From 6c2ffddf31269957353b1ad56174802ac14832a3 Mon Sep 17 00:00:00 2001 From: markjaquith Date: Tue, 5 May 2009 19:43:53 +0000 Subject: [PATCH] _a(), _ea(), _xa(), attr() are now esc_attr__(), esc_attr_e(), esc_attr_x(), esc_attr() -- still short, but less cryptic. see #9650 git-svn-id: http://svn.automattic.com/wordpress/trunk@11204 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/admin-ajax.php | 8 +- wp-admin/categories.php | 8 +- wp-admin/comment.php | 10 +-- wp-admin/custom-header.php | 22 ++--- wp-admin/edit-attachment-rows.php | 8 +- wp-admin/edit-category-form.php | 8 +- wp-admin/edit-comments.php | 48 +++++------ wp-admin/edit-form-advanced.php | 66 +++++++-------- wp-admin/edit-form-comment.php | 18 ++--- wp-admin/edit-link-categories.php | 8 +- wp-admin/edit-link-category-form.php | 10 +-- wp-admin/edit-link-form.php | 26 +++--- wp-admin/edit-page-form.php | 46 +++++------ wp-admin/edit-pages.php | 8 +- wp-admin/edit-tag-form.php | 10 +-- wp-admin/edit-tags.php | 12 +-- wp-admin/edit.php | 16 ++-- wp-admin/export.php | 4 +- wp-admin/import/blogger.php | 8 +- wp-admin/import/btt.php | 4 +- wp-admin/import/dotclear.php | 12 +-- wp-admin/import/greymatter.php | 2 +- wp-admin/import/jkw.php | 8 +- wp-admin/import/livejournal.php | 20 ++--- wp-admin/import/mt.php | 8 +- wp-admin/import/opml.php | 2 +- wp-admin/import/stp.php | 6 +- wp-admin/import/textpattern.php | 12 +-- wp-admin/import/utw.php | 8 +- wp-admin/import/wordpress.php | 6 +- wp-admin/import/wp-cat2tag.php | 10 +-- wp-admin/includes/bookmark.php | 2 +- wp-admin/includes/class-wp-upgrader.php | 24 +++--- wp-admin/includes/dashboard.php | 20 ++--- wp-admin/includes/file.php | 12 +-- wp-admin/includes/manifest.php | 2 +- wp-admin/includes/media.php | 84 ++++++++++---------- wp-admin/includes/plugin-install.php | 18 ++--- wp-admin/includes/plugin.php | 2 +- wp-admin/includes/taxonomy.php | 2 +- wp-admin/includes/template.php | 84 ++++++++++---------- wp-admin/includes/theme-install.php | 18 ++--- wp-admin/includes/user.php | 18 ++--- wp-admin/includes/widgets.php | 16 ++-- wp-admin/install.php | 6 +- wp-admin/link-manager.php | 16 ++-- wp-admin/load-scripts.php | 2 +- wp-admin/load-styles.php | 2 +- wp-admin/media-upload.php | 2 +- wp-admin/media.php | 6 +- wp-admin/menu.php | 2 +- wp-admin/options-discussion.php | 16 ++-- wp-admin/options-general.php | 14 ++-- wp-admin/options-media.php | 2 +- wp-admin/options-misc.php | 6 +- wp-admin/options-permalink.php | 14 ++-- wp-admin/options-privacy.php | 2 +- wp-admin/options-reading.php | 2 +- wp-admin/options-writing.php | 2 +- wp-admin/options.php | 6 +- wp-admin/plugin-editor.php | 20 ++--- wp-admin/plugins.php | 20 ++--- wp-admin/press-this.php | 30 +++---- wp-admin/sidebar.php | 10 +-- wp-admin/theme-editor.php | 16 ++-- wp-admin/themes.php | 6 +- wp-admin/tools.php | 2 +- wp-admin/update-core.php | 10 +-- wp-admin/upload.php | 20 ++--- wp-admin/user-edit.php | 26 +++--- wp-admin/user-new.php | 12 +-- wp-admin/users.php | 22 ++--- wp-admin/widgets.php | 12 +-- wp-app.php | 12 +-- wp-content/themes/classic/comments-popup.php | 12 +-- wp-content/themes/classic/comments.php | 8 +- wp-content/themes/classic/sidebar.php | 2 +- wp-content/themes/default/comments-popup.php | 8 +- wp-content/themes/default/comments.php | 6 +- wp-content/themes/default/functions.php | 52 ++++++------ wp-includes/author-template.php | 4 +- wp-includes/bookmark-template.php | 4 +- wp-includes/bookmark.php | 4 +- wp-includes/category-template.php | 2 +- wp-includes/class.wp-styles.php | 4 +- wp-includes/classes.php | 6 +- wp-includes/comment-template.php | 2 +- wp-includes/comment.php | 4 +- wp-includes/default-widgets.php | 40 +++++----- wp-includes/deprecated.php | 4 +- wp-includes/feed-atom-comments.php | 4 +- wp-includes/feed-rss2-comments.php | 2 +- wp-includes/feed.php | 2 +- wp-includes/formatting.php | 8 +- wp-includes/functions.php | 8 +- wp-includes/general-template.php | 24 +++--- wp-includes/kses.php | 6 +- wp-includes/l10n.php | 16 ++-- wp-includes/link-template.php | 18 ++--- wp-includes/media.php | 6 +- wp-includes/pluggable.php | 2 +- wp-includes/post-template.php | 20 ++--- wp-includes/post.php | 4 +- wp-includes/rss.php | 2 +- wp-includes/script-loader.php | 18 ++--- wp-includes/taxonomy.php | 6 +- wp-includes/theme.php | 2 +- wp-includes/update.php | 6 +- wp-links-opml.php | 8 +- wp-login.php | 20 ++--- 110 files changed, 703 insertions(+), 703 deletions(-) diff --git a/wp-admin/admin-ajax.php b/wp-admin/admin-ajax.php index 1016fb122..78c3c94db 100644 --- a/wp-admin/admin-ajax.php +++ b/wp-admin/admin-ajax.php @@ -426,7 +426,7 @@ case 'add-link-category' : // On the Fly $x->add( array( 'what' => 'link-category', 'id' => $cat_id, - 'data' => "", + 'data' => "", 'position' => -1 ) ); } @@ -474,7 +474,7 @@ case 'add-cat' : // From Manage->Categories $cat_full_name = $_cat->name . ' — ' . $cat_full_name; $level++; } - $cat_full_name = attr($cat_full_name); + $cat_full_name = esc_attr($cat_full_name); $x = new WP_Ajax_Response( array( 'what' => 'cat', @@ -552,7 +552,7 @@ case 'add-tag' : // From Manage->Tags die('0'); $tag_full_name = $tag->name; - $tag_full_name = attr($tag_full_name); + $tag_full_name = esc_attr($tag_full_name); $x = new WP_Ajax_Response( array( 'what' => 'tag', @@ -1214,7 +1214,7 @@ case 'find_posts': $time = mysql2date(__('Y/m/d'), $post->post_date); } - $html .= ''; + $html .= ''; $html .= ''.wp_specialchars($time, true).''.wp_specialchars($stat, true).''."\n\n"; } $html .= ''; diff --git a/wp-admin/categories.php b/wp-admin/categories.php index 904e736a1..6c1baec17 100644 --- a/wp-admin/categories.php +++ b/wp-admin/categories.php @@ -144,7 +144,7 @@ endif; ?>

- +


@@ -189,7 +189,7 @@ if ( $page_links ) - + @@ -229,7 +229,7 @@ if ( $page_links ) - + @@ -283,7 +283,7 @@ if ( $page_links )

-

+

diff --git a/wp-admin/comment.php b/wp-admin/comment.php index 92e43bb53..f6437e575 100644 --- a/wp-admin/comment.php +++ b/wp-admin/comment.php @@ -90,18 +90,18 @@ if ( 'spam' == $_GET['dt'] ) { - - + +
' onclick="self.location='" />' onclick="self.location='" />
- + - - + + diff --git a/wp-admin/custom-header.php b/wp-admin/custom-header.php index 72c861e07..0ac3a11f2 100644 --- a/wp-admin/custom-header.php +++ b/wp-admin/custom-header.php @@ -284,10 +284,10 @@ class Custom_Image_Header {
- - + + -
+ @@ -296,12 +296,12 @@ class Custom_Image_Header {

%1$d x %2$d pixels will be used as-is.'), HEADER_IMAGE_WIDTH, HEADER_IMAGE_HEIGHT); ?>

-
+

- +

@@ -311,9 +311,9 @@ class Custom_Image_Header {

-
+ - +
-
+

@@ -386,10 +386,10 @@ class Custom_Image_Header { - - + + - +

diff --git a/wp-admin/edit-attachment-rows.php b/wp-admin/edit-attachment-rows.php index eb742dac7..84a4f8cfe 100644 --- a/wp-admin/edit-attachment-rows.php +++ b/wp-admin/edit-attachment-rows.php @@ -62,7 +62,7 @@ foreach ($posts_columns as $column_name => $column_display_name ) { if ( $thumb = wp_get_attachment_image( $post->ID, array(80, 60), true ) ) { ?> - + @@ -74,7 +74,7 @@ foreach ($posts_columns as $column_name => $column_display_name ) { case 'media': ?> - >
+ >
ID))); ?>

$column_display_name ) { $actions['edit'] = '' . __('Edit') . ''; if ( current_user_can('delete_post', $post->ID) ) $actions['delete'] = "ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $post->post_status) ? __("You are about to delete this attachment '%s'\n 'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this attachment '%s'\n 'Cancel' to stop, 'OK' to delete."), $post->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . ""; - $actions['view'] = '' . __('View') . ''; + $actions['view'] = '' . __('View') . ''; $action_count = count($actions); $i = 0; echo '

'; @@ -182,7 +182,7 @@ foreach ($posts_columns as $column_name => $column_display_name ) { case 'actions': ?> > - | + |
- + - - @@ -70,7 +70,7 @@ _fill_empty_category($category);

+

+
-

+

diff --git a/wp-admin/edit-comments.php b/wp-admin/edit-comments.php index 21dd065d1..5d69c9577 100644 --- a/wp-admin/edit-comments.php +++ b/wp-admin/edit-comments.php @@ -83,7 +83,7 @@ else require_once('admin-header.php'); -$mode = ( ! isset($_GET['mode']) || empty($_GET['mode']) ) ? 'detail' : attr($_GET['mode']); +$mode = ( ! isset($_GET['mode']) || empty($_GET['mode']) ) ? 'detail' : esc_attr($_GET['mode']); $default_status = get_user_option('edit_comments_last_view'); if ( empty($default_status) ) @@ -94,10 +94,10 @@ if ( !in_array($comment_status, array('all', 'moderated', 'approved', 'spam')) ) if ( $comment_status != $default_status ) update_usermeta($current_user->ID, 'edit_comments_last_view', $comment_status); -$comment_type = !empty($_GET['comment_type']) ? attr($_GET['comment_type']) : ''; +$comment_type = !empty($_GET['comment_type']) ? esc_attr($_GET['comment_type']) : ''; $search_dirty = ( isset($_GET['s']) ) ? $_GET['s'] : ''; -$search = attr( $search_dirty ); ?> +$search = esc_attr( $search_dirty ); ?>
@@ -164,7 +164,7 @@ foreach ( $stati as $status => $label ) { /* // I toyed with this, but decided against it. Leaving it in here in case anyone thinks it is a good idea. ~ Mark if ( !empty( $_GET['s'] ) ) - $link = add_query_arg( 's', attr( stripslashes( $_GET['s'] ) ), $link ); + $link = add_query_arg( 's', esc_attr( stripslashes( $_GET['s'] ) ), $link ); */ $status_links[] = "
  • " . sprintf( _n( $label[0], $label[1], $num_comments->$status ), @@ -182,7 +182,7 @@ unset($status_links);

    - +

    - + - + - - + +
    @@ -240,9 +240,9 @@ $page_links = paginate_links( array( '' . number_format_i18n( $total ) . '', $page_links ); echo $page_links_text; ?>
    - - - + + +
    @@ -259,7 +259,7 @@ $page_links = paginate_links( array( - + - + - + - + @@ -346,10 +346,10 @@ if ( $page_links ) - + - +
    @@ -360,12 +360,12 @@ if ( $page_links ) diff --git a/wp-admin/edit-form-advanced.php b/wp-admin/edit-form-advanced.php index d1240b2d5..eadb7071b 100644 --- a/wp-admin/edit-form-advanced.php +++ b/wp-admin/edit-form-advanced.php @@ -33,11 +33,11 @@ $notices[1] = __( 'There is an autosave of this post that is more recent than th if ( 0 == $post_ID ) { $form_action = 'post'; $temp_ID = -1 * time(); // don't change this formula without looking at wp_write_post() - $form_extra = ""; + $form_extra = ""; $autosave = false; } else { $form_action = 'editpost'; - $form_extra = ""; + $form_extra = ""; $autosave = wp_get_post_autosave( $post_ID ); // Detect if there exists an autosave newer than the post and if that autosave is different than the post @@ -72,15 +72,15 @@ function post_submit_meta_box($post) {
    - +
    post_status && 'future' != $post->post_status && 'pending' != $post->post_status ) { ?> -post_status ) { ?>style="display:none" type="submit" name="save" id="save-post" value="" tabindex="4" class="button button-highlighted" /> +post_status ) { ?>style="display:none" type="submit" name="save" id="save-post" value="" tabindex="4" class="button button-highlighted" /> post_status && $can_publish ) { ?> - +
    @@ -129,7 +129,7 @@ switch ( $post->post_status ) {     post_status ) { ?>style="display:none;" class="edit-post-status hide-if-no-js" tabindex='4'>
    - + + ID)); ?> /> - + />
    ID)); ?> tabindex="4" />
    />
    -
    +
    />

