidden" id="referredby" value="<?php
    170170if ( !empty($_REQUEST['popupurl']) )
    171         echo wp_specialchars($_REQUEST['popupurl']);
     171        echo attribute_escape(stripslashes($_REQUEST['popupurl']));
    172172else if ( url_to_postid(wp_get_referer()) == $post_ID )
    173173        echo 'redo';
    174174else
    175         echo wp_specialchars(wp_get_referer());
     175        echo attribute_escape(stripslashes(wp_get_referer()));
    176176?>" /></p>
    177177

  • trunk/wp-admin/edit-link-form.php

    r4495 r4656  
    248248<input type="hidden" name="action" value="save" />
    249249<input type="hidden" name="link_id" value="<?php echo (int) $link_id; ?>" />
    250 <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
     250<input type="hidden" name="order_by" value="<?php echo attribute_escape($order_by); ?>" />
    251251<input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
    252252<?php else: ?>

  • trunk/wp-admin/edit-page-form.php

    r4655 r4656  
    1414}
    1515
    16 $sendto = wp_get_referer();
     16$sendto = attribute_escape(stripslashes(wp_get_referer()));
    1717
    1818if ( 0 != $post_ID && $sendto == get_permalink($post_ID) )
    1919        $sendto = 'redo';
    20 $sendto = wp_specialchars( $sendto );
    21 
    2220?>
    2321

  • trunk/wp-admin/edit-pages.php

    r4495 r4656  
    1414        <fieldset>
    1515        <legend><?php _e('Search Pages&hellip;') ?></legend>
    16         <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo wp_specialchars($_GET['s'], 1); ?>" size="17" />
     16        <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo attribute_escape($_GET['s']); ?>" size="17" />
    1717        <input type="submit" name="submit" value="<?php _e('Search') ?>"  />
    1818        </fieldset>

  • trunk/wp-admin/edit.php

    r4615 r4656  
    7777  <fieldset>
    7878  <legend><?php _e('Search Posts&hellip;') ?></legend>
    79   <input type="text" name="s" value="<?php if (isset($s)) echo wp_specialchars($s, 1); ?>" size="17" />
     79  <input type="text" name="s" value="<?php if (isset($s)) echo attribute_escape($s); ?>" size="17" />
    8080  <input type="submit" name="submit" value="<?php _e('Search') ?>" class="button" />
    8181  </fieldset>

  • trunk/wp-admin/link-manager.php

    r4617 r4656  
    117117<input type="hidden" name="link_id" value="" />
    118118<input type="hidden" name="action" value="" />
    119 <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
     119<input type="hidden" name="order_by" value="<?php echo attribute_escape($order_by); ?>" />
    120120<input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
    121121<table class="widefat">
    … …  
    131131<?php
    132132        foreach ($links as $link) {
    133                 $link->link_name = wp_specialchars($link->link_name);
     133                $link->link_name = attribute_escape($link->link_name);
    134134                $link->link_description = wp_specialchars($link->link_description);
    135                 $link->link_url = wp_specialchars($link->link_url);
     135                $link->link_url = attribute_escape($link->link_url);
    136136                $link->link_category = wp_get_link_cats($link->link_id);
    137137                $short_url = str_replace('http://', '', $link->link_url);

  • trunk/wp-admin/options-misc.php

    r4495 r4656  
    1919<tr valign="top">
    2020<th scope="row"><?php _e('Store uploads in this folder'); ?>:</th>
    21 <td><input name="upload_path" type="text" id="upload_path" class="code" value="<?php echo wp_specialchars(str_replace(ABSPATH, '', get_option('upload_path')), 1); ?>" size="40" />
     21<td><input name="upload_path" type="text" id="upload_path" class="code" value="<?php echo attribute_escape(str_replace(ABSPATH, '', get_option('upload_path'))); ?>" size="40" />
    2222<br />
    2323<?php _e('Default is <code>wp-content/uploads</code>'); ?>

  • trunk/wp-admin/options-permalink.php

    r4495 r4656  
    150150<br />
    151151</p>
    152 <p id="customstructure"><?php _e('Custom structure'); ?>: <input name="permalink_structure" id="permalink_structure" type="text" class="code" style="width: 60%;" value="<?php echo wp_specialchars($permalink_structure, 1); ?>" size="50" /></p>
     152<p id="customstructure"><?php _e('Custom structure'); ?>: <input name="permalink_structure" id="permalink_structure" type="text" class="code" style="width: 60%;" value="<?php echo attribute_escape($permalink_structure); ?>" size="50" /></p>
    153153
    154154<h3><?php _e('Optional'); ?></h3>
    … …  
    159159<?php endif; ?>
    160160        <p>
    161   <?php _e('Category base'); ?>: <input name="category_base" type="text" class="code"  value="<?php echo wp_specialchars($category_base, 1); ?>" size="30" />
     161  <?php _e('Category base'); ?>: <input name="category_base" type="text" class="code"  value="<?php echo attribute_escape($category_base); ?>" size="30" />
    162162     </p>
    163163    <p class="submit">

