WordPress.org

Tagged: escaping Toggle Comment Threads | Keyboard Shortcuts

• 

  Mark Jaquith 4:54 pm on May 18, 2009 Permalink
  Tags: API ( 10 ), escaping, esc_url, esc_url_raw, security ( 6 )   

  Deprecated clean_url() in favor of esc_url(), and deprecated sanitize_url() in favor of esc_url_raw().

  Lloyd Budd is discussing. Toggle Comments

   
  • 

    Lloyd Budd 4:48 pm on May 21, 2009 Permalink | Log in to Reply

    http://codex.wordpress.org/Data_Validation will need an update.
• 

  Mark Jaquith 3:13 pm on May 18, 2009 Permalink
  Tags: API ( 10 ), escaping, esc_attr, esc_html, security ( 6 )   

  Deprecated wp_specialchars() in favor of esc_html() (also: esc_html__() and esc_html_e()). Using wp_specialchars() with more than one param works for backwards compat. Also, esc_html() (or wp_specialchars() with one param) escapes quotes, just like esc_attr(). This buys security for plugin authors who were mistakenly using a one-param wp_specialchars() call in an HTML attribute. See this wp-hackers message for more detail.

  Lloyd Budd is discussing. Toggle Comments

   
  • 

    Lloyd Budd 4:48 pm on May 21, 2009 Permalink | Log in to Reply

    http://codex.wordpress.org/Data_Validation

• 

  Mark Jaquith 9:16 pm on May 5, 2009 Permalink
  Tags: API ( 10 ), escaping, security ( 6 )   

  Standardizing and shortening the WP security escaping functions.

  attribute_escape() is now esc_attr()

  Additionally, you can do attribute escaping and translation in one go. Just add the translation function to the end. Like so:

  • esc_attr__() — translate and return, attribute-escaped.
  • esc_attr_e() — translate and echo, attribute-escaped.

  Will be following up with esc_html (with __() and _e() variants), esc_url(), maybe some more. Will be nice, short, predictable, and allow you do translate/escape in one go without a lot of nested parenthesis.

  Leandro Vieira Pinho, WordPress News: BuddyPress News, WordPress 2.8 News, WordCamp Toronto & Virginia, WordPress.tv Feeds, and More | The Blog Herald, Mark Jaquith, and 1 other are discussing. Toggle Comments

   
  • 

    Viper007Bond 5:04 am on May 6, 2009 Permalink | Log in to Reply

    An esc_js() or whatnot might be useful to (i.e. an improved js_escape() (see #7648).

    • 

      Mark Jaquith 5:58 am on May 6, 2009 Permalink | Log in to Reply

      Yes, I meant to include that in the list of “coming soon” ones. Though js_escape() would continue to work, as would attribute_escape() and wp_specialchars().

      Improvements to esc_js() née js_escape() are a separate issue — I’ll take a look at that ticket.

  • 

    Leandro Vieira Pinho 3:11 am on May 9, 2009 Permalink | Log in to Reply

    Why not escape_attr than esc_attr?. Write escape is more intuitive than esc.