    @@ -238,20 +238,20 @@ if ( ( 'edit' == $action ) && current_user_can('delete_post', $post->ID) ) { ?> if ( !in_array( $post->post_status, array('publish', 'future', 'private') ) || 0 == $post->ID ) { if ( current_user_can('publish_posts') ) : if ( !empty($post->post_date_gmt) && time() < strtotime( $post->post_date_gmt . ' +0000' ) ) : ?> - - + + - - + + - - + + - - + +

    @@ -271,20 +271,20 @@ add_meta_box('submitdiv', __('Publish'), 'post_submit_meta_box', 'post', 'side', * @param object $post */ function post_tags_meta_box($post, $box) { - $tax_name = attr(substr($box['id'], 8)); + $tax_name = esc_attr(substr($box['id'], 8)); $taxonomy = get_taxonomy($tax_name); - $helps = isset($taxonomy->helps) ? attr($taxonomy->helps) : __('Separate tags with commas.'); + $helps = isset($taxonomy->helps) ? esc_attr($taxonomy->helps) : __('Separate tags with commas.'); ?>

    -
    +
    - - + +

    @@ -297,7 +297,7 @@ function post_tags_meta_box($post, $box) { foreach ( get_object_taxonomies('post') as $tax_name ) { if ( !is_taxonomy_hierarchical($tax_name) ) { $taxonomy = get_taxonomy($tax_name); - $label = isset($taxonomy->label) ? attr($taxonomy->label) : $tax_name; + $label = isset($taxonomy->label) ? esc_attr($taxonomy->label) : $tax_name; add_meta_box('tagsdiv-' . $tax_name, $label, 'post_tags_meta_box', 'post', 'side', 'core'); } @@ -333,9 +333,9 @@ function post_categories_meta_box($post) {

    - + 0, 'name' => 'newcat_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => __('Parent category'), 'tab_index' => 3 ) ); ?> - +

    @@ -385,7 +385,7 @@ add_meta_box('postexcerpt', __('Excerpt'), 'post_excerpt_meta_box', 'post', 'nor * @param object $post */ function post_trackback_meta_box($post) { - $form_trackback = 'to_ping) ) .'" />'; + $form_trackback = 'to_ping) ) .'" />'; if ('' != $post->pinged) { $pings = '

    '. __('Already pinged:') . '

      '; $already_pinged = explode("\n", trim($post->pinged)); @@ -492,7 +492,7 @@ if ( 'publish' == $post->post_status || 'private' == $post->post_status ) */ function post_slug_meta_box($post) { ?> - + post_status && !current_user_can( 'publish_posts' ) ) ) @@ -567,11 +567,11 @@ else ?> - - - - - + + + + + post_status ) @@ -592,7 +592,7 @@ echo $form_extra ?>
      - +
      comment_ID); $form_action = 'editedcomment'; -$form_extra = "' />\n\n\n\n\n' /> comment_author_email ); -$url = attr( $comment->comment_author_url ); +$email = esc_attr( $comment->comment_author_email ); +$url = esc_attr( $comment->comment_author_url ); // add_meta_box('submitdiv', __('Save'), 'comment_submit_meta_box', 'comment', 'side', 'core'); ?> @@ -72,7 +72,7 @@ $date = date_i18n( $datef, strtotime( $comment->comment_date ) ); comment_ID&_wp_original_http_referer=" . urlencode(wp_get_referer()), 'delete-comment_' . $comment->comment_ID) . "' onclick=\"if ( confirm('" . js_escape(__("You are about to delete this comment. \n 'Cancel' to stop, 'OK' to delete.")) . "') ){return true;}return false;\">" . __('Delete') . "\n"; ?>
      - +
      @@ -90,7 +90,7 @@ $date = date_i18n( $datef, strtotime( $comment->comment_date ) ); - + @@ -101,7 +101,7 @@ $date = date_i18n( $datef, strtotime( $comment->comment_date ) ); _e( 'E-mail:' ); } ?> - + @@ -113,7 +113,7 @@ $date = date_i18n( $datef, strtotime( $comment->comment_date ) ); } else { _e( 'URL:' ); } ?> - + @@ -128,8 +128,8 @@ $date = date_i18n( $datef, strtotime( $comment->comment_date ) ); - - + + diff --git a/wp-admin/edit-link-categories.php b/wp-admin/edit-link-categories.php index 82c09a105..f3a60f0ba 100644 --- a/wp-admin/edit-link-categories.php +++ b/wp-admin/edit-link-categories.php @@ -75,7 +75,7 @@ endif; ?>

      - +


      @@ -112,7 +112,7 @@ if ( $page_links ) - +
    @@ -166,7 +166,7 @@ if ( $page_links ) - +

    • @@ -211,7 +211,7 @@ if ( $page_links ) -

    +

    diff --git a/wp-admin/edit-link-category-form.php b/wp-admin/edit-link-category-form.php index ba13e5873..be52d1c01 100644 --- a/wp-admin/edit-link-category-form.php +++ b/wp-admin/edit-link-category-form.php @@ -57,17 +57,17 @@ _fill_empty_link_category($category);
    - - + + - + - @@ -75,7 +75,7 @@ _fill_empty_link_category($category);

    +
    -

    +

    diff --git a/wp-admin/edit-link-form.php b/wp-admin/edit-link-form.php index 4cb903c7c..42085c1aa 100644 --- a/wp-admin/edit-link-form.php +++ b/wp-admin/edit-link-form.php @@ -60,7 +60,7 @@ function link_submit_meta_box($link) {
    - +
    @@ -91,9 +91,9 @@ if ( !empty($_GET['action']) && 'edit' == $_GET['action'] && current_user_can('m
    link_id) ) { ?> - + - +
    @@ -139,8 +139,8 @@ function link_categories_meta_box($link) { ?>

    @@ -185,7 +185,7 @@ function link_xfn_meta_box($link) { - + "; - return "

    $heading

    $blogtitle

    $directions

    @@ -305,11 +305,11 @@ function link_advanced_meta_box($link) { - + - + @@ -320,7 +320,7 @@ function link_advanced_meta_box($link) {
    +

    @@ -382,7 +382,7 @@ $side_meta_boxes = do_meta_boxes( 'link', 'side', $link );

    - +

    http://wordpress.org/ — don’t forget the http://'); ?>

    @@ -390,7 +390,7 @@ $side_meta_boxes = do_meta_boxes( 'link', 'side', $link );

    - +

    @@ -404,7 +404,7 @@ do_meta_boxes('link', 'advanced', $link); if ( $link_id ) : ?> - + diff --git a/wp-admin/edit-page-form.php b/wp-admin/edit-page-form.php index 4960f56ca..02b74dadf 100644 --- a/wp-admin/edit-page-form.php +++ b/wp-admin/edit-page-form.php @@ -66,15 +66,15 @@ function page_submit_meta_box($post) {
    - +
    post_status && 'future' != $post->post_status && 'pending' != $post->post_status ) { ?> -post_status ) { ?>style="display:none" type="submit" name="save" id="save-post" value="" tabindex="4" class="button button-highlighted" /> +post_status ) { ?>style="display:none" type="submit" name="save" id="save-post" value="" tabindex="4" class="button button-highlighted" /> post_status && $can_publish ) { ?> - +
    @@ -123,7 +123,7 @@ switch ( $post->post_status ) { post_status ) { ?>style="display:none;" class="edit-post-status hide-if-no-js" tabindex='4'>
    - + - + + />
    />
    -
    +
    />

    @@ -226,20 +226,20 @@ if ( !in_array( $post->post_status, array('publish', 'future', 'private') ) || 0 post_date_gmt) && time() < strtotime( $post->post_date_gmt . ' +0000' ) ) : ?> - - + + - - + + - - + + - - + +

    @@ -291,7 +291,7 @@ function page_attributes_meta_box($post){
    -

    +

    - + '; ?> - - - + + + - - + + post_status ) wp_original_referer_field(true, 'previous'); ?> @@ -436,7 +436,7 @@ $side_meta_boxes = do_meta_boxes('page', 'side', $post); ?>
    - +
    ID); ?> diff --git a/wp-admin/edit-pages.php b/wp-admin/edit-pages.php index bcf9372cf..d7f4e0886 100644 --- a/wp-admin/edit-pages.php +++ b/wp-admin/edit-pages.php @@ -171,11 +171,11 @@ endif;

    - +

    - + @@ -215,7 +215,7 @@ if ( $page_links ) : ?> - +
    @@ -254,7 +254,7 @@ if ( $page_links ) - +

    diff --git a/wp-admin/edit-tag-form.php b/wp-admin/edit-tag-form.php index 5390e6e51..210b3b198 100644 --- a/wp-admin/edit-tag-form.php +++ b/wp-admin/edit-tag-form.php @@ -20,18 +20,18 @@ do_action('edit_tag_form_pre', $tag); ?>
    - - + + - - @@ -40,7 +40,7 @@ do_action('edit_tag_form_pre', $tag); ?>
    +

    +

    -

    +

    diff --git a/wp-admin/edit-tags.php b/wp-admin/edit-tags.php index e71c3b929..88f4b5185 100644 --- a/wp-admin/edit-tags.php +++ b/wp-admin/edit-tags.php @@ -160,7 +160,7 @@ endif; ?>

    - +


    @@ -170,7 +170,7 @@ endif; ?>
    - +
    - +
    @@ -244,7 +244,7 @@ if ( $page_links ) - +

    @@ -276,7 +276,7 @@ else
    - +
    @@ -297,7 +297,7 @@ else

    -

    +

    diff --git a/wp-admin/edit.php b/wp-admin/edit.php index 6ada6de94..3197b2d85 100644 --- a/wp-admin/edit.php +++ b/wp-admin/edit.php @@ -92,7 +92,7 @@ if ( !isset( $_GET['paged'] ) ) if ( empty($_GET['mode']) ) $mode = 'list'; else - $mode = attr($_GET['mode']); ?> + $mode = esc_attr($_GET['mode']); ?>
    @@ -166,13 +166,13 @@ endif;

    - +

    - + - + @@ -195,7 +195,7 @@ $page_links = paginate_links( array( - + yyear$arc_row->mmonth") . "'>"; + echo ""; echo $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear"; echo "\n"; } @@ -236,7 +236,7 @@ $dropdown_options = array('show_option_all' => __('View all categories'), 'hide_ wp_dropdown_categories($dropdown_options); do_action('restrict_manage_posts'); ?> - +
    @@ -275,7 +275,7 @@ if ( $page_links ) - +

    diff --git a/wp-admin/export.php b/wp-admin/export.php index 3f39ff1fb..0f750b912 100644 --- a/wp-admin/export.php +++ b/wp-admin/export.php @@ -42,14 +42,14 @@ require_once ('admin-header.php'); $authors = $wpdb->get_col( "SELECT post_author FROM $wpdb->posts GROUP BY post_author" ); foreach ( $authors as $id ) { $o = get_userdata( $id ); - echo ""; + echo ""; } ?>
    -

    +

    diff --git a/wp-admin/import/blogger.php b/wp-admin/import/blogger.php index 8d119eab0..2642c2714 100644 --- a/wp-admin/import/blogger.php +++ b/wp-admin/import/blogger.php @@ -51,7 +51,7 @@ class Blogger_Import { $welcome = __('Howdy! This importer allows you to import posts and comments from your Blogger account into your WordPress blog.'); $prereqs = __('To use this importer, you must have a Google account and an upgraded (New, was Beta) blog hosted on blogspot.com or a custom domain (not FTP).'); $stepone = __('The first thing you need to do is tell Blogger to let WordPress access your account. You will be sent back here after providing authorization.'); - $auth = _a('Authorize'); + $auth = esc_attr__('Authorize'); echo "
    @@ -214,7 +214,7 @@ class Blogger_Import { $value = $continue; else $value = $authors; - $value = attr($value); + $value = esc_attr($value); $blogtitle = js_escape( $blog['title'] ); $pdone = isset($blog['posts_done']) ? (int) $blog['posts_done'] : 0; $cdone = isset($blog['comments_done']) ? (int) $blog['comments_done'] : 0; @@ -663,7 +663,7 @@ class Blogger_Import { foreach ( $blog['authors'] as $i => $author ) $rows .= "
    $rows
    $mapthis$tothis
    "; + return "

    $heading

    $blogtitle

    $directions

    $rows
    $mapthis$tothis
    "; } function get_user_options($current) { @@ -832,7 +832,7 @@ class Blogger_Import { if ( $saved && !isset($_GET['noheader']) ) { $restart = __('Restart'); $message = __('We have saved some information about your Blogger account in your WordPress database. Clearing this information will allow you to start over. Restarting will not affect any posts you have already imported. If you attempt to re-import a blog, duplicate posts and comments will be skipped.'); - $submit = _a('Clear account information'); + $submit = esc_attr__('Clear account information'); echo "

    $restart

    $message

    "; } } diff --git a/wp-admin/import/btt.php b/wp-admin/import/btt.php index 9224336aa..a2aab3ffd 100644 --- a/wp-admin/import/btt.php +++ b/wp-admin/import/btt.php @@ -35,7 +35,7 @@ class BunnyTags_Import { echo '

    '.__('Don’t be stupid - backup your database before proceeding!').'