  • trunk/wp-admin/options.php

    r4480 r4656  
    159159  </table>
    160160<?php $options_to_update = implode(',', $options_to_update); ?>
    161 <p class="submit"><input type="hidden" name="page_options" value="<?php echo wp_specialchars($options_to_update, true); ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p>
     161<p class="submit"><input type="hidden" name="page_options" value="<?php echo attribute_escape($options_to_update); ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p>
    162162  </form>
    163163</div>

  • trunk/wp-admin/page.php

    r4612 r4656  
    5858        <div id='preview' class='wrap'>
    5959        <h2 id="preview-post"><?php _e('Page Preview (updated when page is saved)'); ?></h2>
    60                 <iframe src="<?php echo wp_specialchars(apply_filters('preview_page_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
     60                <iframe src="<?php echo attribute_escape(apply_filters('preview_page_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
    6161        </div>
    6262        <?php

  • trunk/wp-admin/post.php

    r4612 r4656  
    6464        <div id='preview' class='wrap'>
    6565        <h2 id="preview-post"><?php _e('Post Preview (updated when post is saved)'); ?></h2>
    66                 <iframe src="<?php echo wp_specialchars(apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
     66                <iframe src="<?php echo attribute_escape(apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
    6767        </div>
    6868        <?php

  • trunk/wp-admin/templates.php

    r4495 r4656  
    9999echo '<ol>';
    100100foreach ($recents as $recent) :
    101         echo "<li><a href='templates.php?file=" . wp_specialchars($recent, true) . "'>" . get_file_description(basename($recent)) . "</a></li>";
     101        echo "<li><a href='templates.php?file=" . attribute_escape($recent) . "'>" . get_file_description(basename($recent)) . "</a></li>";
    102102endforeach;
    103103echo '</ol>';

  • trunk/wp-admin/theme-editor.php

    r4495 r4656  
    8989                if ($theme_name == $theme) $selected = " selected='selected'";
    9090                else $selected = '';
    91                 $theme_name = wp_specialchars($theme_name, true);
     91                $theme_name = attribute_escape($theme_name);
    9292                echo "\n\t<option value=\"$theme_name\" $selected>$theme_name</option>";
    9393        }

  • trunk/wp-admin/upgrade.php

    r4495 r4656  
    2929switch($step) {
    3030        case 0:
    31                 $goback = wp_specialchars(wp_get_referer());
     31                $goback = attribute_escape(stripslashes(wp_get_referer()));
    3232?>
    3333<p><?php _e('This file upgrades you from any previous version of WordPress to the latest. It may take a while though, so be patient.'); ?></p>
    … …  
    4141                        $backto = __get_option('home');
    4242                else
    43                         $backto = wp_specialchars( $_GET['backto'] , 1 );
     43                        $backto = attribute_escape(stripslashes($_GET['backto']));
    4444?>
    4545<h2><?php _e('Step 1'); ?></h2>

  • trunk/wp-admin/upload-functions.php

    r4628 r4656  
    88        ob_start();
    99                the_title();
    10                 $post_title = wp_specialchars( ob_get_contents(), 1 );
     10                $post_title = attribute_escape( ob_get_contents());
    1111        ob_end_clean();
    1212        $post_content = apply_filters( 'content_edit_pre', $post->post_content );
    … …  
    7272                                echo '<a href="' . get_permalink() . '">' . __('view') . '</a>';
    7373                                echo '&nbsp;|&nbsp;';
    74                                         echo '<a href="' . wp_specialchars( add_query_arg( 'action', 'edit' ), 1 ) . '" title="' . __('Edit this file') . '">' . __('edit') . '</a>';
     74                                        echo '<a href="' . attribute_escape( add_query_arg( 'action', 'edit' )) . '" title="' . __('Edit this file') . '">' . __('edit') . '</a>';
    7575                                echo '&nbsp;|&nbsp;';
    76                                 echo '<a href="' . wp_specialchars( remove_query_arg( array('action', 'ID') ), 1 ) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
     76                                echo '<a href="' . attribute_escape( remove_query_arg( array('action', 'ID') )) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
    7777                                echo '&nbsp;]'; ?></span>
    7878                </div>
    … …  
    112112                                echo '<a href="' . get_permalink() . '">' . __('view') . '</a>';
    113113                                echo '&nbsp;|&nbsp;';
    114                                         echo '<a href="' . wp_specialchars( add_query_arg( 'action', 'view' ), 1 ) . '">' . __('links') . '</a>';
     114                                        echo '<a href="' . attribute_escape( add_query_arg( 'action', 'view' )) . '">' . __('links') . '</a>';
    115115                                echo '&nbsp;|&nbsp;';
    116                                 echo '<a href="' . wp_specialchars( remove_query_arg( array('action','ID') ), 1 ) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
     116                                echo '<a href="' . attribute_escape( remove_query_arg( array('action','ID') )) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
    117117                                echo '&nbsp;]'; ?></span>
    118118                </div>

