From b235937bcc4218e1ae2b33fbd8c36f06ca21f16d Mon Sep 17 00:00:00 2001
From: ryan <ryan@1a063a9b-81f0-0310-95a4-ce76da25c4cd>
Date: Mon, 8 Feb 2010 20:28:13 +0000
Subject: [PATCH] Escape some attributes. Fix search form action. see #9015

git-svn-id: http://svn.automattic.com/wordpress/trunk@13029 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-content/themes/twentyten/archive.php    |  6 +++---
 wp-content/themes/twentyten/attachment.php | 16 ++++++++--------
 wp-content/themes/twentyten/author.php     |  4 ++--
 wp-content/themes/twentyten/category.php   |  4 ++--
 wp-content/themes/twentyten/comments.php   |  8 ++++----
 wp-content/themes/twentyten/footer.php     |  4 ++--
 wp-content/themes/twentyten/functions.php  | 11 ++++-------
 wp-content/themes/twentyten/header.php     |  8 ++++----
 wp-content/themes/twentyten/index.php      | 14 +++++++-------
 wp-content/themes/twentyten/search.php     |  4 ++--
 wp-content/themes/twentyten/searchform.php |  4 ++--
 wp-content/themes/twentyten/single.php     |  4 ++--
 wp-content/themes/twentyten/tag.php        |  4 ++--
 13 files changed, 44 insertions(+), 47 deletions(-)

diff --git a/wp-content/themes/twentyten/archive.php b/wp-content/themes/twentyten/archive.php
index db137ad3d..7804e8d1d 100644
--- a/wp-content/themes/twentyten/archive.php
+++ b/wp-content/themes/twentyten/archive.php
@@ -27,14 +27,14 @@
 <?php while ( have_posts() ) : the_post(); ?>
 
 				<div id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
-					<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( __('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
+					<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( esc_attr__('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
 
 					<div class="entry-meta">
 						<span class="meta-prep meta-prep-author"><?php _e('Posted on ', 'twentyten'); ?></span>
 						<a href="<?php
-		the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><span class="entry-date"><?php the_time( get_option( 'date_format' ) ); ?></span></a>
+		the_permalink(); ?>" title="<?php echo esc_attr( get_the_time('Y-m-d\TH:i:sO') ); ?>" rel="bookmark"><span class="entry-date"><?php the_time( get_option( 'date_format' ) ); ?></span></a>
 						<span class="meta-sep"> <?php _e('by ', 'twentyten'); ?> </span>
-						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( __( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
+						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( esc_attr__( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
 					</div><!-- .entry-meta -->
 
 					<div class="entry-summary">
diff --git a/wp-content/themes/twentyten/attachment.php b/wp-content/themes/twentyten/attachment.php
index d908eb3b2..b4393df00 100644
--- a/wp-content/themes/twentyten/attachment.php
+++ b/wp-content/themes/twentyten/attachment.php
@@ -5,14 +5,14 @@
 
 <?php the_post(); ?>
 
-				<p class="page-title"><a href="<?php echo get_permalink($post->post_parent) ?>" title="<?php printf( __( 'Return to %s', 'twentyten' ), wp_specialchars( get_the_title($post->post_parent), 1 ) ) ?>" rel="gallery">&larr; <?php echo get_the_title($post->post_parent) ?></a></p>
+				<p class="page-title"><a href="<?php echo get_permalink($post->post_parent) ?>" title="<?php printf( esc_attr__( 'Return to %s', 'twentyten' ), wp_specialchars( get_the_title($post->post_parent), 1 ) ) ?>" rel="gallery">&larr; <?php echo get_the_title($post->post_parent) ?></a></p>
 
 				<div id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
 					<h2 class="entry-title"><?php the_title(); ?></h2>
 