    '; echo '
    '; wp_nonce_field('import-btt'); - echo '

    '; + echo '

    '; echo '
    '; echo ''; } @@ -105,7 +105,7 @@ class BunnyTags_Import { echo '
    '; wp_nonce_field('import-btt'); - echo '

    '; + echo '

    '; echo '
    '; echo ''; } diff --git a/wp-admin/import/dotclear.php b/wp-admin/import/dotclear.php index 5d52fd6c6..611e88733 100644 --- a/wp-admin/import/dotclear.php +++ b/wp-admin/import/dotclear.php @@ -215,7 +215,7 @@ class Dotclear_Import { echo '
    '; wp_nonce_field('import-dotclear'); $this->db_form(); - echo '

    '; + echo '

    '; echo '
    '; } @@ -632,7 +632,7 @@ class Dotclear_Import { echo '
    '; wp_nonce_field('import-dotclear'); - printf('

    ', _a('Import Users')); + printf('

    ', esc_attr__('Import Users')); echo '
    '; } @@ -645,7 +645,7 @@ class Dotclear_Import { echo '
    '; wp_nonce_field('import-dotclear'); - printf('

    ', _a('Import Posts')); + printf('

    ', esc_attr__('Import Posts')); echo '
    '; } @@ -659,7 +659,7 @@ class Dotclear_Import { echo '
    '; wp_nonce_field('import-dotclear'); - printf('

    ', _a('Import Comments')); + printf('

    ', esc_attr__('Import Comments')); echo '
    '; } @@ -671,7 +671,7 @@ class Dotclear_Import { echo '
    '; wp_nonce_field('import-dotclear'); - printf('

    ', _a('Import Links')); + printf('

    ', esc_attr__('Import Links')); echo '
    '; } @@ -684,7 +684,7 @@ class Dotclear_Import { echo '
    '; wp_nonce_field('import-dotclear'); - printf('

    ', _a('Finish')); + printf('

    ', esc_attr__('Finish')); echo '
    '; } diff --git a/wp-admin/import/greymatter.php b/wp-admin/import/greymatter.php index f16ec4357..7e06f67ce 100644 --- a/wp-admin/import/greymatter.php +++ b/wp-admin/import/greymatter.php @@ -66,7 +66,7 @@ class GM_Import { so you need to enter the number of the last GM post here.
    (if you don’t know that number, just log into your FTP and look it out
    in the entries’ folder)') ?> -

    +

    footer(); diff --git a/wp-admin/import/jkw.php b/wp-admin/import/jkw.php index bf7e26993..d21d79a35 100644 --- a/wp-admin/import/jkw.php +++ b/wp-admin/import/jkw.php @@ -34,11 +34,11 @@ class JeromesKeyword_Import { echo '

    '.__('Don’t be stupid - backup your database before proceeding!').'

    '; echo '
    '; wp_nonce_field('import-jkw'); - echo '

    '; + echo '

    '; echo '
    '; echo '
    '; wp_nonce_field('import-jkw'); - echo '

    '; + echo '

    '; echo '
    '; echo ''; } @@ -120,7 +120,7 @@ class JeromesKeyword_Import { echo '
    '; wp_nonce_field('import-jkw'); - echo '

    '; + echo '

    '; echo '
    '; echo ''; } @@ -153,7 +153,7 @@ class JeromesKeyword_Import { } echo '
    '; wp_nonce_field('import-jkw'); - echo '

    '; + echo '

    '; echo '
    '; echo ''; } diff --git a/wp-admin/import/livejournal.php b/wp-admin/import/livejournal.php index 18a27bcc5..759d9129d 100644 --- a/wp-admin/import/livejournal.php +++ b/wp-admin/import/livejournal.php @@ -181,12 +181,12 @@ class LJ_API_Import {
    - +

    - +

    -

    +

    @@ -223,7 +223,7 @@ class LJ_API_Import {

    WARNING: This can take a really long time if you have a lot of entries in your LiveJournal, or a lot of comments. Ideally, you should only start this process if you can leave your computer alone while it finishes the import." ) ?>

    - +

    NOTE: If the import process is interrupted for any reason, come back to this page and it will continue from where it stopped automatically.' ) ?>

    @@ -724,7 +724,7 @@ class LJ_API_Import { if ( empty( $this->username ) || empty( $this->password ) ) { ?>

    and password so we can download your posts and comments.' ) ?>

    -

    +

    -

    +

    -

    +

    auto_ajax( 'ljapi-auto-repost', 'auto-message', 0 ); ?> approximately %d' ), get_option( 'ljapi_comment_batch' ), $batch ) ?>

    -

    +

    auto_ajax( 'ljapi-auto-repost', 'auto-message', 0 ); ?> '; $str .= wp_nonce_field( 'lj-api-import', '_wpnonce', true, false ); $str .= wp_referer_field( false ); - $str .= ''; - $str .= '

    '; + $str .= ''; + $str .= '

    '; $str .= ''; return $str; diff --git a/wp-admin/import/mt.php b/wp-admin/import/mt.php index fc10b63d8..7b7502040 100644 --- a/wp-admin/import/mt.php +++ b/wp-admin/import/mt.php @@ -39,14 +39,14 @@ class MT_Import {

    mt-export.txt in your /wp-content/ directory and then click "Import mt-export.txt"'); ?>

    -
    +

    mt-export.txt in your /wp-content/ directory'); ?>

    - +

    out of memory error try splitting up the import file into pieces.'); ?>

    @@ -207,12 +207,12 @@ class MT_Import { $j = -1; foreach ($authors as $author) { ++ $j; - echo '
    • '; } - echo '

    '.'
    '; + echo '

    '.'
    '; echo ''; echo ''; diff --git a/wp-admin/import/opml.php b/wp-admin/import/opml.php index dc21793b8..6f7610a00 100644 --- a/wp-admin/import/opml.php +++ b/wp-admin/import/opml.php @@ -64,7 +64,7 @@ foreach ($categories as $category) { ?>

    -

    +

    diff --git a/wp-admin/import/stp.php b/wp-admin/import/stp.php index 3c007ebd6..4568428c9 100644 --- a/wp-admin/import/stp.php +++ b/wp-admin/import/stp.php @@ -33,7 +33,7 @@ class STP_Import { echo '

    '.__('Don’t be stupid - backup your database before proceeding!').'

    '; echo '
    '; wp_nonce_field('import-stp'); - echo '

    '; + echo '

    '; echo '
    '; echo ''; } @@ -93,7 +93,7 @@ class STP_Import { echo '
    '; wp_nonce_field('import-stp'); - echo '

    '; + echo '

    '; echo '
    '; echo ''; } @@ -109,7 +109,7 @@ class STP_Import { echo '

    ' . sprintf( _n('Done! %s tag was added!', 'Done! %s tags were added!', $tags_added), $tags_added ) . '

    '; echo '
    '; wp_nonce_field('import-stp'); - echo '

    '; + echo '

    '; echo '
    '; echo ''; } diff --git a/wp-admin/import/textpattern.php b/wp-admin/import/textpattern.php index d9c9766d2..2cbf36e0e 100644 --- a/wp-admin/import/textpattern.php +++ b/wp-admin/import/textpattern.php @@ -70,7 +70,7 @@ class Textpattern_Import { echo '
    '; wp_nonce_field('import-textpattern'); $this->db_form(); - echo '

    '; + echo '

    '; echo '
    '; echo ''; } @@ -505,7 +505,7 @@ class Textpattern_Import { echo '
    '; wp_nonce_field('import-textpattern'); - printf('

    ', _a('Import Users')); + printf('

    ', esc_attr__('Import Users')); echo '
    '; } @@ -518,7 +518,7 @@ class Textpattern_Import { echo '
    '; wp_nonce_field('import-textpattern'); - printf('

    ', _a('Import Posts')); + printf('

    ', esc_attr__('Import Posts')); echo '
    '; } @@ -532,7 +532,7 @@ class Textpattern_Import { echo '
    '; wp_nonce_field('import-textpattern'); - printf('

    ', _a('Import Comments')); + printf('

    ', esc_attr__('Import Comments')); echo '
    '; } @@ -544,7 +544,7 @@ class Textpattern_Import { echo '
    '; wp_nonce_field('import-textpattern'); - printf('

    ', _a('Import Links')); + printf('

    ', esc_attr__('Import Links')); echo '
    '; } @@ -557,7 +557,7 @@ class Textpattern_Import { echo '
    '; wp_nonce_field('import-textpattern'); - printf('

    ', _a('Finish')); + printf('

    ', esc_attr__('Finish')); echo '
    '; } diff --git a/wp-admin/import/utw.php b/wp-admin/import/utw.php index fa2aaa835..3add5b636 100644 --- a/wp-admin/import/utw.php +++ b/wp-admin/import/utw.php @@ -33,7 +33,7 @@ class UTW_Import { echo '

    '.__('To accommodate larger databases for those tag-crazy authors out there, we have made this into an easy 5-step program to help you kick that nasty UTW habit. Just keep clicking along and we will let you know when you are in the clear!').'

    '; echo '

    '.__('Don’t be stupid - backup your database before proceeding!').'

    '; echo '
    '; - echo '

    '; + echo '

    '; echo '
    '; echo ''; } @@ -120,7 +120,7 @@ class UTW_Import { echo '
    '; wp_nonce_field('import-utw'); - echo '

    '; + echo '

    '; echo '
    '; echo ''; } @@ -156,7 +156,7 @@ class UTW_Import { echo '
    '; wp_nonce_field('import-utw'); - echo '

    '; + echo '

    '; echo '
    '; echo ''; @@ -175,7 +175,7 @@ class UTW_Import { echo '
    '; wp_nonce_field('import-utw'); - echo '

    '; + echo '

    '; echo '
    '; echo ''; diff --git a/wp-admin/import/wordpress.php b/wp-admin/import/wordpress.php index 049d5a57f..28e85d047 100644 --- a/wp-admin/import/wordpress.php +++ b/wp-admin/import/wordpress.php @@ -233,7 +233,7 @@ class WP_Import { } echo '

    '; - echo ''.'
    '; + echo ''.'
    '; echo '

    '; echo ''; @@ -242,14 +242,14 @@ class WP_Import { function users_form($n, $author) { if ( $this->allow_create_users() ) { - printf('
    '); + printf('
    '); } else { echo __('Map to existing').'
    '; } // keep track of $n => $author name - echo ''; + echo ''; $users = get_users_of_blog(); ?> +