  • trunk/wp-admin/upload-js.php

    r4613 r4656  
    7373                                params.ID = '';
    7474                                params.action = '';
    75                                 h += "<a href='" + this.urlData[0] + '?' + params.toQueryString() + "' title='<?php echo wp_specialchars(__('Browse your files'), 1); ?>' class='back'><?php echo wp_specialchars(__('&laquo; Back'), 1); ?></a>";
    76                         } else {
    77                                 h += "<a href='#' onclick='return theFileList.cancelView();'  title='<?php echo wp_specialchars(__('Browse your files'), 1); ?>' class='back'><?php echo wp_specialchars(__('&laquo; Back'), 1) ?></a>";
     75                                h += "<a href='" + this.urlData[0] + '?' + params.toQueryString() + "' title='<?php echo attribute_escape(__('Browse your files')); ?>' class='back'><?php echo attribute_escape(__('&laquo; Back')); ?></a>";
     76                        } else {
     77                                h += "<a href='#' onclick='return theFileList.cancelView();'  title='<?php echo attribute_escape(__('Browse your files')); ?>' class='back'><?php echo attribute_escape(__('&laquo; Back')) ?></a>";
    7878                        }
    7979                        h += "<div id='file-title'>"
    8080                        if ( !this.currentImage.isImage )
    81                                 h += "<h2><a href='" + this.currentImage.srcBase + this.currentImage.src + "' onclick='return false;' title='<?php echo wp_specialchars(__('Direct link to file'), 1); ?>'>" + this.currentImage.title + "</a></h2>";
     81                                h += "<h2><a href='" + this.currentImage.srcBase + this.currentImage.src + "' onclick='return false;' title='<?php echo attribute_escape(__('Direct link to file')); ?>'>" + this.currentImage.title + "</a></h2>";
    8282                        else
    8383                                h += "<h2>" + this.currentImage.title + "</h2>";
    8484                        h += " &#8212; <span>";
    85                         h += "<a href='#' onclick='return theFileList.editView(" + id + ");'><?php echo wp_specialchars(__('Edit'), 1); ?></a>"
     85                        h += "<a href='#' onclick='return theFileList.editView(" + id + ");'><?php echo attribute_escape(__('Edit')); ?></a>"
    8686                        h += "</span>";
    8787                        h += '</div>'
    8888                        h += "<div id='upload-file-view' class='alignleft'>";
    8989                        if ( this.currentImage.isImage ) {
    90                                 h += "<a href='" + this.currentImage.srcBase + this.currentImage.src + "' onclick='return false;' title='<?php echo wp_specialchars(__('Direct link to file'), 1); ?>'>";
     90                                h += "<a href='" + this.currentImage.srcBase + this.currentImage.src + "' onclick='return false;' title='<?php echo attribute_escape(__('Direct link to file')); ?>'>";
    9191                                h += "<img src='" + ( this.currentImage.thumb ? this.currentImage.thumb : this.currentImage.src ) + "' alt='" + this.currentImage.title + "' width='" + this.currentImage.width + "' height='" + this.currentImage.height + "' />";
    9292                                h += "</a>";
    … …  
    9898                        h += "<table>";
    9999                        if ( this.currentImage.thumb ) {
    100                                 h += "<tr><th style='padding-bottom:.5em'><?php echo wp_specialchars(__('Show:'), 1); ?></th><td style='padding-bottom:.5em'>";
    101                                 h += "<label for='display-thumb'><input type='radio' name='display' id='display-thumb' value='thumb' checked='checked' /> <?php echo wp_specialchars(__('Thumbnail'), 1); ?></label><br />";
    102                                 h += "<label for='display-full'><input type='radio' name='display' id='display-full' value='full' /> <?php echo wp_specialchars(__('Full size'), 1); ?></label>";
     100                                h += "<tr><th style='padding-bottom:.5em'><?php echo attribute_escape(__('Show:')); ?></th><td style='padding-bottom:.5em'>";
     101                                h += "<label for='display-thumb'><input type='radio' name='display' id='display-thumb' value='thumb' checked='checked' /> <?php echo attribute_escape(__('Thumbnail')); ?></label><br />";
     102                                h += "<label for='display-full'><input type='radio' name='display' id='display-full' value='full' /> <?php echo attribute_escape(__('Full size')); ?></label>";
    103103                                h += "</td></tr>";
    104104                        }
    105105
    106                         h += "<tr><th><?php echo wp_specialchars(__('Link to:'), 1); ?></th><td>";
    107                         h += "<label for='link-file'><input type='radio' name='link' id='link-file' value='file' checked='checked'/> <?php echo wp_specialchars(__('File'), 1); ?></label><br />";
    108                         h += "<label for='link-page'><input type='radio' name='link' id='link-page' value='page' /> <?php echo wp_specialchars(__('Page'), 1); ?></label><br />";
    109                         h += "<label for='link-none'><input type='radio' name='link' id='link-none' value='none' /> <?php echo wp_specialchars(__('None'), 1); ?></label>";
     106                        h += "<tr><th><?php echo attribute_escape(__('Link to:')); ?></th><td>";
     107                        h += "<label for='link-file'><input type='radio' name='link' id='link-file' value='file' checked='checked'/> <?php echo attribute_escape(__('File')); ?></label><br />";
     108                        h += "<label for='link-page'><input type='radio' name='link' id='link-page' value='page' /> <?php echo attribute_escape(__('Page')); ?></label><br />";
     109                        h += "<label for='link-none'><input type='radio' name='link' id='link-none' value='none' /> <?php echo attribute_escape(__('None')); ?></label>";
