WordPress.org

Make WordPress Core

Opened 10 years ago

Closed 10 years ago

Last modified 9 years ago

#9650 closed defect (bug) (fixed)

attribute_escape() shortcuts

Reported by: ryan Owned by:
Milestone: 2.8 Priority: normal
Severity: normal Version:
Component: Formatting Keywords: security i18n
Focuses: Cc:

Description (last modified by ryan)

attribute_escape() is often forgotten on value attributes, especially on translated messages. Maybe some shortcuts would improve adoption. Use esc() as shorthand for atribute_escape() and add _e_esc() and _t_esc() which run translations through attribute_escape(), thus avoiding the need to do this: echo attribute_escape( __('Translated string') )

Attachments (2)

9650.diff (4.5 KB) - added by ryan 10 years ago.
9650 .patch (3.6 KB) - added by hakre 10 years ago.
Akismet

Download all attachments as: .zip

Change History (23)

#1 @ryan
10 years ago

  • Component changed from General to Formatting
  • Keywords security i18n added
  • Owner anonymous deleted

#2 @ryan
10 years ago

  • Description modified (diff)

#3 @ryan
10 years ago

_a(), _ea(), _xa() are other suggestions.

@ryan
10 years ago

#4 @ryan
10 years ago

(In [11103]) attr(), _a(), _ea(), _xa() for shorthand attribute escaping. see #9650

#5 @Denis-de-Bernardy
10 years ago

thank you. you've just made coding shorter to write. :-)

#6 @ryan
10 years ago

(In [11104]) Some attr escaping. see #9650

#7 @ryan
10 years ago

(In [11109]) s/attribute_escape/attr/. see #9650

#8 @ryan
10 years ago

(In [11110]) attr escaping. see #9650

#9 @Simek
10 years ago

akismet.php file form Akismet Plugin also need to be updated.

#10 @Denis-de-Bernardy
10 years ago

  • Milestone changed from Unassigned to 2.8

@hakre
10 years ago

Akismet

#11 @markjaquith
10 years ago

I find this to be harder to remember. My inclination would be to standardize the function names but keep them memorable and more obvious.

Here is my suggestion:

  • __ = translate return suffix
  • _e = translate echo suffix

Stick all escaping functions into an "esc" class.

methods:

  • attr()
  • url()
  • js()
  • html()
  • sql()

html(), js(), attr() would have __ and _e suffix versions too.

So it would look like:

esc::[context][optional translation suffix]( $input, [optional translation domain]);

Example:

<a href="<?php echo esc::url( $my_url ); ?>"><?php esc::html_e( 'My translatable string' ); ?></a>

It's still shorter, but it's obvious that escaping is going on, and which context is being used. People already know __() and _e() so we keep those as suffixes. This also puts all our escaping in one place, so that curious people can look there to see which contexts they should be escaping but might not be.

#12 @ryan
10 years ago

Let's do it.

#13 @ryan
10 years ago

xgettext might not like that format though.

#14 @ryan
10 years ago

I can't get xgettext to recognize anything with a ::

#15 @Denis-de-Bernardy
10 years ago

mm... in that case we'd want to use straight functions instead: esc_html_e(), etc.

#16 @link2caro
10 years ago

  • Cc tran.minhquan@… added

keep _e and at the beginning for better auto-completion if straight functions are used

#17 @link2caro
10 years ago

sorry,

!_e()
__()

#18 @markjaquith
10 years ago

(In [11204]) _a(), _ea(), _xa(), attr() are now esc_attr(), esc_attr_e(), esc_attr_x(), esc_attr() -- still short, but less cryptic. see #9650

#19 @markjaquith
10 years ago

link2caro, considered that, but _eattr_esc() isn't very clear. The leading underscore makes it ideal as a suffix. Also:

attribute_escape(__('string'));

Becomes:

esc_attr__('string');

Maps well.

#20 @Viper007Bond
10 years ago

Let's not forget about js_escape(). Worth renaming to esc_js() or similar?

See also: #7648

#21 @ryan
10 years ago

  • Resolution set to fixed
  • Status changed from new to closed
Note: See TracTickets for help on using tickets.