    \n"; } @@ -104,7 +104,7 @@ function get_image_send_to_editor($id, $alt, $title, $align, $url='', $rel = fal $html = get_image_tag($id, $htmlalt, $title, $align, $size); - $rel = $rel ? ' rel="attachment wp-att-'.attr($id).'"' : ''; + $rel = $rel ? ' rel="attachment wp-att-' . esc_attr($id).'"' : ''; if ( $url ) $html = '$html"; @@ -428,7 +428,7 @@ function media_upload_form_handler() { $html = $attachment['post_title']; if ( !empty($attachment['url']) ) { if ( strpos($attachment['url'], 'attachment_id') || false !== strpos($attachment['url'], get_permalink($_POST['post_id'])) ) - $rel = " rel='attachment wp-att-".attr($send_id)."'"; + $rel = " rel='attachment wp-att-" . esc_attr($send_id)."'"; $html = "$html"; } $html = apply_filters('media_send_to_editor', $html, $send_id, $attachment); @@ -463,9 +463,9 @@ function media_upload_image() { $src = $_POST['insertonly']['src']; if ( !empty($src) && !strpos($src, '://') ) $src = "http://$src"; - $alt = attr($_POST['insertonly']['alt']); + $alt = esc_attr($_POST['insertonly']['alt']); if ( isset($_POST['insertonly']['align']) ) { - $align = attr($_POST['insertonly']['align']); + $align = esc_attr($_POST['insertonly']['align']); $class = " class='align$align'"; } if ( !empty($src) ) @@ -557,7 +557,7 @@ function media_upload_audio() { $href = $_POST['insertonly']['href']; if ( !empty($href) && !strpos($href, '://') ) $href = "http://$href"; - $title = attr($_POST['insertonly']['title']); + $title = esc_attr($_POST['insertonly']['title']); if ( empty($title) ) $title = basename($href); if ( !empty($title) && !empty($href) ) @@ -611,7 +611,7 @@ function media_upload_video() { $href = $_POST['insertonly']['href']; if ( !empty($href) && !strpos($href, '://') ) $href = "http://$href"; - $title = attr($_POST['insertonly']['title']); + $title = esc_attr($_POST['insertonly']['title']); if ( empty($title) ) $title = basename($href); if ( !empty($title) && !empty($href) ) @@ -665,7 +665,7 @@ function media_upload_file() { $href = $_POST['insertonly']['href']; if ( !empty($href) && !strpos($href, '://') ) $href = "http://$href"; - $title = attr($_POST['insertonly']['title']); + $title = esc_attr($_POST['insertonly']['title']); if ( empty($title) ) $title = basename($href); if ( !empty($title) && !empty($href) ) @@ -755,7 +755,7 @@ function image_align_input_fields($post, $checked='') { $out = array(); foreach ($alignments as $name => $label) { - $name = attr($name); + $name = esc_attr($name); $out[] = ""; @@ -829,10 +829,10 @@ function image_link_input_fields($post, $url_type='') { elseif ( $url_type == 'post' ) $url = $link; - return "
    + return "
    - - + + "; } @@ -992,7 +992,7 @@ function get_attachment_fields_to_edit($post, $errors = null) { 'image_url' => array( 'label' => __('File URL'), 'input' => 'html', - 'html' => "
    ", + 'html' => "
    ", 'value' => isset($edit_post->post_url) ? $edit_post->post_url : '', 'helps' => __('Location of the uploaded file.'), ) @@ -1089,19 +1089,19 @@ function get_media_item( $attachment_id, $args = null ) { $post = get_post($attachment_id); $filename = basename($post->guid); - $title = attr($post->post_title); + $title = esc_attr($post->post_title); if ( $_tags = get_the_tags($attachment_id) ) { foreach ( $_tags as $tag ) $tags[] = $tag->name; - $tags = attr(join(', ', $tags)); + $tags = esc_attr(join(', ', $tags)); } $type = ''; if ( isset($post_mime_types) ) { $keys = array_keys(wp_match_mime_types(array_keys($post_mime_types), $post->post_mime_type)); $type = array_shift($keys); - $type = ""; + $type = ""; } $form_fields = get_attachment_fields_to_edit($post, $errors); @@ -1160,7 +1160,7 @@ function get_media_item( $attachment_id, $args = null ) { $delete_href = wp_nonce_url("post.php?action=delete-post&post=$attachment_id", 'delete-post_' . $attachment_id); if ( $send ) - $send = ""; + $send = ""; if ( $delete ) $delete = "" . __('Delete') . ""; if ( ( $send || $delete ) && !isset($form_fields['buttons']) ) @@ -1198,7 +1198,7 @@ function get_media_item( $attachment_id, $args = null ) { elseif ( $field['input'] == 'textarea' ) { $item .= ""; } else { - $item .= ""; + $item .= ""; } if ( !empty($field['helps']) ) $item .= "

    " . join( "

    \n

    ", array_unique((array) $field['helps']) ) . '

    '; @@ -1226,7 +1226,7 @@ function get_media_item( $attachment_id, $args = null ) { $item .= "\t\n"; foreach ( $hidden_fields as $name => $value ) - $item .= "\t\n"; + $item .= "\t\n"; if ( $post->post_parent < 1 && isset($_REQUEST['post_id']) ) { $parent = (int) $_REQUEST['post_id']; @@ -1307,7 +1307,7 @@ SWFUpload.onload = function() { button_width: "132", button_image_url: '', button_placeholder_id: "flash-browse-button", - upload_url : "", + upload_url : "", flash_url : "", file_post_name: "async-upload", file_types: "", @@ -1355,7 +1355,7 @@ SWFUpload.onload = function() {

    - +

    @@ -1385,7 +1385,7 @@ function media_upload_type_form($type = 'file', $errors = null, $id = null) { $form_action_url = apply_filters('media_upload_form_url', $form_action_url, $type); ?> -
    + @@ -1417,7 +1417,7 @@ if ( $id ) { } ?> - + - + @@ -1575,7 +1575,7 @@ jQuery(function($){ | - + @@ -1590,10 +1590,10 @@ jQuery(function($){

    - + - - + +

    - - + +

    @@ -1704,15 +1704,15 @@ function media_upload_library_form($errors) { ?>
    - - + + - +
    \n"; @@ -507,7 +507,7 @@ function install_plugin_information() {

    -
    +
    <?php _e('5 stars') ?>
    <?php _e('4 stars') ?>
    <?php _e('3 stars') ?>
    @@ -532,7 +532,7 @@ function install_plugin_information() { $content = links_add_base_url($content, 'http://wordpress.org/extend/plugins/' . $api->slug . '/'); $content = links_add_target($content, '_blank'); - $san_title = attr(sanitize_title_with_dashes($title)); + $san_title = esc_attr(sanitize_title_with_dashes($title)); $display = ( $section_name == $section ) ? 'block' : 'none'; diff --git a/wp-admin/includes/plugin.php b/wp-admin/includes/plugin.php index 0813fc0a7..caf863b06 100644 --- a/wp-admin/includes/plugin.php +++ b/wp-admin/includes/plugin.php @@ -1116,7 +1116,7 @@ function remove_option_whitelist( $del_options, $options = '' ) { * @param string $option_group A settings group name. This should match the group name used in register_setting(). */ function settings_fields($option_group) { - echo ""; + echo ""; echo ''; wp_nonce_field("$option_group-options"); } diff --git a/wp-admin/includes/taxonomy.php b/wp-admin/includes/taxonomy.php index ebb49509b..5f104d630 100644 --- a/wp-admin/includes/taxonomy.php +++ b/wp-admin/includes/taxonomy.php @@ -222,7 +222,7 @@ function get_terms_to_edit( $post_id, $taxonomy = 'post_tag' ) { foreach ( $tags as $tag ) $tag_names[] = $tag->name; $tags_to_edit = join( ',', $tag_names ); - $tags_to_edit = attr( $tags_to_edit ); + $tags_to_edit = esc_attr( $tags_to_edit ); $tags_to_edit = apply_filters( 'terms_to_edit', $tags_to_edit, $taxonomy ); return $tags_to_edit; diff --git a/wp-admin/includes/template.php b/wp-admin/includes/template.php index dfccb6e66..ad57cbcc1 100644 --- a/wp-admin/includes/template.php +++ b/wp-admin/includes/template.php @@ -125,7 +125,7 @@ function _cat_row( $category, $level, $name_override = false ) { $name = ( $name_override ? $name_override : $pad . ' ' . $category->name ); $edit_link = "categories.php?action=edit&cat_ID=$category->term_id"; if ( current_user_can( 'manage_categories' ) ) { - $edit = "name)) . "'>" . attr( $name ) . '
    '; + $edit = "name)) . "'>" . esc_attr( $name ) . '
    '; $actions = array(); $actions['edit'] = '' . __('Edit') . ''; $actions['inline hide-if-no-js'] = '' . __('Quick Edit') . ''; @@ -264,7 +264,7 @@ function inline_edit_term_row($type) {

    - + @@ -296,7 +296,7 @@ function link_cat_row( $category, $name_override = false ) { $name = ( $name_override ? $name_override : $category->name ); $edit_link = "link-category.php?action=edit&cat_ID=$category->term_id"; if ( current_user_can( 'manage_categories' ) ) { - $edit = "name)) . "'>$name
    "; + $edit = "name)) . "'>$name
    "; $actions = array(); $actions['edit'] = '' . __('Edit') . ''; $actions['inline hide-if-no-js'] = '' . __('Quick Edit') . ''; @@ -658,7 +658,7 @@ function _tag_row( $tag, $class = '', $taxonomy = 'post_tag' ) { $out .= ' '; break; case 'name': - $out .= '' . $name . '
    '; + $out .= '' . $name . '
    '; $actions = array(); $actions['edit'] = '' . __('Edit') . ''; $actions['inline hide-if-no-js'] = '' . __('Quick Edit') . ''; @@ -1257,12 +1257,12 @@ function inline_edit_row( $type ) { wp_nonce_field( 'inlineeditnonce', '_inline_edit', false ); $update_text = ( $is_page ) ? __( 'Update Page' ) : __( 'Update Post' ); ?> - + - +
    @@ -1288,7 +1288,7 @@ function get_inline_data($post) { if ( ! current_user_can('edit_' . $post->post_type, $post->ID) ) return; - $title = attr($post->post_title); + $title = esc_attr($post->post_title); echo '

    diff --git a/wp-admin/plugin-editor.php b/wp-admin/plugin-editor.php index 2b45c518b..64959e34c 100644 --- a/wp-admin/plugin-editor.php +++ b/wp-admin/plugin-editor.php @@ -116,7 +116,7 @@ default: $docs_select = ''; } @@ -132,7 +132,7 @@ default:

    fatal error.') ?>

    - +
    @@ -150,13 +150,13 @@ default: $selected = " selected='selected'"; else $selected = ''; - $plugin_name = attr($plugin_name); - $plugin_key = attr($plugin_key); + $plugin_name = esc_attr($plugin_name); + $plugin_key = esc_attr($plugin_key); echo "\n\t"; } ?> - +
    @@ -204,11 +204,11 @@ foreach ( $plugin_files as $plugin_file ) :
    - - + +
    -
    +
    @@ -217,9 +217,9 @@ foreach ( $plugin_files as $plugin_file ) :

    "; + echo ""; else - echo ""; + echo ""; ?>

    diff --git a/wp-admin/plugins.php b/wp-admin/plugins.php index c31019c93..52c6ed89f 100644 --- a/wp-admin/plugins.php +++ b/wp-admin/plugins.php @@ -139,13 +139,13 @@ if ( !empty($action) ) { '; + echo ''; ?> - +
    - +

    @@ -194,7 +194,7 @@ if ( !empty($invalid) )

    fatal error.') ?>

    - + @@ -369,7 +369,7 @@ function print_plugins_table($plugins, $context = '') { $class = $is_active ? 'active' : 'inactive'; echo " - + {$plugin_data['Title']}"; $i = 0; echo '
    '; @@ -413,9 +413,9 @@ function print_plugin_actions($context) { - + - +
    - +

    - - + +
      - +
      -

      - <?php echo attr(__('Click to insert.')); ?>

      +

      + <?php echo esc_attr(__('Click to insert.')); ?>

      @@ -168,7 +168,7 @@ switch ($_REQUEST['ajax']) {

      - +
      @@ -377,17 +377,17 @@ var ajaxurl = ''; jQuery('#extra_fields').show(); switch(tab_name) { case 'video' : - jQuery('#extra_fields').load('', { ajax: 'video', s: ''}, function() { + jQuery('#extra_fields').load('', { ajax: 'video', s: ''}, function() { '; } elseif ( preg_match("/vimeo\.com\/[0-9]+/i", $url) ) { list($domain, $video_id) = split(".com/", $url); - $video_id = attr($video_id); + $video_id = esc_attr($video_id); $content = ' '; if ( trim($selection) == '' ) @@ -457,11 +457,11 @@ var ajaxurl = '';

      - + - + -

      +

      @@ -481,9 +481,9 @@ var ajaxurl = '';

      - + 0, 'name' => 'newcat_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => __('Parent category'), 'tab_index' => 3 ) ); ?> - +

      @@ -499,8 +499,8 @@ var ajaxurl = '';

      @@ -518,7 +518,7 @@ var ajaxurl = '';
      - +
      diff --git a/wp-admin/sidebar.php b/wp-admin/sidebar.php index ea9c4ea0f..62a375d40 100644 --- a/wp-admin/sidebar.php +++ b/wp-admin/sidebar.php @@ -88,10 +88,10 @@ form {
      - + - - + +

      - + - +

      diff --git a/wp-admin/theme-editor.php b/wp-admin/theme-editor.php index 722ff83a6..f2524e58f 100644 --- a/wp-admin/theme-editor.php +++ b/wp-admin/theme-editor.php @@ -94,9 +94,9 @@ default: $functions = wp_doc_link_parse( $content ); $docs_select = ''; } @@ -125,12 +125,12 @@ $desc_header = ( $description != $file_show ) ? "$description ( $theme_name = $a_theme['Name']; if ($theme_name == $theme) $selected = " selected='selected'"; else $selected = ''; - $theme_name = attr($theme_name); + $theme_name = esc_attr($theme_name); echo "\n\t"; } ?> - +
      @@ -199,14 +199,14 @@ if ($allowed_files) :
      - - + +
      - +
      @@ -214,7 +214,7 @@ if ($allowed_files) :