    110110                        h += "</td></tr>";
    111111
    112112                        h += "<tr><td colspan='2'><p class='submit'>";
    113                         h += "<input type='button' class='button' name='send' onclick='theFileList.sendToEditor(" + id + ")' value='<?php echo wp_specialchars(__('Send to editor &raquo;'), 1); ?>' />";
     113                        h += "<input type='button' class='button' name='send' onclick='theFileList.sendToEditor(" + id + ")' value='<?php echo attribute_escape(__('Send to editor &raquo;')); ?>' />";
    114114                        h += "</p></td></tr></table>";
    115115                        h += "</form>";
    … …  
    135135                                params.ID = '';
    136136                                params.action = '';
    137                                 h += "<a href='" + this.urlData[0] + '?' + params.toQueryString() + "'  title='<?php echo wp_specialchars(__('Browse your files'), 1); ?>' class='back'><?php echo wp_specialchars(__('&laquo; Back'), 1); ?></a>";
    138                         } else {
    139                                 h += "<a href='#' onclick='return theFileList.cancelView();'  title='<?php echo wp_specialchars(__('Browse your files'), 1); ?>' class='back'><?php echo wp_specialchars(__('&laquo; Back'), 1); ?></a>";
     137                                h += "<a href='" + this.urlData[0] + '?' + params.toQueryString() + "'  title='<?php echo attribute_escape(__('Browse your files')); ?>' class='back'><?php echo attribute_escape(__('&laquo; Back')); ?></a>";
     138                        } else {
     139                                h += "<a href='#' onclick='return theFileList.cancelView();'  title='<?php echo attribute_escape(__('Browse your files')); ?>' class='back'><?php echo attribute_escape(__('&laquo; Back')); ?></a>";
    140140                        }
    141141                        h += "<div id='file-title'>"
    142142                        if ( !this.currentImage.isImage )
    143                                 h += "<h2><a href='" + this.currentImage.srcBase + this.currentImage.src + "' onclick='return false;' title='<?php echo wp_specialchars(__('Direct link to file'), 1); ?>'>" + this.currentImage.title + "</a></h2>";
     143                                h += "<h2><a href='" + this.currentImage.srcBase + this.currentImage.src + "' onclick='return false;' title='<?php echo attribute_escape(__('Direct link to file')); ?>'>" + this.currentImage.title + "</a></h2>";
    144144                        else
    145145                                h += "<h2>" + this.currentImage.title + "</h2>";
    146146                        h += " &#8212; <span>";
    147                         h += "<a href='#' onclick='return theFileList.imageView(" + id + ");'><?php wp_specialchars(__('Insert'), 1); ?></a>"
     147                        h += "<a href='#' onclick='return theFileList.imageView(" + id + ");'><?php attribute_escape(__('Insert')); ?></a>"
    148148                        h += "</span>";
    149149                        h += '</div>'
    … …  
    159159
    160160                        h += "<table><col /><col class='widefat' /><tr>"
    161                         h += "<th scope='row'><label for='url'><?php echo wp_specialchars(__('URL'), 1); ?></label></th>";
     161                        h += "<th scope='row'><label for='url'><?php echo attribute_escape(__('URL')); ?></label></th>";
    162162                        h += "<td><input type='text' id='url' class='readonly' value='" + this.currentImage.srcBase + this.currentImage.src + "' readonly='readonly' /></td>";
    163163                        h += "</tr><tr>";
    164                         h += "<th scope='row'><label for='post_title'><?php echo wp_specialchars(__('Title'), 1); ?></label></th>";
     164                        h += "<th scope='row'><label for='post_title'><?php echo attribute_escape(__('Title')); ?></label></th>";
    165165                        h += "<td><input type='text' id='post_title' name='post_title' value='" + this.currentImage.title + "' /></td>";
    166166                        h += "</tr><tr>";
    167                         h += "<th scope='row'><label for='post_content'><?php echo wp_specialchars(__('Description'), 1); ?></label></th>";
     167                        h += "<th scope='row'><label for='post_content'><?php echo attribute_escape(__('Description')); ?></label></th>";
    168168                        h += "<td><textarea name='post_content' id='post_content'>" + this.currentImage.description + "</textarea></td>";
    169                         h += "</tr><tr id='buttons' class='submit'><td colspan='2'><input type='button' id='delete' name='delete' class='delete alignleft' value='<?php echo wp_specialchars(__('Delete File'), 1); ?>' onclick='theFileList.deleteFile(" + id + ");' />";
     169                        h += "</tr><tr id='buttons' class='submit'><td colspan='2'><input type='button' id='delete' name='delete' class='delete alignleft' value='<?php echo attribute_escape(__('Delete File')); ?>' onclick='theFileList.deleteFile(" + id + ");' />";
    170170                        h += "<input type='hidden' name='from_tab' value='" + this.tab + "' />";
    171171                        h += "<input type='hidden' name='action' id='action-value' value='save' />";
    172172                        h += "<input type='hidden' name='ID' value='" + id + "' />";
    173173                        h += "<input type='hidden' name='_wpnonce' value='" + this.nonce + "' />";
    174                         h += "<div class='submit'><input type='submit' value='<?php echo wp_specialchars(__('Save &raquo;'), 1); ?>' /></div>";
     174                        h += "<div class='submit'><input type='submit' value='<?php echo attribute_escape(__('Save &raquo;')); ?>' /></div>";
    175175                        h += "</td></tr></table></form>";
    176176