 					<div class="entry-meta">
 						<span class="meta-prep meta-prep-author"><?php _e('By ', 'twentyten'); ?></span>
-						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( __( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
+						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( esc_attr__( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
 						<span class="meta-sep"> | </span>
 						<span class="meta-prep meta-prep-entry-date"><?php _e('Published ', 'twentyten'); ?></span>
 						<span class="entry-date"><abbr class="published" title="<?php the_time('Y-m-d\TH:i:sO') ?>"><?php the_time( get_option( 'date_format' ) ); ?></abbr></span>
@@ -22,7 +22,7 @@
 					<div class="entry-content">
 						<div class="entry-attachment">
 <?php if ( wp_attachment_is_image( $post->id ) ) : $att_image = wp_get_attachment_image_src( $post->id, array(640,640)); ?>
-						<p class="attachment"><a href="<?php echo wp_get_attachment_url($post->id); ?>" title="<?php the_title(); ?>" rel="attachment"><img src="<?php echo $att_image[0];?>" width="<?php echo $att_image[1];?>" height="<?php echo $att_image[2];?>"  class="attachment-medium" alt="<?php $post->post_excerpt; ?>" /></a>
+						<p class="attachment"><a href="<?php echo wp_get_attachment_url($post->id); ?>" title="<?php echo esc_attr( get_the_title() ); ?>" rel="attachment"><img src="<?php echo $att_image[0];?>" width="<?php echo $att_image[1];?>" height="<?php echo $att_image[2];?>"  class="attachment-medium" alt="<?php $post->post_excerpt; ?>" /></a>
 						</p>
 
 
@@ -31,7 +31,7 @@
 					<div class="nav-next"><?php next_image_link( false ); ?></div>
 				</div><!-- #nav-below -->
 <?php else : ?>
-						<a href="<?php echo wp_get_attachment_url($post->ID) ?>" title="<?php echo wp_specialchars( get_the_title($post->ID), 1 ) ?>" rel="attachment"><?php echo basename($post->guid) ?></a>
+						<a href="<?php echo wp_get_attachment_url($post->ID) ?>" title="<?php echo esc_attr( get_the_title($post->ID) ); ?>" rel="attachment"><?php echo basename($post->guid) ?></a>
 <?php endif; ?>
 						</div>
 						<div class="entry-caption"><?php if ( !empty($post->post_excerpt) ) the_excerpt() ?></div>
@@ -49,13 +49,13 @@
 						the_title_attribute('echo=0'),
 						comments_rss() ) ?>
 
-<?php if ( ('open' == $post->comment_status) && ('open' == $post->ping_status) ) : // Comments and trackbacks open ?>
+<?php if ( comments_open() && pings_open() ) : // Comments and trackbacks open ?>
 						<?php printf( __( '<a class="comment-link" href="#respond" title="Post a comment">Post a comment</a> or leave a trackback: <a class="trackback-link" href="%s" title="Trackback URL for your post" rel="trackback">Trackback URL</a>.', 'twentyten' ), get_trackback_url() ) ?>
-<?php elseif ( !('open' == $post->comment_status) && ('open' == $post->ping_status) ) : // Only trackbacks open ?>
+<?php elseif ( !comments_open() && pings_open() ) : // Only trackbacks open ?>
 						<?php printf( __( 'Comments are closed, but you can leave a trackback: <a class="trackback-link" href="%s" title="Trackback URL for your post" rel="trackback">Trackback URL</a>.', 'twentyten' ), get_trackback_url() ) ?>
-<?php elseif ( ('open' == $post->comment_status) && !('open' == $post->ping_status) ) : // Only comments open ?>
+<?php elseif ( comments_open() && !pings_open() ) : // Only comments open ?>
 						<?php _e( 'Trackbacks are closed, but you can <a class="comment-link" href="#respond" title="Post a comment">post a comment</a>.', 'twentyten' ) ?>
-<?php elseif ( !('open' == $post->comment_status) && !('open' == $post->ping_status) ) : // Comments and trackbacks closed ?>
+<?php elseif ( !comments_open() && !pings_open() ) : // Comments and trackbacks closed ?>
 						<?php _e( 'Both comments and trackbacks are currently closed.', 'twentyten' ) ?>
 <?php endif; ?>
 <?php edit_post_link( __( 'Edit', 'twentyten' ), "\n\t\t\t\t\t<span class=\"edit-link\">", "</span>" ) ?>
diff --git a/wp-content/themes/twentyten/author.php b/wp-content/themes/twentyten/author.php
index f5c49783b..5d2062d77 100644
--- a/wp-content/themes/twentyten/author.php
+++ b/wp-content/themes/twentyten/author.php
@@ -5,7 +5,7 @@
 