      "; + echo ""; ?>

      diff --git a/wp-admin/themes.php b/wp-admin/themes.php index 01b571482..4e7b77914 100644 --- a/wp-admin/themes.php +++ b/wp-admin/themes.php @@ -188,14 +188,14 @@ foreach ( $cols as $col => $theme_name ) { $parent_theme = $themes[$theme_name]['Parent Theme']; $preview_link = clean_url( get_option('home') . '/'); $preview_link = htmlspecialchars( add_query_arg( array('preview' => 1, 'template' => $template, 'stylesheet' => $stylesheet, 'TB_iframe' => 'true' ), $preview_link ) ); - $preview_text = attr( sprintf( __('Preview of “%s”'), $title ) ); + $preview_text = esc_attr( sprintf( __('Preview of “%s”'), $title ) ); $tags = $themes[$theme_name]['Tags']; $thickbox_class = 'thickbox thickbox-preview'; $activate_link = wp_nonce_url("themes.php?action=activate&template=".urlencode($template)."&stylesheet=".urlencode($stylesheet), 'switch-theme_' . $template); - $activate_text = attr( sprintf( __('Activate “%s”'), $title ) ); + $activate_text = esc_attr( sprintf( __('Activate “%s”'), $title ) ); $actions = array(); $actions[] = '' . __('Activate') . ''; - $actions[] = '' . __('Preview') . ''; + $actions[] = '' . __('Preview') . ''; if ( current_user_can('update_themes') ) $actions[] = '' . __('Delete') . ''; $actions = apply_filters('theme_action_links', $actions, $themes[$theme_name]); diff --git a/wp-admin/tools.php b/wp-admin/tools.php index d51d75eef..dddc2db0a 100644 --- a/wp-admin/tools.php +++ b/wp-admin/tools.php @@ -84,7 +84,7 @@ if ( ! $is_opera ) {

      -

      +

      diff --git a/wp-admin/update-core.php b/wp-admin/update-core.php index 09a85621a..2da47ecab 100644 --- a/wp-admin/update-core.php +++ b/wp-admin/update-core.php @@ -40,15 +40,15 @@ function list_core_update( $update ) { echo '
      '; wp_nonce_field('upgrade-core'); echo '

      '; - echo ' '; - echo ''; - echo ''; + echo ' '; + echo ''; + echo ''; echo '' . $download . ' '; if ( 'en_US' != $update->locale ) if ( !isset( $update->dismissed ) || !$update->dismissed ) - echo ''; + echo ''; else - echo ''; + echo ''; echo '

      '; echo '
      '; diff --git a/wp-admin/upload.php b/wp-admin/upload.php index a9d52af3e..c985eae4b 100644 --- a/wp-admin/upload.php +++ b/wp-admin/upload.php @@ -211,7 +211,7 @@ unset($type_links);

      - +

      @@ -247,7 +247,7 @@ if ( $page_links ) : ?> - + yyear$arc_row->mmonth") . "'>"; + echo ""; echo $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear"; echo "\n"; } @@ -280,12 +280,12 @@ foreach ($arc_result as $arc_row) { - + - +
    @@ -325,14 +325,14 @@ foreach ($arc_result as $arc_row) { $att_title = wp_specialchars( _draft_or_post_title($post->ID) ); ?> - + ID, array(80, 60), true ) ) { ?> - + -
    +
    ID))); ?>
    @@ -342,7 +342,7 @@ foreach ($arc_result as $arc_row) { $actions['edit'] = '' . __('Edit') . ''; if ( current_user_can('delete_post', $post->ID) ) $actions['delete'] = "ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $post->post_status) ? __("You are about to delete this attachment '%s'\n 'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this attachment '%s'\n 'Cancel' to stop, 'OK' to delete."), $post->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . ""; - $actions['view'] = '' . __('View') . ''; + $actions['view'] = '' . __('View') . ''; if ( current_user_can('edit_post', $post->ID) ) $actions['attach'] = ''.__('Attach').''; $actions = apply_filters( 'media_row_actions', $actions, $post ); @@ -403,7 +403,7 @@ if ( $page_links ) - +

    diff --git a/wp-admin/user-edit.php b/wp-admin/user-edit.php index 43e052b69..710f191bb 100644 --- a/wp-admin/user-edit.php +++ b/wp-admin/user-edit.php @@ -215,7 +215,7 @@ $current_color = get_user_option('admin_color', $user_id); if ( empty($current_color) ) $current_color = 'fresh'; foreach ( $_wp_admin_css_colors as $color => $color_info ): ?> -
    /> +
    /> colors as $html_color ): ?> @@ -248,7 +248,7 @@ do_action('personal_options', $profileuser);
    - + @@ -274,17 +274,17 @@ else - + - + - + @@ -303,7 +303,7 @@ else $public_display = array_map( 'trim', $public_display ); foreach ( $public_display as $id => $item ) { ?> - + @@ -317,27 +317,27 @@ else
    - + - + - + - + - +
    @@ -395,8 +395,8 @@ if ( $show_password_fields ) :

    - - + +

    diff --git a/wp-admin/user-new.php b/wp-admin/user-new.php index c2b1e6317..8eb940e35 100644 --- a/wp-admin/user-new.php +++ b/wp-admin/user-new.php @@ -91,23 +91,23 @@ foreach ( array('user_login' => 'login', 'first_name' => 'firstname', 'last_name - + - + - + - + - + @@ -132,7 +132,7 @@ foreach ( array('user_login' => 'login', 'first_name' => 'firstname', 'last_name

    - +

    diff --git a/wp-admin/users.php b/wp-admin/users.php index d83fe9a67..1cbd6dd4a 100644 --- a/wp-admin/users.php +++ b/wp-admin/users.php @@ -28,10 +28,10 @@ if ( empty($doaction) ) { } if ( empty($_REQUEST) ) { - $referer = ''; + $referer = ''; } elseif ( isset($_REQUEST['wp_http_referer']) ) { $redirect = remove_query_arg(array('wp_http_referer', 'updated', 'delete_count'), stripslashes($_REQUEST['wp_http_referer'])); - $referer = ''; + $referer = ''; } else { $redirect = 'users.php'; $referer = ''; @@ -149,7 +149,7 @@ case 'delete': if ( $id == $current_user->ID ) { echo "
  • " . sprintf(__('ID #%1s: %2s The current user will not be deleted.'), $id, $user->user_login) . "
    • \n"; } else { - echo "
  • " . sprintf(__('ID #%1s: %2s'), $id, $user->user_login) . "
    • \n"; + echo "
  • " . sprintf(__('ID #%1s: %2s'), $id, $user->user_login) . "
    • \n"; $go_delete = true; } } @@ -157,7 +157,7 @@ case 'delete': $user_dropdown = ''; ?> @@ -170,7 +170,7 @@ case 'delete': '.__('Attribute all posts and links to:')." $user_dropdown"; ?> -

    +

    @@ -291,8 +291,8 @@ unset($role_links);

    - - + +

    @@ -308,9 +308,9 @@ unset($role_links); - + - +
    @@ -374,7 +374,7 @@ foreach ( $wp_user_search->get_results() as $userid ) { - +

    @@ -388,7 +388,7 @@ foreach ( $wp_user_search->get_results() as $userid ) { 'user_login', 'first_name' => 'user_firstname', 'last_name' => 'user_lastname', 'email' => 'user_email', 'url' => 'user_uri', 'role' => 'user_role') as $formpost => $var ) { $var = 'new_' . $var; - $$var = isset($_REQUEST[$formpost]) ? attr(stripslashes($_REQUEST[$formpost])) : ''; + $$var = isset($_REQUEST[$formpost]) ? esc_attr(stripslashes($_REQUEST[$formpost])) : ''; } unset($name); ?> diff --git a/wp-admin/widgets.php b/wp-admin/widgets.php index 4166380da..56a9d6e60 100644 --- a/wp-admin/widgets.php +++ b/wp-admin/widgets.php @@ -271,7 +271,7 @@ if ( isset($_GET['editwidget']) && $_GET['editwidget'] ) {
    $sbvalue ) { - echo "\t\t
    "; + echo "\t\t
    "; if ( 'wp_inactive_widgets' == $sbname ) { echo ' '; } else { @@ -301,12 +301,12 @@ if ( isset($_GET['editwidget']) && $_GET['editwidget'] ) { - + - - - - + + + +
    diff --git a/wp-app.php b/wp-app.php index 650c751a2..eb36979d2 100644 --- a/wp-app.php +++ b/wp-app.php @@ -352,9 +352,9 @@ class AtomServer { if( !current_user_can( 'edit_posts' ) ) $this->auth_required( __( 'Sorry, you do not have the right to access this blog.' ) ); - $entries_url = attr($this->get_entries_url()); - $categories_url = attr($this->get_categories_url()); - $media_url = attr($this->get_attachments_url()); + $entries_url = esc_attr($this->get_entries_url()); + $categories_url = esc_attr($this->get_categories_url()); + $media_url = esc_attr($this->get_attachments_url()); foreach ($this->media_content_types as $med) { $accepted_media_types = $accepted_media_types . "" . $med . ""; } @@ -392,12 +392,12 @@ EOD; if( !current_user_can( 'edit_posts' ) ) $this->auth_required( __( 'Sorry, you do not have the right to access this blog.' ) ); - $home = attr(get_bloginfo_rss('home')); + $home = esc_attr(get_bloginfo_rss('home')); $categories = ""; $cats = get_categories("hierarchical=0&hide_empty=0"); foreach ((array) $cats as $cat) { - $categories .= " name) . "\" />\n"; + $categories .= " name) . "\" />\n"; } $output = << function redirect($url) { log_app('Status','302: Redirect'); - $escaped_url = attr($url); + $escaped_url = esc_attr($url); $content = << diff --git a/wp-content/themes/classic/comments-popup.php b/wp-content/themes/classic/comments-popup.php index 40ef005e3..68d5a9c22 100644 --- a/wp-content/themes/classic/comments-popup.php +++ b/wp-content/themes/classic/comments-popup.php @@ -64,20 +64,20 @@ if ( post_password_required($commentstatus) ) { // and it doesn't match the coo
    -

    '.$user_identity.''); ?>

    +

    '.$user_identity.''); ?>

    - +

    - +

    - +

    @@ -90,8 +90,8 @@ if ( post_password_required($commentstatus) ) { // and it doesn't match the coo

    - " /> - " /> + " /> + " />

    ID); ?>
    diff --git a/wp-content/themes/classic/comments.php b/wp-content/themes/classic/comments.php index 35b63268b..57d6cf3cc 100644 --- a/wp-content/themes/classic/comments.php +++ b/wp-content/themes/classic/comments.php @@ -53,13 +53,13 @@ if ( post_password_required() ) : ?> -

    +

    -

    +

    -

    +

    @@ -68,7 +68,7 @@ if ( post_password_required() ) : ?>

    -

    +

    ID); ?> diff --git a/wp-content/themes/classic/sidebar.php b/wp-content/themes/classic/sidebar.php index a44532731..ab7d7458f 100644 --- a/wp-content/themes/classic/sidebar.php +++ b/wp-content/themes/classic/sidebar.php @@ -18,7 +18,7 @@

    - +
    diff --git a/wp-content/themes/default/comments-popup.php b/wp-content/themes/default/comments-popup.php index 95e63cc18..49fe744a3 100644 --- a/wp-content/themes/default/comments-popup.php +++ b/wp-content/themes/default/comments-popup.php @@ -66,17 +66,17 @@ if ( post_password_required($post) ) { // and it doesn't match the cookie

    Logged in as . Log out »

    - +

    - +

    - +

    @@ -89,7 +89,7 @@ if ( post_password_required($post) ) { // and it doesn't match the cookie

    - " /> + " />

    ID); ?> diff --git a/wp-content/themes/default/comments.php b/wp-content/themes/default/comments.php index 49319a06b..7e81cdb35 100644 --- a/wp-content/themes/default/comments.php +++ b/wp-content/themes/default/comments.php @@ -68,13 +68,13 @@ -

    /> +

    />

    -

    /> +

    />

    -

    +

    diff --git a/wp-content/themes/default/functions.php b/wp-content/themes/default/functions.php index 498af4107..6be222d0e 100644 --- a/wp-content/themes/default/functions.php +++ b/wp-content/themes/default/functions.php @@ -166,7 +166,7 @@ function kubrick_theme_page_head() { kUpdate(ColorPicker_targetInput.id); } function PopupWindow_populate(contents) { - contents += '

    '; + contents += '

