WordPress.org

Make WordPress Core

Opened 5 years ago

Closed 4 years ago

Last modified 4 years ago

#13419 closed defect (bug) (worksforme)

comment_excerpt does not use htmlspecialchars

Reported by: gene91 Owned by:
Milestone: Priority: normal
Severity: normal Version:
Component: Comments Keywords: comment_excerpt
Focuses: Cc:

Description

As a result, I will have to always use
echo htmlspecialchar(get_comment_excerpt())
if I don't want my blog goes wrong as there could be quotes in the comment.

Change History (3)

comment:1 @scribu4 years ago

  • Resolution set to worksforme
  • Status changed from new to closed

You can add this single line into your theme's functions.php:

add_filter('comment_excerpt', 'esc_html');

comment:2 @scribu4 years ago

  • Milestone Awaiting Review deleted

comment:3 @nacin4 years ago

I don't even see the use case for doing so. It's already kses'd.

Note: See TracTickets for help on using tickets.