 <?php the_post(); ?>
 
-				<h1 class="page-title author"><?php printf( __( 'Author Archives: <span class="vcard">%s</span>', 'twentyten' ), "<a class='url fn n' href='$authordata->user_url' title='$authordata->display_name' rel='me'>$authordata->display_name</a>" ) ?></h1>
+				<h1 class="page-title author"><?php printf( __( 'Author Archives: <span class="vcard">%s</span>', 'twentyten' ), "<a class='url fn n' href='$authordata->user_url' title='" . esc_attr($authordata->display_name) . "' rel='me'>" . esc_html($authordata->display_name) . "</a>" ) ?></h1>
 
 <?php if ( get_the_author_meta('description') ) : // If a user has filled out their decscription show a bio on their entries  ?>
 					<div id="entry-author-info">
@@ -31,7 +31,7 @@
 <?php while ( have_posts() ) : the_post(); ?>
 
 				<div id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
-					<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( __('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
+					<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( esc_attr__('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
 
 					<div class="entry-meta">
 						<span class="meta-prep meta-prep-author"><?php _e('Posted on ', 'twentyten'); ?></span>
diff --git a/wp-content/themes/twentyten/category.php b/wp-content/themes/twentyten/category.php
index e1eec8c64..7b8870f4e 100644
--- a/wp-content/themes/twentyten/category.php
+++ b/wp-content/themes/twentyten/category.php
@@ -21,14 +21,14 @@
 <?php while ( have_posts() ) : the_post(); ?>
 
 				<div id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
-					<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( __('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
+					<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( esc_attr__('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
 
 					<div class="entry-meta">
 						<span class="meta-prep meta-prep-author"><?php _e('Posted on ', 'twentyten'); ?></span>
 						<a href="<?php
 		the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><span class="entry-date"><?php the_time( get_option( 'date_format' ) ); ?></span></a>
 						<span class="meta-sep"> <?php _e('by ', 'twentyten'); ?> </span>
-						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( __( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
+						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( esc_attr__( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
 					</div><!-- .entry-meta -->
 
 					<div class="entry-summary">
diff --git a/wp-content/themes/twentyten/comments.php b/wp-content/themes/twentyten/comments.php
index 35c10ed53..facae79c8 100644
--- a/wp-content/themes/twentyten/comments.php
+++ b/wp-content/themes/twentyten/comments.php
@@ -74,17 +74,17 @@
 
 					<div id="form-section-author" class="form-section">
 						<div class="form-label"><label for="author"><?php _e('Name', 'twentyten') ?></label> <?php if ($req) _e('<span class="required">*</span>', 'twentyten') ?></div>
-						<div class="form-input"><input id="author" name="author" type="text" value="<?php echo $comment_author ?>" size="30" tabindex="3" /></div>
+						<div class="form-input"><input id="author" name="author" type="text" value="<?php echo esc_attr($comment_author) ?>" size="30" tabindex="3" /></div>
 					</div><!-- #form-section-author .form-section -->
 
 					<div id="form-section-email" class="form-section">
 						<div class="form-label"><label for="email"><?php _e('Email', 'twentyten') ?></label> <?php if ($req) _e('<span class="required">*</span>', 'twentyten') ?></div>
-						<div class="form-input"><input id="email" name="email" type="text" value="<?php echo $comment_author_email ?>" size="30" tabindex="4" /></div>
+						<div class="form-input"><input id="email" name="email" type="text" value="<?php echo esc_attr($comment_author_email) ?>" size="30" tabindex="4" /></div>
 					</div><!-- #form-section-email .form-section -->
 
