wp_insert_term sanitizes attribute names, while term_exists does not before checking names

[Dekadinious]

We have found an edge-case bug in the way term_exists handles checking for existing names compared to how wp_insert_term inserts the names. This happens if you are in a situation where the term name has an ampersand, and term_exists reach the point where it needs to check for the name. This happened to us because we have a suffix on each term slug.

So if we are creating the term "X & Y", the slug will be "x-y-suffix". Therefore, there is no "x-y" slug in the database. The term_exists function will therefore not find the slug and will check for the name instead.

When checking for the name, it will see if "X & Y" exists in the database. It does not, because wp_insert_term sanitizes the name and inserts it as "X & Y".

The behavior is inconsistent. I would expect term_exist to find that the term exists when checking for the exact name used in wp_insert_term.

[costdev]

Test Report

Env

• WordPress: trunk
• Chrome 97.0.4692.71
• Windows 10
• Theme: Twenty Twenty One
• Gutenberg Editor
• Plugin: None activated

Steps to test

1. Navigate to Posts > Categories.
2. Insert a category called X & Y with the slug x-y-suffix.
3. Add wp_die( var_export( term_exists( 'X & Y' ), true ) ); into the active theme's functions.php file.
4. Refresh the page.
5. Actual output: NULL. Expected output: <the term's ID>.

Cleanup

Must be done before re-testing.

1. Remove the line added to the active theme's functions.php file.
2. Navigate to Posts > Categories.
3. Delete the X & Y category.

Results

• Issue reproduced ✅

Trac ticket: https://core.trac.wordpress.org/ticket/54840

[costdev]

PR added with unit tests. Milestoning for 6.0.

[dlh]

#47351 was marked as a duplicate.

[Dekadinious]

Replying to costdev:

PR added with unit tests. Milestoning for 6.0.'

EDIT: Sorry, I just had some bad code hanging around in my testing. It does not seem to be a problem with get_terms.

I don't know if this should be posted here as a comment, or if a new ticket should be created, but this seems to happen with get_terms() also. If you choose to fetch by name but don't run esc_attr() first, it will not find a term with single quotes in it. One would think get_terms() would find a term inserted by wp_insert_term() without modifications.

[costdev]

This particular issue appears to have been resolved by [52921]. In my testing, the term ID is returned now. Closing this ticket as fixed.

With regards to this comment, if an issue exists in get_terms(), this should be handled in a separate ticket.

This issue appears to be fixed by 52921.