Write Post title doesn't escape HTML tags

[hje1555]

I was writing a new post and I used the title "Curse of the <p>". When saving the post, it appears under Your Drafts but the <p> has not been escaped, so the browser renders a line break.

[santosj]

Fix

"Curse of the <p>"

Perhaps a setting, where it allows you to place HTML in the title if you want and escape it if you don't.

[JeremyVisser]

Replying to santosj:

Perhaps a setting, where it allows you to place HTML in the title if you want and escape it if you don't.

Noooo! We don't need Yet Another (tm) setting, for such a niche thing. Do The Right Thing (tm) in the first place, and we don't need it to be changed.

[markjaquith]

I don't think HTML belongs in titles, but there is a small-but-vocal contingent who thinks it does.

If we do entitize it, we should do it in a way that allows a plugin to circumvent it.

[hje1555]

This kind of input should be sanitized. The exception is the Code view, where it is clear that a restricted set of XHTML is allowed.

[Viper007Bond]

It's a toughy. Personally, I like being able to <del> and <em> stuff in my titles.

[Viper007Bond]

Replying to Viper007Bond:

It's a toughy. Personally, I like being able to <del> and <em> stuff in my titles.

Although for the average user, I think they'd expect that those items would display as typed.

So, a solution:

On output (anywhere and everywhere), filter the title and do a htmlspecialchars() on it rendering HTML invalid. For us wishing to still post HTML in titles, we could just remove the filter.

[DavidSzp]

I wrote a post with the title "</2007>" for New Years Eve today. Instead, my post title turns up blank in the web browser. This is not expected behavior! It is not clear that HTML is acceptable and must be escaped in the title anywhere in the interface. I had to edit the post title to "&lt;/2007&gt;" manually, which fixed it, but I shouldn't have had to do that.

Additionally, with the original title I specified above, the auto-generated post-slug was "176" which was the post ID of the post, not "2007" which is the expected, sanitized slug (I changed it to "closing-2007" manually, but it was still incorrect).

I do agree that allowing a plugin to override this behavior if people want to use HTML in their titles is a good idea.

I am re-opening this ticket as although it is marked duplicate, I can't find where the duplicate ticket is! I searched.

[westi]

Moving to 2.6

Not a simple change and needs a patch.

[Viper007Bond]

Intended behavior currently, so it's not a bug.

[Denis-de-Bernardy]

Moreover, it's still a dup... Can't recall where it is, but I'm pretty certain it's in there...

[solarissmoke]

Any thoughts from senior devs on whether this is worth keeping open? Suggestions above are basically:

• Add an esc_html filter to the title, which advanced users can remove (I can see serious back-compat issues here)

• Add a setting to determine behaviour

• Do nothing, it's intended behaviour

[nacin]

This has been called intended behavior for quite a while. Closing due to lack of traction.

[peaceablewhale]

See also #14361

[SergeyBiryukov]

#14361 was marked as a duplicate.