 					<div id="form-section-url" class="form-section">
 						<div class="form-label"><label for="url"><?php _e('Website', 'twentyten') ?></label></div>
-						<div class="form-input"><input id="url" name="url" type="text" value="<?php echo $comment_author_url ?>" size="30" tabindex="5" /></div>
+						<div class="form-input"><input id="url" name="url" type="text" value="<?php echo esc_attr($comment_author_url) ?>" size="30" tabindex="5" /></div>
 					</div><!-- #form-section-url .form-section -->
 
 	<?php endif; // if ( $user_ID ) ?>
@@ -100,7 +100,7 @@
 
 					<?php do_action('comment_form', $post->ID); ?>
 
-					<div class="form-submit"><input id="submit" name="submit" type="submit" value="<?php _e('Post Comment', 'twentyten') ?>" tabindex="7" /><input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" /></div>
+					<div class="form-submit"><input id="submit" name="submit" type="submit" value="<?php esc_attr_e('Post Comment', 'twentyten') ?>" tabindex="7" /><input type="hidden" name="comment_post_ID" value="<?php echo esc_attr($id); ?>" /></div>
 
 <?php comment_id_fields(); ?>
 
diff --git a/wp-content/themes/twentyten/footer.php b/wp-content/themes/twentyten/footer.php
index d24a18091..000ed7c5b 100644
--- a/wp-content/themes/twentyten/footer.php
+++ b/wp-content/themes/twentyten/footer.php
@@ -6,11 +6,11 @@
 <?php get_sidebar('footer'); ?>
 
 			<div id="site-info">
-				<a href="<?php bloginfo( 'url' ) ?>/" title="<?php bloginfo( 'name' ) ?>" rel="home"><?php bloginfo( 'name' ) ?></a>
+				<a href="<?php bloginfo( 'url' ) ?>/" title="<?php echo esc_attr( get_bloginfo( 'name', 'display' ) ); ?>" rel="home"><?php bloginfo( 'name' ) ?></a>
 			</div>
 
 			<div id="site-generator">
-				<?php printf( __('Proudly powered by <span id="generator-link">%s</span>.', 'twentyten'), '<a href="http://wordpress.org/" title="' . __( 'Semantic Personal Publishing Platform', 'twentyten' ) . '" rel="generator">' . __( 'WordPress', 'twentyten' ) . '</a>' ); ?>
+				<?php printf( __('Proudly powered by <span id="generator-link">%s</span>.', 'twentyten'), '<a href="http://wordpress.org/" title="' . esc_attr__( 'Semantic Personal Publishing Platform', 'twentyten' ) . '" rel="generator">' . __( 'WordPress', 'twentyten' ) . '</a>' ); ?>
 			</div>
 
 		</div><!-- #colophon -->
diff --git a/wp-content/themes/twentyten/functions.php b/wp-content/themes/twentyten/functions.php
index 4dfe78ad7..9abe3653f 100644
--- a/wp-content/themes/twentyten/functions.php
+++ b/wp-content/themes/twentyten/functions.php
@@ -49,9 +49,8 @@ if ( is_readable($locale_file) )
 
 // Get the page number
 function get_page_number() {
-	if ( get_query_var('paged') ) {
+	if ( get_query_var('paged') )
 		print ' | ' . __( 'Page ' , 'twentyten') . get_query_var('paged');
-	}
 } // end get_page_number
 
 
@@ -66,7 +65,7 @@ add_filter('excerpt_length', 'new_excerpt_length');
 
 // Make a nice read more link on excerpts
 function new_excerpt_more($more) {
-return '&nbsp;&hellip; <a href="'. get_permalink($post->ID) . '">' . 'Continue&nbsp;reading&nbsp;<span class="meta-nav">&rarr;</span>' . '</a>';
+	return '&nbsp;&hellip; <a href="'. get_permalink() . '">' . 'Continue&nbsp;reading&nbsp;<span class="meta-nav">&rarr;</span>' . '</a>';
 }
 add_filter('excerpt_more', 'new_excerpt_more');
 
@@ -124,8 +123,8 @@ function twentyten_comment($comment, $args, $depth) {
 
 function remove_gallery_css() {
 	return "<div class='gallery'>";
-	}
-	add_filter('gallery_style', 'remove_gallery_css');
+}
+add_filter('gallery_style', 'remove_gallery_css');
 