    '; this.contents = contents; this.populated = false; } @@ -380,43 +380,43 @@ function kubrick_theme_page() {
    -
    - red', '#FF0000', 'rgb(255, 0, 0)'); ?>
    - #FF0000', '#F00'); ?>
    - #FF0000', '#F00'); ?>
    - - - - +
    + red', '#FF0000', 'rgb(255, 0, 0)'); ?>
    + #FF0000', '#F00'); ?>
    + #FF0000', '#F00'); ?>
    + + + +
    -
    + - - - - - + + + + + - - - - - -

    + + + + + +

    diff --git a/wp-includes/author-template.php b/wp-includes/author-template.php index 99e170794..71a1dc570 100644 --- a/wp-includes/author-template.php +++ b/wp-includes/author-template.php @@ -181,7 +181,7 @@ function the_author_posts_link($deprecated = '') { printf( '%3$s', get_author_posts_url( $authordata->ID, $authordata->user_nicename ), - sprintf( __( 'Posts by %s' ), attr( get_the_author() ) ), + sprintf( __( 'Posts by %s' ), esc_attr( get_the_author() ) ), get_the_author() ); } @@ -292,7 +292,7 @@ function wp_list_authors($args = '') { if ( ! $hide_empty ) $link = $name; } else { - $link = 'display_name)) . '">' . $name . ''; + $link = 'display_name)) . '">' . $name . ''; if ( (! empty($feed_image)) || (! empty($feed)) ) { $link .= ' '; diff --git a/wp-includes/bookmark-template.php b/wp-includes/bookmark-template.php index fac3fb201..7ade2db13 100644 --- a/wp-includes/bookmark-template.php +++ b/wp-includes/bookmark-template.php @@ -72,8 +72,8 @@ function _walk_bookmarks($bookmarks, $args = '' ) { if ( !empty($bookmark->link_url) ) $the_link = clean_url($bookmark->link_url); - $desc = attr(sanitize_bookmark_field('link_description', $bookmark->link_description, $bookmark->link_id, 'display')); - $name = attr(sanitize_bookmark_field('link_name', $bookmark->link_name, $bookmark->link_id, 'display')); + $desc = esc_attr(sanitize_bookmark_field('link_description', $bookmark->link_description, $bookmark->link_id, 'display')); + $name = esc_attr(sanitize_bookmark_field('link_name', $bookmark->link_name, $bookmark->link_id, 'display')); $title = $desc; if ( $show_updated ) diff --git a/wp-includes/bookmark.php b/wp-includes/bookmark.php index e4d07c07c..90e0569d5 100644 --- a/wp-includes/bookmark.php +++ b/wp-includes/bookmark.php @@ -345,7 +345,7 @@ function sanitize_bookmark_field($field, $value, $bookmark_id, $context) { if ( in_array($field, $format_to_edit) ) { $value = format_to_edit($value); } else { - $value = attr($value); + $value = esc_attr($value); } } else if ( 'db' == $context ) { $value = apply_filters("pre_$field", $value); @@ -355,7 +355,7 @@ function sanitize_bookmark_field($field, $value, $bookmark_id, $context) { } if ( 'attribute' == $context ) - $value = attr($value); + $value = esc_attr($value); else if ( 'js' == $context ) $value = js_escape($value); diff --git a/wp-includes/category-template.php b/wp-includes/category-template.php index 0afcda973..69ec2ba78 100644 --- a/wp-includes/category-template.php +++ b/wp-includes/category-template.php @@ -662,7 +662,7 @@ function wp_generate_tag_cloud( $tags, $args = '' ) { $tag_link = '#' != $tag->link ? clean_url( $tag->link ) : '#'; $tag_id = isset($tags[ $key ]->id) ? $tags[ $key ]->id : $key; $tag_name = $tags[ $key ]->name; - $a[] = "$tag_name"; } diff --git a/wp-includes/class.wp-styles.php b/wp-includes/class.wp-styles.php index 67b732efa..d2bb22bda 100644 --- a/wp-includes/class.wp-styles.php +++ b/wp-includes/class.wp-styles.php @@ -48,13 +48,13 @@ class WP_Styles extends WP_Dependencies { } if ( isset($this->registered[$handle]->args) ) - $media = attr( $this->registered[$handle]->args ); + $media = esc_attr( $this->registered[$handle]->args ); else $media = 'all'; $href = $this->_css_href( $this->registered[$handle]->src, $ver, $handle ); $rel = isset($this->registered[$handle]->extra['alt']) && $this->registered[$handle]->extra['alt'] ? 'alternate stylesheet' : 'stylesheet'; - $title = isset($this->registered[$handle]->extra['title']) ? "title='" . attr( $this->registered[$handle]->extra['title'] ) . "'" : ''; + $title = isset($this->registered[$handle]->extra['title']) ? "title='" . esc_attr( $this->registered[$handle]->extra['title'] ) . "'" : ''; $end_cond = $tag = ''; if ( isset($this->registered[$handle]->extra['conditional']) && $this->registered[$handle]->extra['conditional'] ) { diff --git a/wp-includes/classes.php b/wp-includes/classes.php index 9f4214c63..7519fb498 100644 --- a/wp-includes/classes.php +++ b/wp-includes/classes.php @@ -1187,7 +1187,7 @@ class Walker_Page extends Walker { $css_class = implode(' ', apply_filters('page_css_class', $css_class, $page)); - $output .= $indent . '
  • ' . $link_before . apply_filters('the_title', $page->post_title) . $link_after . ''; + $output .= $indent . '
  • ' . $link_before . apply_filters('the_title', $page->post_title) . $link_after . ''; if ( !empty($show_date) ) { if ( 'modified' == $show_date ) @@ -1325,13 +1325,13 @@ class Walker_Category extends Walker { function start_el(&$output, $category, $depth, $args) { extract($args); - $cat_name = attr( $category->name); + $cat_name = esc_attr( $category->name); $cat_name = apply_filters( 'list_cats', $cat_name, $category ); $link = 'description) ) $link .= 'title="' . sprintf(__( 'View all posts filed under %s' ), $cat_name) . '"'; else - $link .= 'title="' . attr( apply_filters( 'category_description', $category->description, $category )) . '"'; + $link .= 'title="' . esc_attr( apply_filters( 'category_description', $category->description, $category )) . '"'; $link .= '>'; $link .= $cat_name . ''; diff --git a/wp-includes/comment-template.php b/wp-includes/comment-template.php index 141e87420..19258f085 100644 --- a/wp-includes/comment-template.php +++ b/wp-includes/comment-template.php @@ -945,7 +945,7 @@ function comments_popup_link( $zero = false, $one = false, $more = false, $css_c if ( !empty( $css_class ) ) { echo ' class="'.$css_class.'" '; } - $title = attr( get_the_title() ); + $title = esc_attr( get_the_title() ); echo apply_filters( 'comments_popup_link_attributes', '' ); diff --git a/wp-includes/comment.php b/wp-includes/comment.php index d61b0358f..91833fb57 100644 --- a/wp-includes/comment.php +++ b/wp-includes/comment.php @@ -371,14 +371,14 @@ function sanitize_comment_cookies() { if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) ) { $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]); $comment_author = stripslashes($comment_author); - $comment_author = attr($comment_author); + $comment_author = esc_attr($comment_author); $_COOKIE['comment_author_'.COOKIEHASH] = $comment_author; } if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) ) { $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]); $comment_author_email = stripslashes($comment_author_email); - $comment_author_email = attr($comment_author_email); + $comment_author_email = esc_attr($comment_author_email); $_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email; } diff --git a/wp-includes/default-widgets.php b/wp-includes/default-widgets.php index 767869acf..cc3c96578 100644 --- a/wp-includes/default-widgets.php +++ b/wp-includes/default-widgets.php @@ -61,8 +61,8 @@ class WP_Widget_Pages extends WP_Widget { function form( $instance ) { //Defaults $instance = wp_parse_args( (array) $instance, array( 'sortby' => 'post_title', 'title' => '', 'exclude' => '') ); - $title = attr( $instance['title'] ); - $exclude = attr( $instance['exclude'] ); + $title = esc_attr( $instance['title'] ); + $exclude = esc_attr( $instance['exclude'] ); ?>

    @@ -212,7 +212,7 @@ class WP_Widget_Archives extends WP_Widget { if ( $d ) { ?> - + @@ -241,7 +241,7 @@ class WP_Widget_Archives extends WP_Widget { $count = $instance['count'] ? 'checked="checked"' : ''; $dropdown = $instance['dropdown'] ? 'checked="checked"' : ''; ?> -

    +


    @@ -276,9 +276,9 @@ class WP_Widget_Meta extends WP_Widget {

    '' ) ); $title = strip_tags($instance['title']); ?> -

    +

    @@ -469,7 +469,7 @@ class WP_Widget_Categories extends WP_Widget { function form( $instance ) { //Defaults $instance = wp_parse_args( (array) $instance, array( 'title' => '') ); - $title = attr( $instance['title'] ); + $title = esc_attr( $instance['title'] ); $count = (bool) $instance['count']; $hierarchical = (bool) $instance['hierarchical']; $dropdown = (bool) $instance['dropdown']; @@ -572,7 +572,7 @@ class WP_Widget_Recent_Posts extends WP_Widget { } function form( $instance ) { - $title = attr($instance['title']); + $title = esc_attr($instance['title']); if ( !$number = (int) $instance['number'] ) $number = 5; ?> @@ -659,7 +659,7 @@ class WP_Widget_Recent_Comments extends WP_Widget { } function form( $instance ) { - $title = attr($instance['title']); + $title = esc_attr($instance['title']); if ( !$number = (int) $instance['number'] ) $number = 5; ?> @@ -708,7 +708,7 @@ class WP_Widget_RSS extends WP_Widget { $link = ''; if ( ! is_wp_error($rss) ) { - $desc = attr(strip_tags(@html_entity_decode($rss->get_description(), ENT_QUOTES, get_option('blog_charset')))); + $desc = esc_attr(strip_tags(@html_entity_decode($rss->get_description(), ENT_QUOTES, get_option('blog_charset')))); if ( empty($title) ) $title = htmlentities(strip_tags($rss->get_title())); $link = clean_url(strip_tags($rss->get_permalink())); @@ -723,7 +723,7 @@ class WP_Widget_RSS extends WP_Widget { $url = clean_url(strip_tags($url)); $icon = includes_url('images/rss.png'); if ( $title ) - $title = "RSS $title"; + $title = "RSS $title"; echo $before_widget; if ( $title ) @@ -795,11 +795,11 @@ function wp_widget_rss_output( $rss, $args = array() ) { while ( stristr($link, 'http') != $link ) $link = substr($link, 1); $link = clean_url(strip_tags($link)); - $title = attr(strip_tags($item->get_title())); + $title = esc_attr(strip_tags($item->get_title())); if ( empty($title) ) $title = __('Untitled'); - $desc = str_replace(array("\n", "\r"), ' ', attr(strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset'))))); + $desc = str_replace(array("\n", "\r"), ' ', esc_attr(strip_tags(@html_entity_decode($item->get_description(), ENT_QUOTES, get_option('blog_charset'))))); $desc = wp_html_excerpt( $desc, 360 ) . ' […]'; $desc = wp_specialchars( $desc ); @@ -858,8 +858,8 @@ function wp_widget_rss_form( $args, $inputs = null ) { extract( $args ); extract( $inputs, EXTR_SKIP); - $number = attr( $number ); - $title = attr( $title ); + $number = esc_attr( $number ); + $title = esc_attr( $title ); $url = clean_url( $url ); $items = (int) $items; if ( $items < 1 || 20 < $items ) @@ -995,7 +995,7 @@ class WP_Widget_Tag_Cloud extends WP_Widget { ?>

