WordPress.org
Get WordPress

Make WordPress Core

Changes between Initial Version and Version 1 of Ticket #51159


Ignore:
Timestamp:
08/27/2020 06:59:19 PM (6 years ago)
Author:
whyisjake
Comment:

Ideally, WordPress core has a few functions that can replace the laborious methods to escape Javascript content given the different contexts. Something like the following:

  • esc_json()
  • esc_js_attr() or maybe esc_attr( $thing, 'json' )
  • esc_wp_json_encode() etc...

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #51159 – Description

    initial v1  
    150150PHP’s `json_encode()` has an `$options` parameter, which can be used to always Unicode-escape these HTML special characters:
    151151
     152{{{
    152153ALMOST (PHP 5.3+):
    153154<script>
    154155var foo = <?php echo wp_json_encode( $foo, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT ); ?>;
    155156</script>
     157}}}
    156158
    157159These constants are only available as of PHP 5.3.
    158160
    159 Also, just replacing those characters isn’t good enough. We also need to Unicode-escape ``` and `$` because of their special meanings in JavaScript template literals.
    160 
    161 GOOD (PHP 5.3+):
     161Also, just replacing those characters isn’t good enough. We also need to Unicode-escape `&#96;` and `$` because of their special meanings in JavaScript template literals.
    162162
    163163{{{
     164GOOD (PHP 5.3+):
    164165<script>
    165166var message = `hello, ${<?php echo str_replace(