 
 
@@ -240,5 +239,3 @@ function theme_widgets_init() {
 
 // Add all the groovy widget areas
 add_action( 'init', 'theme_widgets_init' );
-
-
diff --git a/wp-content/themes/twentyten/header.php b/wp-content/themes/twentyten/header.php
index 07b9c5f82..25a327205 100644
--- a/wp-content/themes/twentyten/header.php
+++ b/wp-content/themes/twentyten/header.php
@@ -20,8 +20,8 @@
 
 	<?php wp_head(); ?>
 
-	<link rel="alternate" type="application/rss+xml" href="<?php bloginfo('rss2_url'); ?>" title="<?php printf( __( '%s latest posts', 'twentyten' ), wp_specialchars( get_bloginfo('name'), 1 ) ); ?>" />
-	<link rel="alternate" type="application/rss+xml" href="<?php bloginfo('comments_rss2_url') ?>" title="<?php printf( __( '%s latest comments', 'twentyten' ), wp_specialchars( get_bloginfo('name'), 1 ) ); ?>" />
+	<link rel="alternate" type="application/rss+xml" href="<?php bloginfo('rss2_url'); ?>" title="<?php printf( esc_attr__( '%s latest posts', 'twentyten' ), wp_specialchars( get_bloginfo('name'), 1 ) ); ?>" />
+	<link rel="alternate" type="application/rss+xml" href="<?php bloginfo('comments_rss2_url') ?>" title="<?php printf( esc_attr__( '%s latest comments', 'twentyten' ), wp_specialchars( get_bloginfo('name'), 1 ) ); ?>" />
 	<link rel="pingback" href="<?php bloginfo('pingback_url'); ?>" />
 </head>
 
@@ -32,7 +32,7 @@
 		<div id="masthead">
 
 			<div id="branding">
-				<div id="site-title"><span><a href="<?php bloginfo( 'url' ) ?>/" title="<?php bloginfo( 'name' ) ?>" rel="home"><?php bloginfo( 'name' ) ?></a></span></div>
+				<div id="site-title"><span><a href="<?php bloginfo( 'url' ) ?>/" title="<?php echo esc_attr( get_bloginfo( 'name', 'display' ) ); ?>" rel="home"><?php bloginfo( 'name' ) ?></a></span></div>
 				<div id="site-description"><?php bloginfo( 'description' ) ?></div>
 
 				<?php
@@ -45,7 +45,7 @@
 			</div><!-- #branding -->
 
 			<div id="access">
-				<div class="skip-link screen-reader-text"><a href="#content" title="<?php _e( 'Skip to content', 'twentyten' ) ?>"><?php _e( 'Skip to content', 'twentyten' ) ?></a></div>
+				<div class="skip-link screen-reader-text"><a href="#content" title="<?php esc_attr_e( 'Skip to content', 'twentyten' ) ?>"><?php _e( 'Skip to content', 'twentyten' ) ?></a></div>
 				<?php wp_page_menu( 'sort_column=menu_order' ); ?>
 			</div><!-- #access -->
 
diff --git a/wp-content/themes/twentyten/index.php b/wp-content/themes/twentyten/index.php
index c21ae5d07..49be30fe9 100644
--- a/wp-content/themes/twentyten/index.php
+++ b/wp-content/themes/twentyten/index.php
@@ -13,20 +13,20 @@
     <?php if ( have_posts() ) : while ( have_posts() ) : the_post(); ?>
     <?php if ( in_category( 'Gallery' ) ) { ?>
     	<div id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
-			<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( __('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
+			<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( esc_attr__('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
 
 			<div class="entry-meta">
 				<span class="meta-prep meta-prep-author"><?php _e('Posted on ', 'twentyten'); ?></span>
 				<a href="<?php
 the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><span class="entry-date"><?php the_time( get_option( 'date_format' ) ); ?></span></a>
 				<span class="meta-sep"> <?php _e('by ', 'twentyten'); ?> </span>
-				<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( __( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
+				<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( esc_attr__( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
 			</div><!-- .entry-meta -->
 
