Changeset 4656 for trunk/wp-admin/upload-functions.php

Timestamp:

12/21/2006 10:10:04 AM (18 years ago)

Author:

markjaquith

Message:

new function for escaping within attributes: attribute_escape()

File:

• trunk/wp-admin/upload-functions.php (modified) (3 diffs)

trunk/wp-admin/upload-functions.php

@@ -8 +8 @@
     ob_start();
         the_title();
-        $post_title = wp_specialchars( ob_get_contents(), 1 );
+        $post_title = attribute_escape( ob_get_contents());
     ob_end_clean();
     $post_content = apply_filters( 'content_edit_pre', $post->post_content );
@@ -72 +72 @@
                 echo '<a href="' . get_permalink() . '">' . __('view') . '</a>';
                 echo '&nbsp;|&nbsp;';
-                    echo '<a href="' . wp_specialchars( add_query_arg( 'action', 'edit' ), 1 ) . '" title="' . __('Edit this file') . '">' . __('edit') . '</a>';
+                    echo '<a href="' . attribute_escape( add_query_arg( 'action', 'edit' )) . '" title="' . __('Edit this file') . '">' . __('edit') . '</a>';
                 echo '&nbsp;|&nbsp;';
-                echo '<a href="' . wp_specialchars( remove_query_arg( array('action', 'ID') ), 1 ) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
+                echo '<a href="' . attribute_escape( remove_query_arg( array('action', 'ID') )) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
                 echo '&nbsp;]'; ?></span>
         </div>
@@ -112 +112 @@
                 echo '<a href="' . get_permalink() . '">' . __('view') . '</a>';
                 echo '&nbsp;|&nbsp;';
-                    echo '<a href="' . wp_specialchars( add_query_arg( 'action', 'view' ), 1 ) . '">' . __('links') . '</a>';
+                    echo '<a href="' . attribute_escape( add_query_arg( 'action', 'view' )) . '">' . __('links') . '</a>';
                 echo '&nbsp;|&nbsp;';
-                echo '<a href="' . wp_specialchars( remove_query_arg( array('action','ID') ), 1 ) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
+                echo '<a href="' . attribute_escape( remove_query_arg( array('action','ID') )) . '" title="' . __('Browse your files') . '">' . __('cancel') . '</a>';
                 echo '&nbsp;]'; ?></span>
         </div>