  • trunk/wp-admin/upload.php

    r4600 r4656  
    8888        if ( isset($tab_array[4]) && is_array($tab_array[4]) )
    8989                add_query_arg( $tab_array[4], $href );
    90         $_href = wp_specialchars( $href, 1 );
     90        $_href = attribute_escape( $href);
    9191        $page_links = '';
    9292        $class = 'upload-tab alignleft';

  • trunk/wp-admin/user-edit.php

    r4495 r4656  
    5656        <p><strong><?php _e('User updated.') ?></strong></p>
    5757        <?php if ( $wp_http_referer ) : ?>
    58         <p><a href="<?php echo wp_specialchars($wp_http_referer); ?>"><?php _e('&laquo; Back to Authors and Users'); ?></a></p>
     58        <p><a href="<?php echo attribute_escape($wp_http_referer); ?>"><?php _e('&laquo; Back to Authors and Users'); ?></a></p>
    5959        <?php endif; ?>
    6060</div>

  • trunk/wp-admin/users.php

    r4583 r4656  
    1313
    1414if ( empty($_POST) ) {
    15         $referer = '<input type="hidden" name="wp_http_referer" value="'. wp_specialchars(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
     15        $referer = '<input type="hidden" name="wp_http_referer" value="'. attribute_escape(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
    1616} elseif ( isset($_POST['wp_http_referer']) ) {
    1717        $redirect = remove_query_arg(array('wp_http_referer', 'updated', 'delete_count'), stripslashes($_POST['wp_http_referer']));
    18         $referer = '<input type="hidden" name="wp_http_referer" value="' . wp_specialchars($redirect) . '" />';
     18        $referer = '<input type="hidden" name="wp_http_referer" value="' . attribute_escape($redirect) . '" />';
    1919} else {
    2020        $redirect = 'users.php';
    … …  
    339339
    340340        <form action="" method="get" name="search" id="search">
    341                 <p><input type="text" name="usersearch" id="usersearch" value="<?php echo wp_specialchars($wp_user_search->search_term, 1); ?>" /> <input type="submit" value="<?php _e('Search         users &raquo;'); ?>" class="button" /></p>
     341                <p><input type="text" name="usersearch" id="usersearch" value="<?php echo attribute_escape($wp_user_search->search_term); ?>" /> <input type="submit" value="<?php _e('Search   users &raquo;'); ?>" class="button" /></p>
    342342        </form>
    343343
    … …  
    430430                foreach ( array('user_login' => 'user_login', 'first_name' => 'user_firstname', 'last_name' => 'user_lastname', 'email' => 'user_email', 'url' => 'user_uri', 'role' => 'user_role') as $formpost => $var ) {
    431431                        $var = 'new_' . $var;
    432                         $$var = wp_specialchars(stripslashes($_POST[$formpost]));
     432                        $$var = attribute_escape(stripslashes($_POST[$formpost]));
    433433                }
    434434                unset($name);