    ', $between = ' if ( '' != $rel ) $rel = ' rel="' . $rel . '"'; - $desc = attr(sanitize_bookmark_field('link_description', $row->link_description, $row->link_id, 'display')); - $name = attr(sanitize_bookmark_field('link_name', $row->link_name, $row->link_id, 'display')); + $desc = esc_attr(sanitize_bookmark_field('link_description', $row->link_description, $row->link_id, 'display')); + $name = esc_attr(sanitize_bookmark_field('link_name', $row->link_name, $row->link_id, 'display')); $title = $desc; if ( $show_updated ) diff --git a/wp-includes/feed-atom-comments.php b/wp-includes/feed-atom-comments.php index 1ce1eb114..a6f629ef8 100644 --- a/wp-includes/feed-atom-comments.php +++ b/wp-includes/feed-atom-comments.php @@ -18,7 +18,7 @@ echo '' if ( is_singular() ) printf(ent2ncr(__('Comments on: %s')), get_the_title_rss()); elseif ( is_search() ) - printf(ent2ncr(__('Comments for %1$s searching on %2$s')), get_bloginfo_rss( 'name' ), attr(get_search_query())); + printf(ent2ncr(__('Comments for %1$s searching on %2$s')), get_bloginfo_rss( 'name' ), esc_attr(get_search_query())); else printf(ent2ncr(__('Comments for %s')), get_bloginfo_rss( 'name' ) . get_wp_title_rss()); ?> @@ -32,7 +32,7 @@ echo '' - + diff --git a/wp-includes/feed-rss2-comments.php b/wp-includes/feed-rss2-comments.php index 8e5fe8cac..09e52410e 100644 --- a/wp-includes/feed-rss2-comments.php +++ b/wp-includes/feed-rss2-comments.php @@ -20,7 +20,7 @@ echo ''; if ( is_singular() ) printf(ent2ncr(__('Comments on: %s')), get_the_title_rss()); elseif ( is_search() ) - printf(ent2ncr(__('Comments for %s searching on %s')), get_bloginfo_rss( 'name' ), attr($wp_query->query_vars['s'])); + printf(ent2ncr(__('Comments for %s searching on %s')), get_bloginfo_rss( 'name' ), esc_attr($wp_query->query_vars['s'])); else printf(ent2ncr(__('Comments for %s')), get_bloginfo_rss( 'name' ) . get_wp_title_rss()); ?> diff --git a/wp-includes/feed.php b/wp-includes/feed.php index 44efe2d3f..274494740 100644 --- a/wp-includes/feed.php +++ b/wp-includes/feed.php @@ -338,7 +338,7 @@ function get_the_category_rss($type = 'rss') { if ( 'rdf' == $type ) $the_list .= "\t\t\n"; elseif ( 'atom' == $type ) - $the_list .= sprintf( '', attr( apply_filters( 'get_bloginfo_rss', get_bloginfo( 'url' ) ) ), attr( $cat_name ) ); + $the_list .= sprintf( '', esc_attr( apply_filters( 'get_bloginfo_rss', get_bloginfo( 'url' ) ) ), esc_attr( $cat_name ) ); else $the_list .= "\t\t\n"; } diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php index b2e7f2d6f..3207ba050 100644 --- a/wp-includes/formatting.php +++ b/wp-includes/formatting.php @@ -1270,7 +1270,7 @@ function translate_smiley($smiley) { $smiley = trim(reset($smiley)); $img = $wpsmiliestrans[$smiley]; - $smiley_masked = attr($smiley); + $smiley_masked = esc_attr($smiley); return " $smiley_masked "; } @@ -2078,7 +2078,7 @@ function js_escape($text) { * @param string $text * @return string */ -function attr( $text ) { +function esc_attr( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $safe_text = wp_specialchars( $safe_text, ENT_QUOTES ); return apply_filters( 'attribute_escape', $safe_text, $text ); @@ -2090,13 +2090,13 @@ function attr( $text ) { * @since 2.0.6 * * @deprecated 2.8.0 - * @see attr() + * @see esc_attr() * * @param string $text * @return string */ function attribute_escape( $text ) { - return attr( $text ); + return esc_attr( $text ); } /** diff --git a/wp-includes/functions.php b/wp-includes/functions.php index a38ac4f8d..8498b1516 100644 --- a/wp-includes/functions.php +++ b/wp-includes/functions.php @@ -393,7 +393,7 @@ function wp_protect_special_option( $option ) { * @param string $option Option name. */ function form_option( $option ) { - echo attr (get_option( $option ) ); + echo esc_attr(get_option( $option ) ); } /** @@ -1743,7 +1743,7 @@ function wp_nonce_url( $actionurl, $action = -1 ) { * @return string Nonce field. */ function wp_nonce_field( $action = -1, $name = "_wpnonce", $referer = true , $echo = true ) { - $name = attr( $name ); + $name = esc_attr( $name ); $nonce_field = ''; if ( $echo ) echo $nonce_field; @@ -1768,7 +1768,7 @@ function wp_nonce_field( $action = -1, $name = "_wpnonce", $referer = true , $ec * @return string Referer field. */ function wp_referer_field( $echo = true) { - $ref = attr( $_SERVER['REQUEST_URI'] ); + $ref = esc_attr( $_SERVER['REQUEST_URI'] ); $referer_field = ''; if ( $echo ) @@ -1794,7 +1794,7 @@ function wp_referer_field( $echo = true) { function wp_original_referer_field( $echo = true, $jump_back_to = 'current' ) { $jump_back_to = ( 'previous' == $jump_back_to ) ? wp_get_referer() : $_SERVER['REQUEST_URI']; $ref = ( wp_get_original_referer() ) ? wp_get_original_referer() : $jump_back_to; - $orig_referer_field = ''; + $orig_referer_field = ''; if ( $echo ) echo $orig_referer_field; return $orig_referer_field; diff --git a/wp-includes/general-template.php b/wp-includes/general-template.php index c48c6c9ad..1a6f5ec20 100644 --- a/wp-includes/general-template.php +++ b/wp-includes/general-template.php @@ -120,8 +120,8 @@ function get_search_form() { $form = ''; @@ -688,7 +688,7 @@ function single_month_title($prefix = '', $display = true ) { */ function get_archives_link($url, $text, $format = 'html', $before = '', $after = '') { $text = wptexturize($text); - $title_text = attr($text); + $title_text = esc_attr($text); $url = clean_url($url); if ('link' == $format) @@ -1434,8 +1434,8 @@ function feed_links( $args ) { $args = wp_parse_args( $args, $defaults ); - echo '\n"; - echo '\n"; + echo '\n"; + echo '\n"; } /** @@ -1467,27 +1467,27 @@ function feed_links_extra( $args ) { $post = &get_post( $id = 0 ); if ( comments_open() || pings_open() || $post->comment_count > 0 ) { - $title = attr(sprintf( $args['singletitle'], get_bloginfo('name'), $args['separator'], wp_specialchars( get_the_title() ) )); + $title = esc_attr(sprintf( $args['singletitle'], get_bloginfo('name'), $args['separator'], wp_specialchars( get_the_title() ) )); $href = get_post_comments_feed_link( $post->ID ); } } elseif ( is_category() ) { $cat_id = intval( get_query_var('cat') ); - $title = attr(sprintf( $args['cattitle'], get_bloginfo('name'), $args['separator'], get_cat_name( $cat_id ) )); + $title = esc_attr(sprintf( $args['cattitle'], get_bloginfo('name'), $args['separator'], get_cat_name( $cat_id ) )); $href = get_category_feed_link( $cat_id ); } elseif ( is_tag() ) { $tag_id = intval( get_query_var('tag_id') ); $tag = get_tag( $tag_id ); - $title = attr(sprintf( $args['tagtitle'], get_bloginfo('name'), $args['separator'], $tag->name )); + $title = esc_attr(sprintf( $args['tagtitle'], get_bloginfo('name'), $args['separator'], $tag->name )); $href = get_tag_feed_link( $tag_id ); } elseif ( is_author() ) { $author_id = intval( get_query_var('author') ); - $title = attr(sprintf( $args['authortitle'], get_bloginfo('name'), $args['separator'], get_author_name( $author_id ) )); + $title = esc_attr(sprintf( $args['authortitle'], get_bloginfo('name'), $args['separator'], get_author_name( $author_id ) )); $href = get_author_feed_link( $author_id ); } elseif ( is_search() ) { - $title = attr(sprintf( $args['searchtitle'], get_bloginfo('name'), $args['separator'], get_search_query() )); + $title = esc_attr(sprintf( $args['searchtitle'], get_bloginfo('name'), $args['separator'], get_search_query() )); $href = get_search_feed_link(); } @@ -1681,14 +1681,14 @@ function get_search_query() { /** * Display the contents of the search query variable. * - * The search query string is passed through {@link attr()} + * The search query string is passed through {@link esc_attr()} * to ensure that it is safe for placing in an html attribute. * * @uses attr * @since 2.1.0 */ function the_search_query() { - echo attr( apply_filters( 'the_search_query', get_search_query() ) ); + echo esc_attr( apply_filters( 'the_search_query', get_search_query() ) ); } /** diff --git a/wp-includes/kses.php b/wp-includes/kses.php index 634cd4931..0d957b31b 100644 --- a/wp-includes/kses.php +++ b/wp-includes/kses.php @@ -415,7 +415,7 @@ function wp_kses_split($string, $allowed_html, $allowed_protocols) { * * @access private * @since 1.0.0 - * @uses wp_kses_attr() + * @uses wp_kses_esc_attr() * * @param string $string Content to filter * @param array $allowed_html Allowed HTML elements @@ -459,7 +459,7 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) { return "<$slash$elem>"; # No attributes are allowed for closing elements - return wp_kses_attr("$slash$elem", $attrlist, $allowed_html, $allowed_protocols); + return wp_kses_esc_attr("$slash$elem", $attrlist, $allowed_html, $allowed_protocols); } /** @@ -479,7 +479,7 @@ function wp_kses_split2($string, $allowed_html, $allowed_protocols) { * @param array $allowed_protocols Allowed protocols to keep * @return string Sanitized HTML element */ -function wp_kses_attr($element, $attr, $allowed_html, $allowed_protocols) { +function wp_kses_esc_attr($element, $attr, $allowed_html, $allowed_protocols) { # Is there a closing XHTML slash at the end of the attributes? $xhtml_slash = ''; diff --git a/wp-includes/l10n.php b/wp-includes/l10n.php index 7503a7e90..81987595a 100644 --- a/wp-includes/l10n.php +++ b/wp-includes/l10n.php @@ -108,15 +108,15 @@ function __( $text, $domain = 'default' ) { * If there is no translation, or the domain isn't loaded the original text is returned. * * @see translate() An alias of translate() - * @see attr() + * @see esc_attr() * @since 2.8.0 * * @param string $text Text to translate * @param string $domain Optional. Domain to retrieve the translated text * @return string Translated text */ -function _a( $text, $domain = 'default' ) { - return attr( translate( $text, $domain ) ); +function esc_attr__( $text, $domain = 'default' ) { + return esc_attr( translate( $text, $domain ) ); } /** @@ -136,14 +136,14 @@ function _e( $text, $domain = 'default' ) { * Displays translated text that has been escaped for safe use in an attribute. * * @see translate() Echos returned translate() string - * @see attr() + * @see esc_attr() * @since 2.8.0 * * @param string $text Text to translate * @param string $domain Optional. Domain to retrieve the translated text */ -function _ea( $text, $domain = 'default' ) { - echo attr( translate( $text, $domain ) ); +function esc_attr_e( $text, $domain = 'default' ) { + echo esc_attr( translate( $text, $domain ) ); } /** @@ -173,8 +173,8 @@ function _x( $single, $context, $domain = 'default' ) { return translate_with_gettext_context( $single, $context, $domain ); } -function _xa( $single, $context, $domain = 'default' ) { - return attr( translate_with_gettext_context( $single, $context, $domain ) ); +function esc_attr_x( $single, $context, $domain = 'default' ) { + return esc_attr( translate_with_gettext_context( $single, $context, $domain ) ); } function __ngettext() { diff --git a/wp-includes/link-template.php b/wp-includes/link-template.php index 1d766edb5..3ba099bdc 100644 --- a/wp-includes/link-template.php +++ b/wp-includes/link-template.php @@ -619,9 +619,9 @@ function edit_tag_link( $link = '', $before = '', $after = '', $tag = null ) { */ function get_search_feed_link($search_query = '', $feed = '') { if ( empty($search_query) ) - $search = attr(get_search_query()); + $search = esc_attr(get_search_query()); else - $search = attr(stripslashes($search_query)); + $search = esc_attr(stripslashes($search_query)); if ( empty($feed) ) $feed = get_default_feed(); @@ -644,9 +644,9 @@ function get_search_feed_link($search_query = '', $feed = '') { */ function get_search_comments_feed_link($search_query = '', $feed = '') { if ( empty($search_query) ) - $search = attr(get_search_query()); + $search = esc_attr(get_search_query()); else - $search = attr(stripslashes($search_query)); + $search = esc_attr(stripslashes($search_query)); if ( empty($feed) ) $feed = get_default_feed(); @@ -730,7 +730,7 @@ function edit_post_link( $link = 'Edit This', $before = '', $after = '' ) { return; } - $link = '' . $link . ''; + $link = '' . $link . ''; echo $before . apply_filters( 'edit_post_link', $link, $post->ID ) . $after; } @@ -940,7 +940,7 @@ function get_adjacent_post_rel_link($title = '%title', $in_same_cat = false, $ex $title = apply_filters('the_title', $title, $post); $link = $previous ? "\n"; $adjacent = $previous ? 'previous' : 'next'; @@ -1064,7 +1064,7 @@ function get_boundary_post_rel_link($title = '%title', $in_same_cat = false, $ex $title = apply_filters('the_title', $title, $post); $link = $start ? "\n"; $boundary = $start ? 'start' : 'end'; @@ -1092,7 +1092,7 @@ function start_post_rel_link($title = '%title', $in_same_cat = false, $excluded_ * @return string */ function get_index_rel_link() { - $link = "\n"; + $link = "\n"; return apply_filters( "index_rel_link", $link ); } @@ -1127,7 +1127,7 @@ function get_parent_post_rel_link($title = '%title') { $title = apply_filters('the_title', $title, $post); $link = "\n"; return apply_filters( "parent_post_rel_link", $link ); diff --git a/wp-includes/media.php b/wp-includes/media.php index ee11a41f2..484d7cece 100644 --- a/wp-includes/media.php +++ b/wp-includes/media.php @@ -200,10 +200,10 @@ function get_image_tag($id, $alt, $title, $align, $size='medium') { list( $img_src, $width, $height ) = image_downsize($id, $size); $hwstring = image_hwstring($width, $height); - $class = 'align'.attr($align).' size-'.attr($size).' wp-image-'.$id; + $class = 'align' . esc_attr($align) .' size-' . esc_attr($size) . ' wp-image-' . $id; $class = apply_filters('get_image_tag_class', $class, $id, $align, $size); - $html = ''.attr($alt).''; + $html = '' . esc_attr($alt) . ''; $html = apply_filters( 'get_image_tag', $html, $id, $alt, $title, $align, $size ); @@ -542,7 +542,7 @@ function wp_get_attachment_image($attachment_id, $size = 'thumbnail', $icon = fa 'title' => trim(strip_tags( $attachment->post_title )), ); $attr = apply_filters( 'wp_get_attachment_image_attributes', $attr, $attachment ); - $attr = array_map( 'attr', $attr ); + $attr = array_map( 'esc_attr', $attr ); $html = rtrim(" $value ) { $html .= " $name=" . '"' . $value . '"'; diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php index 67c3a9d9d..1e574d494 100644 --- a/wp-includes/pluggable.php +++ b/wp-includes/pluggable.php @@ -1512,7 +1512,7 @@ function get_avatar( $id_or_email, $size = '96', $default = '', $alt = false ) { if ( false === $alt) $safe_alt = ''; else - $safe_alt = attr( $alt ); + $safe_alt = esc_attr( $alt ); if ( !is_numeric($size) ) $size = '96'; diff --git a/wp-includes/post-template.php b/wp-includes/post-template.php index f8a2bb689..68a47fe54 100644 --- a/wp-includes/post-template.php +++ b/wp-includes/post-template.php @@ -63,7 +63,7 @@ function the_title($before = '', $after = '', $echo = true) { * an array. See the function for what can be override in the $args parameter. * * The title before it is displayed will have the tags stripped and {@link - * attr()} before it is passed to the user or displayed. The default + * esc_attr()} before it is passed to the user or displayed. The default * as with {@link the_title()}, is to display the title. * * @since 2.3.0 @@ -83,7 +83,7 @@ function the_title_attribute( $args = '' ) { $title = $before . $title . $after; - $title = attr(strip_tags($title)); + $title = esc_attr(strip_tags($title)); if ( $echo ) echo $title; @@ -707,7 +707,7 @@ function wp_dropdown_pages($args = '') { if ( $show_option_no_change ) $output .= "\t"; if ( $show_option_none ) - $output .= "\t\n"; + $output .= "\t\n"; $output .= walk_page_dropdown_tree($pages, $depth, $r); $output .= "\n"; } @@ -927,10 +927,10 @@ function wp_get_attachment_link($id = 0, $size = 'thumbnail', $permalink = false if ( $permalink ) $url = get_attachment_link($_post->ID); - $post_title = attr($_post->post_title); + $post_title = esc_attr($_post->post_title); if ( $text ) { - $link_text = attr($text); + $link_text = esc_attr($text); } elseif ( ( is_int($size) && $size != 0 ) or ( is_string($size) && $size != 'none' ) or $size != false ) { $link_text = wp_get_attachment_image($id, $size, $icon); } @@ -964,7 +964,7 @@ function get_the_attachment_link($id = 0, $fullsize = false, $max_dims = false, if ( $permalink ) $url = get_attachment_link($_post->ID); - $post_title = attr($_post->post_title); + $post_title = esc_attr($_post->post_title); $innerHTML = get_attachment_innerHTML($_post->ID, $fullsize, $max_dims); return "$innerHTML"; @@ -1060,7 +1060,7 @@ function get_attachment_icon( $id = 0, $fullsize = false, $max_dims = false ) { $constraint = ''; } - $post_title = attr($post->post_title); + $post_title = esc_attr($post->post_title); $icon = "$post_title"; @@ -1088,7 +1088,7 @@ function get_attachment_innerHTML($id = 0, $fullsize = false, $max_dims = false) return $innerHTML; - $innerHTML = attr($post->post_title); + $innerHTML = esc_attr($post->post_title); return apply_filters('attachment_innerHTML', $innerHTML, $post->ID); } @@ -1134,7 +1134,7 @@ function get_the_password_form() { $label = 'pwbox-'.(empty($post->ID) ? rand() : $post->ID); $output = '

