wp_set_object_terms ampersand in term name

[kapacity]

This is a follow-up to #32248.
I believe we are running into this same core issue when using the wp_set_object_terms wp function. Here are the repro steps:

For a given post and taxonomy call:

 wp_set_object_terms($post_id, ["foo & bar"], 'my_taxonomy', false);

When the term does not yet exist it will be created with slug 'foo-bar' and name 'foo & bar in db.

Rename term to "this & that" in admin, slug remains foo-bar and name is 'this & that' in db.

Now call

 wp_set_object_terms($post_id, ["this & that"], 'my_taxonomy', false);

You get error 'A term with the name provided already exists in this taxonomy.'

This is because the name matching logic in term_exists does not find the term by name since it is comparing the non escaped name 'this & that' to the escaped name in the db 'this & that' and determines it does not exist.

I can work around this problem by calling the lower level wp functions myself, but this seems to be a bug.

[kapacity]

Any update on this?

Sanitize the $term argument being supplied to wp_set_object_terms() using sanitize_term_field( 'name' ... ).

Includes prior check that sanitize_title( $term ) !== $term to avoid sanitizing if the $term argument provided is the term's slug.
N.B. sanitize_title() is specifically what wp_insert_term() does to create a term slug.

Before/After video will be posted in the Trac ticket below.

Trac ticket: https://core.trac.wordpress.org/ticket/53152

[costdev]

Before/After patch

[costdev]

The ​Docs don't include the term name as a valid value for the $terms argument.

However, passing the term name as the value will either match an existing term, or create a new term if term_exists() is unable to find a match.

The patch resolves this ticket's issue with the existing functionality, but I'm not sure if:

• nothing should be done
• the issue should be closed due to incorrect usage of the function (although, we can be sure this isn't the only time that the term name has been/will be passed)
• the docs should be updated to mention the term name as a valid value
• or wp_set_object_terms() should be locked down a bit more - possibly with an error if is_string( $term ) && sanitize_title( $term ) !== $term to rule out non-slug string values - a breaking change for existing sites that pass the term name

If it's the latter, wp_remove_object_terms() may need to be updated too. If this is the best direction, I can look into this and open another ticket if the issue exists there too.

It would be great if a dev could give some guidance on how to proceed with this.

[hellofromTonya]

A single term slug, single term ID, or array of either term slugs or IDs.

The wp_set_object_terms() function accepts a slug or ID, but not a name. This ticket is not a bug, but rather an enhancement request to allow the function to also accept a name.

5.9 is in feature freeze with Beta 1 tomorrow. It's too late for this ticket to land in 5.9.

Moving it to 6.0 and leaving dev-feedback as it needs discussion and consensus about expanding it to accept a term name.

[peterwilsoncc]

In [52921] term_exists() was modified to use get_terms() rather than make a database query directly.

Searching by name is sanitized in WP_Term_Query. ​(source code ref)

Is this still needed?

[costdev]

Good call @peterwilsoncc!

Just tested on trunk using the same steps as before, which were:

1. Run wp_set_object_terms() to set the category as foo & bar.
2. Manually rename foo & bar to this & that, keep the slug as foo-bar.
3. Run wp_set_object_terms() to set the category as this & that.

Before [52921]:

• Fails on 3: A term with the name provided already exists with this parent.. ❌

After [52921]:

• Succeeds on 3: The category is set to this & that (slug: foo-bar). ✅

---

• Fixed in [52921].
• Related ticket: #36949.

[peterwilsoncc]

Thanks @costdev,

I'll commit the tests in your pull request as it was a use case that was earlier missed. I'll add them as part of #54725.

[peterwilsoncc]

Tests only following fix in other ticket.

[peterwilsoncc]

In 52938:

Tests: Include special characters in term names for wp_set_term_objects().

Test wp_set_term_objects() using terms with special characters in the name, for example ampersand, bullet and other symbols and punctuation.

Props kapacity, costdev.
Fixes #53152.
See #54725.