Sanitize request values and improve translatable strings in edit-comments.php

[sandippatel11]

This patch addresses a small security and translation-related improvement in the wp-admin/edit-comments.php file:

1. Sanitization of Request Inputs

Currently, $_REQUEST['comment_status'] and $_REQUEST['pagegen_timestamp'] are used directly after wp_unslash():

$comment_status = wp_unslash( $_REQUEST['comment_status'] );
$delete_time    = wp_unslash( $_REQUEST['pagegen_timestamp'] );

2. Translatable String Formatting

$messages[] = __( 'This comment is already approved.' ) . sprintf(
    ' <a href="%1$s">%2$s</a>',
    esc_url( admin_url( "comment.php?action=editcomment&c=$same" ) ),
    __( 'Edit comment' )
);

is refactored into a single sprintf()-wrapped translatable string:

$messages[] = sprintf(
    __( 'This comment is already approved. <a href="%s">Edit comment</a>' ),
    esc_url( admin_url( "comment.php?action=editcomment&c=$same" ) )
);

[sandippatel11]

Missing text domain in query-large-title-posts.php block pattern

[sabernhardt]

The $comment_status and $delete_time variables run through $wpdb->prepare(), which returns a sanitized query string.

Regarding the translatable strings, I do not recommend refactoring them to add HTML markup and a %s placeholder for a link intended to remain at the end of the message. The ​three messages from [13247] have a consistent pattern, and they are already translated in more than 120 language locales.