Changeset 1940

Show
Ignore:
Timestamp:
12/12/04 20:41:19 (4 years ago)
Author:
saxmatt
Message:

Axing htmlspecialchars because it double-encodes-encodes. Better error handling around queries.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/wp-admin/admin-functions.php

    r1938 r1940  
    9191   echo '<label for="category-', $category['cat_ID'], '" class="selectit"><input value="', $category['cat_ID'], 
    9292     '" type="checkbox" name="post_category[]" id="category-', $category['cat_ID'], '"', 
    93      ($category['checked'] ? ' checked="checked"' : ""), '/> ', htmlspecialchars($category['cat_name']), "</label>\n"; 
     93     ($category['checked'] ? ' checked="checked"' : ""), '/> ', wp_specialchars($category['cat_name']), "</label>\n"; 
    9494 
    9595   if(isset($category['children'])) { 
    …… 
    114114        foreach ($categories as $category) { 
    115115            if ($category->category_parent == $parent) { 
    116                 $category->cat_name = htmlspecialchars($category->cat_name); 
     116                $category->cat_name = wp_specialchars($category->cat_name); 
    117117                $count = $wpdb->get_var("SELECT COUNT(post_id) FROM $wpdb->post2cat WHERE category_id = $category->cat_ID"); 
    118118                $pad = str_repeat('&#8212; ', $level); 
    …… 
    145145            $count = $wpdb->get_var("SELECT COUNT(post_id) FROM $wpdb->post2cat WHERE category_id = $category->cat_ID"); 
    146146            $pad = str_repeat('&#8211; ', $level); 
    147             $category->cat_name = htmlspecialchars($category->cat_name); 
     147            $category->cat_name = wp_specialchars($category->cat_name); 
    148148            echo "\n\t<option value='$category->cat_ID'"; 
    149149            if ($currentparent == $category->cat_ID) 

  • trunk/wp-admin/bookmarklet.php

    r1839 r1940  
    2121<?php 
    2222} else { 
    23     $popuptitle = htmlspecialchars(stripslashes($popuptitle)); 
    24     $text = htmlspecialchars(stripslashes(urldecode($text))); 
     23    $popuptitle = wp_specialchars(stripslashes($popuptitle)); 
     24    $text = wp_specialchars(stripslashes(urldecode($text))); 
    2525     
    2626    /* big funky fixes for browsers' javascript bugs */ 
    …… 
    4141    } 
    4242     
    43     $post_title = $_REQUEST['post_title']; 
     43    $post_title = wp_specialchars($_REQUEST['post_title']); 
    4444    if (!empty($post_title)) { 
    4545        $post_title =  stripslashes($post_title); 
    …… 
    4747        $post_title = $popuptitle; 
    4848    } 
    49 // I'm not sure why we're using $edited_post_title in the edit-form.php, but we are 
    50 // and that is what is being included below. For this reason, I am just duplicating 
    51 // the var instead of changing the assignment on the lines above.  
    52 // -- Alex King 2004-01-07 
    53     $edited_post_title = htmlspecialchars($post_title); 
     49 
     50    $edited_post_title = wp_specialchars($post_title); 
    5451 
    5552// $post_pingback needs to be set in any file that includes edit-form.php 
    5653    $post_pingback = get_settings('default_pingback_flag'); 
    5754     
    58     $content = htmlspecialchars($_REQUEST['content']); 
    59     if (!empty($content)) { 
    60         $content =  stripslashes($content); 
     55    $content  = wp_specialchars($_REQUEST['content']); 
     56    $popupurl = wp_specialchars($_REQUEST['popupurl']); 
     57    if ( !empty($content) ) { 
     58        $content = wp_specialchars( stripslashes($_REQUEST['content']) ); 
    6159    } else { 
    6260        $content = '<a href="'.$popupurl.'">'.$popuptitle.'</a>'."\n$text"; 
    …… 
    7270<link rel="stylesheet" href="wp-admin.css" type="text/css" /> 
    7371<link rel="shortcut icon" href="../wp-images/wp-favicon.png" /> 
    74 <script type="text/javascript"> 
    75 <!-- 
    76 function launchupload() { 
    77     window.open ("upload.php", "wpupload", "width=380,height=360,location=0,menubar=0,resizable=1,scrollbars=yes,status=1,toolbar=0"); 
    78 } 
    7972 
    80 //--> 
    81 </script> 
    8273<style type="text/css"> 
    8374<!-- 