 			<div class="entry-content">
 				<div class="gallery-thumb"><a class="size-thumbnail" href="<?php permalink_link() ?>"><?php $hilite = $wpdb->get_var( "SELECT ID FROM $wpdb->posts WHERE post_parent = '$post->ID' AND post_type = 'attachment' LIMIT 1" ); echo wp_get_attachment_image( $hilite, 'thumbnail' );?></a></div>
 
-				<p><em><?php printf( __('This gallery contains <a %1$s>%2$s photos</a>.', 'twentyten'), 'href="' . get_permalink() . '" title="' . sprintf( __('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ) . '" rel="bookmark"', $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->posts WHERE post_parent = '$post->ID' AND post_type = 'attachment'" )); ?></em></p>
+				<p><em><?php printf( __('This gallery contains <a %1$s>%2$s photos</a>.', 'twentyten'), 'href="' . get_permalink() . '" title="' . sprintf( esc_attr__('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ) . '" rel="bookmark"', $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->posts WHERE post_parent = '$post->ID' AND post_type = 'attachment'" )); ?></em></p>
 
 				<?php the_excerpt(''); ?>
 			</div><!-- .entry-content -->
@@ -36,7 +36,7 @@ the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><
 				    $category_id = get_cat_ID( 'Gallery' );
 				    $category_link = get_category_link( $category_id );
 				?>
-				<a href="<?php echo $category_link; ?>" title="<?php _e('View posts in the Gallery category', 'twentyten'); ?>"><?php _e('More Galleries', 'twentyten'); ?></a>
+				<a href="<?php echo $category_link; ?>" title="<?php esc_attr_e('View posts in the Gallery category', 'twentyten'); ?>"><?php _e('More Galleries', 'twentyten'); ?></a>
 
 				<span class="meta-sep"> | </span>
 
@@ -58,7 +58,7 @@ the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><
 				<a href="<?php
 the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><span class="entry-date"><?php the_time( get_option( 'date_format' ) ); ?></span></a>
 				<span class="meta-sep"> <?php _e('by ', 'twentyten'); ?> </span>
-				<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( __( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
+				<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( esc_attr__( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
 				<span class="meta-sep"> | </span>
 				<span class="comments-link"><?php comments_popup_link( __( 'Leave a comment', 'twentyten' ), __( '1 Comment', 'twentyten' ), __( '% Comments', 'twentyten' ) ) ?></span>
 				<?php edit_post_link( __( 'Edit', 'twentyten' ), "<span class=\"meta-sep\">|</span>\n\t\t\t\t\t\t<span class=\"edit-link\">", "</span>\n\t\t\t\t\t\n" ) ?>
@@ -68,14 +68,14 @@ the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><
 
     <?php } else { ?>
 		<div id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
-			<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( __('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
+			<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( esc_attr__('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
 
 			<div class="entry-meta">
 				<span class="meta-prep meta-prep-author"><?php _e('Posted on ', 'twentyten'); ?></span>
 				<a href="<?php
 the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><span class="entry-date"><?php the_time( get_option( 'date_format' ) ); ?></span></a>
 				<span class="meta-sep"> <?php _e('by ', 'twentyten'); ?> </span>
-				<span class="author vcard"><a class="url fn n"2 href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( __( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
+				<span class="author vcard"><a class="url fn n"2 href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( esc_attr__( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
 			</div><!-- .entry-meta -->
 
 			<div class="entry-content">
diff --git a/wp-content/themes/twentyten/search.php b/wp-content/themes/twentyten/search.php
index 641d05d74..2b4f5715f 100644
--- a/wp-content/themes/twentyten/search.php
+++ b/wp-content/themes/twentyten/search.php
@@ -17,7 +17,7 @@
 <?php while ( have_posts() ) : the_post() ?>
 
 				<div id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
-					<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( __('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
+					<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( esc_attr__('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
 
