Make WordPress Core

Opened 11 years ago

Closed 10 years ago

Last modified 10 years ago

#13419 closed defect (bug) (worksforme)

comment_excerpt does not use htmlspecialchars

Reported by: gene91 Owned by:
Milestone: Priority: normal
Severity: normal Version:
Component: Comments Keywords: comment_excerpt
Focuses: Cc:


As a result, I will have to always use
echo htmlspecialchar(get_comment_excerpt())
if I don't want my blog goes wrong as there could be quotes in the comment.

Change History (3)

#1 @scribu
10 years ago

  • Resolution set to worksforme
  • Status changed from new to closed

You can add this single line into your theme's functions.php:

add_filter('comment_excerpt', 'esc_html');

#2 @scribu
10 years ago

  • Milestone Awaiting Review deleted

#3 @nacin
10 years ago

I don't even see the use case for doing so. It's already kses'd.

Note: See TracTickets for help on using tickets.