  • trunk/wp-content/themes/classic/comments-popup.php

    r4495 r4656  
    6161           <label for="author"><?php _e("Name"); ?></label>
    6262        <input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
    63         <input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER["REQUEST_URI"]); ?>" />
     63        <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($_SERVER["REQUEST_URI"]); ?>" />
    6464        </p>
    6565

  • trunk/wp-content/themes/default/comments-popup.php

    r4495 r4656  
    6161           <label for="author">Name</label>
    6262        <input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
    63         <input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER["REQUEST_URI"]); ?>" />
     63        <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($_SERVER["REQUEST_URI"]); ?>" />
    6464        </p>
    6565

  • trunk/wp-includes/author-template.php

    r4497 r4656  
    140140        global $authordata;
    141141
    142         echo '<a href="' . get_author_posts_url($authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars(get_the_author())) . '">' . get_the_author() . '</a>';
     142        echo '<a href="' . get_author_posts_url($authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), attribute_escape(get_the_author())) . '">' . get_the_author() . '</a>';
    143143}
    144144
    … …  
    203203                                $link = $name;
    204204                } else {
    205                         $link = '<a href="' . get_author_posts_url($author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars($author->display_name)) . '">' . $name . '</a>';
     205                        $link = '<a href="' . get_author_posts_url($author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), attribute_escape($author->display_name)) . '">' . $name . '</a>';
    206206
    207207                        if ( (! empty($feed_image)) || (! empty($feed)) ) {

  • trunk/wp-includes/bookmark-template.php

    r4535 r4656  
    102102                        $rel = ' rel="' . $rel . '"';
    103103
    104                 $desc = wp_specialchars($row->link_description, ENT_QUOTES);
    105                 $name = wp_specialchars($row->link_name, ENT_QUOTES);
     104                $desc = attribute_escape($row->link_description);
     105                $name = attribute_escape($row->link_name);
    106106                $title = $desc;
    107107
    … …  
    267267                        $rel = ' rel="' . $rel . '"';
    268268
    269                 $desc = wp_specialchars($bookmark->link_description, ENT_QUOTES);
    270                 $name = wp_specialchars($bookmark->link_name, ENT_QUOTES);
     269                $desc = attribute_escape($bookmark->link_description);
     270                $name = attribute_escape($bookmark->link_name);
    271271                $title = $desc;
    272272

  • trunk/wp-includes/classes.php

    r4598 r4656  
    510510                        $css_class .= ' current_page_parent';
    511511
    512                 $output .= $indent . '<li class="' . $css_class . '"><a href="' . get_page_link($page->ID) . '" title="' . wp_specialchars($page->post_title, 1) . '">' . $page->post_title . '</a>';
     512                $output .= $indent . '<li class="' . $css_class . '"><a href="' . get_page_link($page->ID) . '" title="' . attribute_escape($page->post_title) . '">' . $page->post_title . '</a>';
    513513       
    514514                if ( !empty($show_date) ) {
    … …  
    576576                extract($args);
    577577
    578                 $cat_name = wp_specialchars( $category->cat_name, 1 );
     578                $cat_name = attribute_escape( $category->cat_name);
    579579                $link = '<a href="' . get_category_link( $category->cat_ID ) . '" ';
    580580                if ( $use_desc_for_title == 0 || empty($category->category_description) )
    581581                        $link .= 'title="' . sprintf(__( 'View all posts filed under %s' ), $cat_name) . '"';
    582582                else
    583                         $link .= 'title="' . wp_specialchars( apply_filters( 'category_description', $category->category_description, $category ), 1 ) . '"';
     583                        $link .= 'title="' . attribute_escape( apply_filters( 'category_description', $category->category_description, $category )) . '"';
    584584                $link .= '>';
    585585                $link .= apply_filters( 'list_cats', $category->cat_name, $category ).'</a>';

  • trunk/wp-includes/comment-template.php

    r4568 r4656  
    354354                echo ' class="'.$CSSclass.'"';
    355355        }
    356         $title = wp_specialchars(apply_filters('the_title', get_the_title()), true);
     356        $title = attribute_escape(apply_filters('the_title', get_the_title()));
    357357        echo ' title="' . sprintf( __('Comment on %s'), $title ) .'">';
    358358        comments_number($zero, $one, $more, $number);

  • trunk/wp-includes/comment.php

    r4631 r4656  
    156156                $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]);
    157157                $comment_author = stripslashes($comment_author);
    158                 $comment_author = wp_specialchars($comment_author, true);
     158                $comment_author = attribute_escape($comment_author);
    159159                $_COOKIE['comment_author_'.COOKIEHASH] = $comment_author;
    160160        }
    … …  
    163163                $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]);
    164164                $comment_author_email = stripslashes($comment_author_email);
    165                 $comment_author_email = wp_specialchars($comment_author_email, true);
     165                $comment_author_email = attribute_escape($comment_author_email);
    166166                $_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email;
    167167        }
    … …  
    170170                $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
    171171                $comment_author_url = stripslashes($comment_author_url);
    172                 $comment_author_url = wp_specialchars($comment_author_url, true);
     172                $comment_author_url = attribute_escape($comment_author_url);
    173173                $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
    174174        }