 <?php if ( $post->post_type == 'post' ) { ?>
 					<div class="entry-meta">
@@ -25,7 +25,7 @@
 						<a href="<?php
 		the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><span class="entry-date"><?php the_time( get_option( 'date_format' ) ); ?></span></a>
 						<span class="meta-sep"> <?php _e('by ', 'twentyten'); ?> </span>
-						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( __( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
+						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( esc_attr__( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
 					</div><!-- .entry-meta -->
 <?php } ?>
 
diff --git a/wp-content/themes/twentyten/searchform.php b/wp-content/themes/twentyten/searchform.php
index 29903bf25..81f9b9183 100644
--- a/wp-content/themes/twentyten/searchform.php
+++ b/wp-content/themes/twentyten/searchform.php
@@ -1,7 +1,7 @@
-    <form id="searchform" name="searchform" method="get" action="/">
+    <form id="searchform" name="searchform" method="get" action="<?php echo home_url(); ?>">
 		<div>
 			<label for="s"><?php _e('Search', 'twentyten'); ?></label>
 			<input type="text" id="s" name="s" />
-			<input type="submit" id="searchsubmit" value="<?php _e('Search', 'twentyten'); ?>" />
+			<input type="submit" id="searchsubmit" value="<?php esc_attr_e('Search', 'twentyten'); ?>" />
 		</div>
     </form>
\ No newline at end of file
diff --git a/wp-content/themes/twentyten/single.php b/wp-content/themes/twentyten/single.php
index 1c8238c94..9d14143a1 100644
--- a/wp-content/themes/twentyten/single.php
+++ b/wp-content/themes/twentyten/single.php
@@ -15,7 +15,7 @@
 
 					<div class="entry-meta">
 						<span class="meta-prep meta-prep-author"><?php _e('Posted by ', 'twentyten'); ?></span>
-						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( __( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
+						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( esc_attr__( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
 						<span class="meta-sep"> <?php _e('on ', 'twentyten'); ?> </span>
 						<a href="<?php
 the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><span class="entry-date"><?php the_time( get_option( 'date_format' ) ); ?></span></a>
@@ -36,7 +36,7 @@ the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><
 							<h2><?php _e('About ', 'twentyten'); ?><?php the_author(); ?></h2>
 <?php the_author_meta('description'); ?>
 							<div id="author-link">
-								<a href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( __( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php _e('View all posts by ', 'twentyten'); ?><?php the_author(); ?> &rarr;</a>
+								<a href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( esc_attr__( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php _e('View all posts by ', 'twentyten'); ?><?php the_author(); ?> &rarr;</a>
 							</div><!-- #author-link	-->
 						</div><!-- #author-description	-->
 					</div><!-- .entry-author-info -->
diff --git a/wp-content/themes/twentyten/tag.php b/wp-content/themes/twentyten/tag.php
index f6c045960..308434ed8 100644
--- a/wp-content/themes/twentyten/tag.php
+++ b/wp-content/themes/twentyten/tag.php
@@ -19,13 +19,13 @@
 <?php while ( have_posts() ) : the_post(); ?>
 
 				<div id="post-<?php the_ID(); ?>" <?php post_class(); ?>>
-					<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( __('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
+					<h2 class="entry-title"><a href="<?php the_permalink(); ?>" title="<?php printf( esc_attr__('Permalink to %s', 'twentyten'), the_title_attribute('echo=0') ); ?>" rel="bookmark"><?php the_title(); ?></a></h2>
 
 					<div class="entry-meta">
 						<span class="meta-prep meta-prep-author"><?php _e('Posted on ', 'twentyten'); ?></span>
 						<a href="<?php the_permalink(); ?>" title="<?php the_time('Y-m-d\TH:i:sO') ?>" rel="bookmark"><span class="entry-date"><?php the_time( get_option( 'date_format' ) ); ?></span></a>
 						<span class="meta-sep"> <?php _e('by ', 'twentyten'); ?> </span>
-						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( __( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
+						<span class="author vcard"><a class="url fn n" href="<?php echo get_author_posts_url( $authordata->ID, $authordata->user_nicename ); ?>" title="<?php printf( esc_attr__( 'View all posts by %s', 'twentyten' ), $authordata->display_name ); ?>"><?php the_author(); ?></a></span>
 					</div><!-- .entry-meta -->
 
 					<div class="entry-summary">