    ' . __("This post is password protected. To view it please enter your password below:") . '

    -

    +

    '; return apply_filters('the_password_form', $output); @@ -1316,7 +1316,7 @@ function wp_list_post_revisions( $post_id = 0, $args = null ) {
    - +
    diff --git a/wp-includes/post.php b/wp-includes/post.php index b6782eae9..01a1a5565 100644 --- a/wp-includes/post.php +++ b/wp-includes/post.php @@ -869,7 +869,7 @@ function sanitize_post_field($field, $value, $post_id, $context) { else $value = format_to_edit($value); } else { - $value = attr($value); + $value = esc_attr($value); } } else if ( 'db' == $context ) { if ( $prefixed ) { @@ -888,7 +888,7 @@ function sanitize_post_field($field, $value, $post_id, $context) { } if ( 'attribute' == $context ) - $value = attr($value); + $value = esc_attr($value); else if ( 'js' == $context ) $value = js_escape($value); diff --git a/wp-includes/rss.php b/wp-includes/rss.php index 34c151908..bd41464ba 100644 --- a/wp-includes/rss.php +++ b/wp-includes/rss.php @@ -873,7 +873,7 @@ function wp_rss( $url, $num_items = -1 ) { printf( '
  • %3$s
    • ', clean_url( $item['link'] ), - attr( strip_tags( $item['description'] ) ), + esc_attr( strip_tags( $item['description'] ) ), htmlentities( $item['title'] ) ); } diff --git a/wp-includes/script-loader.php b/wp-includes/script-loader.php index fd0f1e9a4..e14349641 100644 --- a/wp-includes/script-loader.php +++ b/wp-includes/script-loader.php @@ -74,10 +74,10 @@ function wp_default_scripts( &$scripts ) { $scripts->localize( 'quicktags', 'quicktagsL10n', array( 'quickLinks' => __('(Quick Links)'), 'wordLookup' => __('Enter a word to look up:'), - 'dictionaryLookup' => attr(__('Dictionary lookup')), - 'lookup' => attr(__('lookup')), - 'closeAllOpenTags' => attr(__('Close all open tags')), - 'closeTags' => attr(__('close tags')), + 'dictionaryLookup' => esc_attr(__('Dictionary lookup')), + 'lookup' => esc_attr(__('lookup')), + 'closeAllOpenTags' => esc_attr(__('Close all open tags')), + 'closeTags' => esc_attr(__('close tags')), 'enterURL' => __('Enter the URL'), 'enterImageURL' => __('Enter the URL of the image'), 'enterImageDescription' => __('Enter a description of the image'), @@ -212,7 +212,7 @@ function wp_default_scripts( &$scripts ) { $scripts->add( 'ajaxcat', "/wp-admin/js/cat$suffix.js", array( 'wp-lists' ), '20090102' ); $scripts->add_data( 'ajaxcat', 'group', 1 ); $scripts->localize( 'ajaxcat', 'catL10n', array( - 'add' => attr(__('Add')), + 'add' => esc_attr(__('Add')), 'how' => __('Separate multiple categories with commas.'), 'l10n_print_after' => 'try{convertEntities(catL10n);}catch(e){};' ) ); @@ -266,8 +266,8 @@ function wp_default_scripts( &$scripts ) { $scripts->add_data( 'post', 'group', 1 ); $scripts->localize( 'post', 'postL10n', array( 'tagsUsed' => __('Tags used on this post:'), - 'add' => attr(__('Add')), - 'addTag' => attr(__('Add new tag')), + 'add' => esc_attr(__('Add')), + 'addTag' => esc_attr(__('Add new tag')), 'separate' => __('Separate tags with commas'), 'cancel' => __('Cancel'), 'edit' => __('Edit'), @@ -604,7 +604,7 @@ function _print_scripts() { $ver = md5("$wp_scripts->concat_version"); $src = $wp_scripts->base_url . "/wp-admin/load-scripts.php?c={$zip}&load=" . trim($wp_scripts->concat, ', ') . "&ver=$ver"; - echo "\n"; + echo "\n"; } if ( !empty($wp_scripts->print_html) ) @@ -671,7 +671,7 @@ function print_admin_styles() { $dir = $wp_styles->text_direction; $ver = md5("$wp_styles->concat_version{$dir}"); $href = $wp_styles->base_url . "/wp-admin/load-styles.php?c={$zip}&dir={$dir}&load=" . trim($wp_styles->concat, ', ') . "&ver=$ver"; - echo "\n"; + echo "\n"; } if ( !empty($wp_styles->print_html) ) diff --git a/wp-includes/taxonomy.php b/wp-includes/taxonomy.php index 586d7931c..d9030f03b 100644 --- a/wp-includes/taxonomy.php +++ b/wp-includes/taxonomy.php @@ -991,7 +991,7 @@ function sanitize_term_field($field, $value, $term_id, $taxonomy, $context) { if ( 'description' == $field ) $value = format_to_edit($value); else - $value = attr($value); + $value = esc_attr($value); } else if ( 'db' == $context ) { $value = apply_filters("pre_term_$field", $value, $taxonomy); $value = apply_filters("pre_${taxonomy}_$field", $value); @@ -1009,7 +1009,7 @@ function sanitize_term_field($field, $value, $term_id, $taxonomy, $context) { } if ( 'attribute' == $context ) - $value = attr($value); + $value = esc_attr($value); else if ( 'js' == $context ) $value = js_escape($value); @@ -2260,7 +2260,7 @@ function get_the_taxonomies($post = 0) { $links = array(); foreach ( $terms as $term ) - $links[] = "$term->name"; + $links[] = "$term->name"; if ( $links ) $taxonomies[$taxonomy] = wp_sprintf($t['template'], $t['label'], $links, $terms); diff --git a/wp-includes/theme.php b/wp-includes/theme.php index 8ed8fde4f..d5358d05f 100644 --- a/wp-includes/theme.php +++ b/wp-includes/theme.php @@ -932,7 +932,7 @@ function preview_theme_ob_filter_callback( $matches ) { $link = add_query_arg( array('preview' => 1, 'template' => $_GET['template'], 'stylesheet' => @$_GET['stylesheet'] ), $matches[3] ); if ( 0 === strpos($link, 'preview=1') ) $link = "?$link"; - return $matches[1] . attr( $link ) . $matches[4]; + return $matches[1] . esc_attr( $link ) . $matches[4]; } /** diff --git a/wp-includes/update.php b/wp-includes/update.php index 04b1aeaaf..92682a56a 100644 --- a/wp-includes/update.php +++ b/wp-includes/update.php @@ -62,15 +62,15 @@ function wp_version_check() { foreach( explode( "\n\n", $body ) as $entry) { $returns = explode("\n", $entry); $new_option = new stdClass(); - $new_option->response = attr( $returns[0] ); + $new_option->response = esc_attr( $returns[0] ); if ( isset( $returns[1] ) ) $new_option->url = clean_url( $returns[1] ); if ( isset( $returns[2] ) ) $new_option->package = clean_url( $returns[2] ); if ( isset( $returns[3] ) ) - $new_option->current = attr( $returns[3] ); + $new_option->current = esc_attr( $returns[3] ); if ( isset( $returns[4] ) ) - $new_option->locale = attr( $returns[4] ); + $new_option->locale = esc_attr( $returns[4] ); $new_options[] = $new_option; } diff --git a/wp-links-opml.php b/wp-links-opml.php index d853fe4fe..b9170528c 100644 --- a/wp-links-opml.php +++ b/wp-links-opml.php @@ -29,7 +29,7 @@ if ((empty ($link_cat)) || ($link_cat == 'all') || ($link_cat == '0')) { - Links for <?php echo attr(get_bloginfo('name', 'display').$cat_name); ?> + Links for <?php echo esc_attr(get_bloginfo('name', 'display').$cat_name); ?> GMT @@ -44,14 +44,14 @@ foreach ((array) $cats as $cat) { $catname = apply_filters('link_category', $cat->name); ?> - + term_id}"); foreach ((array) $bookmarks as $bookmark) { - $title = attr(apply_filters('link_title', $bookmark->link_name)); + $title = esc_attr(apply_filters('link_title', $bookmark->link_name)); ?> - + " method="post">

    +

    -

    +

    +

    +


    -

    +

    +

    -

    +

    - - + +