  • trunk/wp-includes/formatting.php

    r4593 r4656  
    10821082}
    10831083
     1084// Escaping for HTML attributes like
     1085function attribute_escape($text) {
     1086        return wp_specialchars($text, true);
     1087}
     1088
    10841089function wp_make_link_relative( $link ) {
    10851090        return preg_replace('|https?://[^/]+(/.*)|i', '$1', $link );

  • trunk/wp-includes/functions.php

    r4643 r4656  
    232232
    233233function form_option($option) {
    234         echo wp_specialchars( get_option($option), 1 );
     234        echo attribute_escape( get_option($option));
    235235}
    236236
    … …  
    915915
    916916function wp_referer_field() {
    917         $ref = wp_specialchars($_SERVER['REQUEST_URI']);
     917        $ref = attribute_escape($_SERVER['REQUEST_URI']);
    918918        echo '<input type="hidden" name="_wp_http_referer" value="'. $ref . '" />';
    919919        if ( wp_get_original_referer() ) {
    920                 $original_ref = wp_specialchars(stripslashes(wp_get_original_referer()));
     920                $original_ref = attribute_escape(stripslashes(wp_get_original_referer()));
    921921                echo '<input type="hidden" name="_wp_original_http_referer" value="'. $original_ref . '" />';
    922922        }
    … …  
    924924
    925925function wp_original_referer_field() {
    926         echo '<input type="hidden" name="_wp_original_http_referer" value="' . wp_specialchars(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
     926        echo '<input type="hidden" name="_wp_original_http_referer" value="' . attribute_escape(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
    927927}
    928928
    … …  
    11911191                        $v = substr(strstr($a, '='), 1);
    11921192                        $k = substr($a, 0, -(strlen($v)+1));
    1193                         $html .= "\t\t<input type='hidden' name='" . wp_specialchars( urldecode($k), 1 ) . "' value='" . wp_specialchars( urldecode($v), 1 ) . "' />\n";
     1193                        $html .= "\t\t<input type='hidden' name='" . attribute_escape( urldecode($k)) . "' value='" . attribute_escape( urldecode($v)) . "' />\n";
    11941194                }
    11951195                $html .= "\t\t<input type='hidden' name='_wpnonce' value='" . wp_create_nonce($action) . "' />\n";

  • trunk/wp-includes/general-template.php

    r4636 r4656  
    280280function get_archives_link($url, $text, $format = 'html', $before = '', $after = '') {
    281281        $text = wptexturize($text);
    282         $title_text = wp_specialchars($text, 1);
     282        $title_text = attribute_escape($text);
    283283
    284284        if ('link' == $format)
    … …  
    902902function the_search_query() {
    903903        global $s;
    904         echo wp_specialchars( stripslashes($s), 1 );
     904        echo attribute_escape( stripslashes($s));
    905905}
    906906
    … …  
    957957                if ( $add_args )
    958958                        $link = add_query_arg( $add_args, $link );
    959                 $page_links[] = "<a class='prev page-numbers' href='" . wp_specialchars( $link, 1 ) . "'>$prev_text</a>";
     959                $page_links[] = "<a class='prev page-numbers' href='" . attribute_escape( $link) . "'>$prev_text</a>";
    960960        endif;
    961961        for ( $n = 1; $n <= $total; $n++ ) :
    … …  
    969969                                if ( $add_args )
    970970                                        $link = add_query_arg( $add_args, $link );
    971                                 $page_links[] = "<a class='page-numbers' href='" . wp_specialchars( $link, 1 ) . "'>$n</a>";
     971                                $page_links[] = "<a class='page-numbers' href='" . attribute_escape( $link) . "'>$n</a>";
    972972                                $dots = true;
    973973                        elseif ( $dots && !$show_all ) :
    … …  
    982982                if ( $add_args )
    983983                        $link = add_query_arg( $add_args, $link );
    984                 $page_links[] = "<a class='next page-numbers' href='" . wp_specialchars( $link, 1 ) . "'>$next_text</a>";
     984                $page_links[] = "<a class='next page-numbers' href='" . attribute_escape( $link) . "'>$next_text</a>";
    985985        endif;
    986986        switch ( $type ) :

