Changeset 55492

Timestamp:

03/08/2023 10:17:53 PM (22 months ago)

Author:

audrasjb

Message:

Docs: Add security warning in remove_query_arg() docblock to make it consistent with add_query_arg().

Props roytanck.
Fixes #57885.
See #56792.

File:

• trunk/src/wp-includes/functions.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -1196 +1196 @@
 /**
  * Removes an item or items from a query string.
+ *
+ * Important: The return value of remove_query_arg() is not escaped by default. Output should be
+ * late-escaped with esc_url() or similar to help prevent vulnerability to cross-site scripting
+ * (XSS) attacks.
  *
  * @since 1.5.0