wp_dropdown_categories allows multiple classes

[tnash]

The function wp_dropdown_categories() provides the argument for class in line with many other functions however it uses:

$class    = esc_attr( $parsed_args['class'] );

Rather then then:

sanitize_html_class( $class )

This means its not using the much more restrictive santization and is allowing multiple classes.

[tnash]

Patch for wp_dropdown_categories to use sanitize_html_class

[SergeyBiryukov]

Hi there, welcome back to WordPress Trac! Thanks for the ticket.

Just noting this appears to apply to:

• wp_dropdown_categories()
• wp_list_categories()
• wp_dropdown_page()
• wp_dropdown_users()

On the other hand, wp_list_bookmarks() does use sanitize_html_class(), see [32906] / #51666.

Not allowing multiple classes in the other functions would be a back-compat break, they should at least allow for passing in an array of classes, same as wp_list_bookmarks().

[SergeyBiryukov]

In 49688:

Docs: Clarify that the $class argument of wp_list_bookmarks() can accept an array.

Follow-up to [32906].

See #51855, #51800.

[hellofromTonya]

$class = esc_attr introduced in 2.8 via changeset 11890.

[tnash]

Personally I would love to see sanitize_html_class() support multiple classes safely.

However the ticket was raised exactly because of the inconsistencies across functions, developers will expect class arguments to behave and be escaped the same across functions and indeed a function exists for this very usecase so it would make sense to use the stricter purpose built function. Alternatively to switch for all functions to use the more permissive esc_attr when inserting class.