  • trunk/wp-includes/post-template.php

    r4612 r4656  
    335335                return __('Missing Attachment');
    336336
    337         $post_title = wp_specialchars( $_post->post_title, 1 );
     337        $post_title = attribute_escape( $_post->post_title);
    338338
    339339        if (! empty($_post->guid) ) {
    … …  
    421421        }
    422422
    423         $post_title = wp_specialchars( $post->post_title, 1 );
     423        $post_title = attribute_escape( $post->post_title);
    424424
    425425        $icon = "<img src='$src' title='$post_title' alt='$post_title' $constraint/>";
    … …  
    436436        $post = & get_post($id);
    437437
    438         $innerHTML = wp_specialchars( $post->post_title, 1 );
     438        $innerHTML = attribute_escape( $post->post_title);
    439439
    440440        return apply_filters('attachment_innerHTML', $innerHTML, $post->ID);

  • trunk/wp-links-opml.php

    r4495 r4656  
    3131foreach ((array) $cats as $cat) {
    3232?>
    33 <outline type="category" title="<?php echo wp_specialchars($cat->cat_name); ?>">
     33<outline type="category" title="<?php echo attribute_escape($cat->cat_name); ?>">
    3434<?php
    3535
    … …  
    3737        foreach ((array) $bookmarks as $bookmark) {
    3838?>
    39         <outline text="<?php echo wp_specialchars($bookmark->link_name); ?>" type="link" xmlUrl="<?php echo wp_specialchars($bookmark->link_rss); ?>" htmlUrl="<?php echo wp_specialchars($bookmark->link_url); ?>" updated="<?php if ('0000-00-00 00:00:00' != $bookmark->link_updated) echo $bookmark->link_updated; ?>" />
     39        <outline text="<?php echo attribute_escape($bookmark->link_name); ?>" type="link" xmlUrl="<?php echo attribute_escape($bookmark->link_rss); ?>" htmlUrl="<?php echo attribute_escape($bookmark->link_url); ?>" updated="<?php if ('0000-00-00 00:00:00' != $bookmark->link_updated) echo $bookmark->link_updated; ?>" />
    4040<?php
    4141

  • trunk/wp-login.php

    r4652 r4656  
    139139        <p>
    140140                <label><?php _e('Username:') ?><br />
    141                 <input type="text" name="user_login" id="user_login" class="input" value="<?php echo wp_specialchars(stripslashes($_POST['user_login']), 1); ?>" size="20" tabindex="10" /></label>
     141                <input type="text" name="user_login" id="user_login" class="input" value="<?php echo attribute_escape(stripslashes($_POST['user_login'])); ?>" size="20" tabindex="10" /></label>
    142142        </p>
    143143        <p>
    144144                <label><?php _e('E-mail:') ?><br />
    145                 <input type="text" name="user_email" id="user_email" class="input" value="<?php echo wp_specialchars(stripslashes($_POST['user_email']), 1); ?>" size="25" tabindex="20" /></label>
     145                <input type="text" name="user_email" id="user_email" class="input" value="<?php echo attribute_escape(stripslashes($_POST['user_email'])); ?>" size="25" tabindex="20" /></label>
    146146        </p>
    147147<?php do_action('lostpassword_form'); ?>
    … …  
    258258        <p>
    259259                <label><?php _e('Username:') ?><br />
    260                 <input type="text" name="user_login" id="user_login" class="input" value="<?php echo wp_specialchars(stripslashes($user_login), 1); ?>" size="20" tabindex="10" /></label>
     260                <input type="text" name="user_login" id="user_login" class="input" value="<?php echo attribute_escape(stripslashes($user_login)); ?>" size="20" tabindex="10" /></label>
    261261        </p>
    262262        <p>
    263263                <label><?php _e('E-mail:') ?><br />
    264                 <input type="text" name="user_email" id="user_email" class="input" value="<?php echo wp_specialchars(stripslashes($user_email), 1); ?>" size="25" tabindex="20" /></label>
     264                <input type="text" name="user_email" id="user_email" class="input" value="<?php echo attribute_escape(stripslashes($user_email)); ?>" size="25" tabindex="20" /></label>
    265265        </p>
    266266<?php do_action('register_form'); ?>
    … …  
    345345        <p>
    346346                <label><?php _e('Username:') ?><br />
    347                 <input type="text" name="log" id="user_login" class="input" value="<?php echo wp_specialchars(stripslashes($user_login), 1); ?>" size="20" tabindex="10" /></label>
     347                <input type="text" name="log" id="user_login" class="input" value="<?php echo attribute_escape(stripslashes($user_login)); ?>" size="20" tabindex="10" /></label>
    348348        </p>
    349349        <p>
    … …  
    355355        <p class="submit">
    356356                <input type="submit" name="submit" id="submit" value="<?php _e('Login'); ?> &raquo;" tabindex="100" />
    357                 <input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($redirect_to); ?>" />
     357                <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($redirect_to); ?>" />
    358358        </p>
    359359</form>
Note: See TracChangeset for help on using the changeset viewer.