  • trunk/wp-admin/categories.php

    r1930 r1940  
    2727        die (__('Cheatin&#8217; uh?')); 
    2828     
    29     $cat_name= $_POST['cat_name']; 
     29    $cat_name= wp_specialchars($_POST['cat_name']); 
    3030    $id_result = $wpdb->get_row("SHOW TABLE STATUS LIKE '$wpdb->categories'"); 
    3131    $cat_ID = $id_result->Auto_increment; 
    …… 
    6565 
    6666    require_once ('admin-header.php'); 
    67     $cat_ID = intval($_GET['cat_ID']); 
     67    $cat_ID = (int) $_GET['cat_ID']; 
    6868    $category = $wpdb->get_row("SELECT * FROM $wpdb->categories WHERE cat_ID = '$cat_ID'"); 
    6969    $cat_name = $category->cat_name; 
    …… 
    7676        <tr> 
    7777          <th width="33%" scope="row"><?php _e('Category name:') ?></th> 
    78           <td width="67%"><input name="cat_name" type="text" value="<?php echo htmlspecialchars($cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" /> 
     78          <td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" /> 
    7979<input type="hidden" name="cat_ID" value="<?php echo $cat_ID ?>" /></td> 
    8080        </tr> 
    8181        <tr> 
    8282            <th scope="row"><?php _e('Category slug:') ?></th> 
    83             <td><input name="category_nicename" type="text" value="<?php echo htmlspecialchars($category->category_nicename); ?>" size="40" /></td> 
     83            <td><input name="category_nicename" type="text" value="<?php echo wp_specialchars($category->category_nicename); ?>" size="40" /></td> 
    8484        </tr> 
    8585        <tr> 
    …… 
    9393        <tr> 
    9494            <th scope="row"><?php _e('Description:') ?></th> 
    95             <td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo htmlspecialchars($category->category_description, ENT_NOQUOTES); ?></textarea></td> 
     95            <td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description, 1); ?></textarea></td> 
    9696        </tr> 
    9797        </table> 
    …… 
    108108        die (__('Cheatin&#8217; uh?')); 
    109109     
    110     $cat_name = $_POST['cat_name']; 
     110    $cat_name = wp_specialchars($_POST['cat_name']); 
    111111    $cat_ID = (int) $_POST['cat_ID']; 
    112112    $category_nicename = sanitize_title($_POST['category_nicename'], $cat_ID); 

  • trunk/wp-admin/edit-comments.php

    r1875 r1940  
    77require_once('admin-header.php'); 
    88if (empty($_GET['mode'])) $mode = 'view'; 
    9 else $mode = htmlspecialchars($_GET['mode']); 
     9else $mode = wp_specialchars($_GET['mode'], 1); 
    1010?> 
    1111 
    …… 
    3030  <fieldset>  
    3131  <legend><?php _e('Show Comments That Contain...') ?></legend>  
    32   <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo htmlspecialchars($_GET['s']); ?>" size="17" />  
     32  <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo wp_specialchars($_GET['s'], 1); ?>" size="17" />  
    3333  <input type="submit" name="submit" value="<?php _e('Search') ?>"  />   
    3434  <input type="hidden" name="mode" value="<?php echo $mode; ?>" /> 

  • trunk/wp-admin/edit-form-advanced.php

    r1937 r1940  
    129129} 
    130130?> 
    131     <input name="referredby" type="hidden" id="referredby" value="<?php echo htmlspecialchars($_SERVER['HTTP_REFERER']); ?>" /> 
     131    <input name="referredby" type="hidden" id="referredby" value="<?php echo wp_specialchars($_SERVER['HTTP_REFERER']); ?>" /> 
    132132</p> 
    133133 

  • trunk/wp-admin/edit-page-form.php

    r1935 r1940  
    7878<p class="submit"> 
    7979  <input name="savepage" type="submit" id="savepage" tabindex="6" value="<?php $post_ID ? _e('Edit Page') :_e('Create New Page') ?> &raquo;" />  
    80   <input name="referredby" type="hidden" id="referredby" value="<?php if (isset($_SERVER['HTTP_REFERER'])) echo htmlspecialchars($_SERVER['HTTP_REFERER']); ?>" /> 
     80  <input name="referredby" type="hidden" id="referredby" value="<?php if (isset($_SERVER['HTTP_REFERER'])) echo wp_specialchars($_SERVER['HTTP_REFERER']); ?>" /> 
    8181</p> 
    8282 

  • trunk/wp-admin/edit.php

    r1889 r1940  
    55$parent_file = 'edit.php'; 
    66require_once('admin-header.php'); 
     7 
     8$_GET['m'] = (int) $_GET['m']; 
    79 
    810get_currentuserinfo(); 
    …… 
    6668    echo $month[substr( $_GET['m'], 4, 2 )] . ' ' . substr( $_GET['m'], 0, 4 ); 
    6769} elseif ( isset( $_GET['s'] ) ) { 
    68     printf(__('Search for &#8220;%s&#8221;'), htmlspecialchars($_GET['s']) ); 
     70    printf(__('Search for &#8220;%s&#8221;'), wp_specialchars($_GET['s']) ); 
    6971} else { 
    7072    _e('Last 15 Posts'); 
    …… 
    9193            $arc_month = $arc_row->mmonth; 
    9294             
    93             if( isset($_GET['m']) && $arc_year . zeroise($arc_month, 2) == $_GET['m'] ) 
     95            if( isset($_GET['m']) && $arc_year . zeroise($arc_month, 2) == (int) $_GET['m'] ) 
    9496                $default = 'selected="selected"'; 
    9597            else 
    …… 
    122124<?php 
    123125$what_to_show = 'posts'; 
    124 if ( empty($_GET['m']) && empty($_GET['s']) ) { 
     126if ( empty($_GET['m']) || 0 == $_GET['m'] && empty($_GET['s']) ) { 
    125127  $showposts = 15; 
    126128} else { 

  • trunk/wp-admin/link-add.php

    r1818 r1940  
    22require_once('admin.php'); 
    33 
    4 $title = 'Add Link'; 
     4$title = __('Add Link'); 
    55$this_file = 'link-manager.php'; 
    66$parent_file = 'link-manager.php'; 
    77 
    88function category_dropdown($fieldname, $selected = 0) { 
    9     global $wpdb; 
    10  
    11     $results = $wpdb->get_results("SELECT cat_id, cat_name, auto_toggle FROM $wpdb->linkcategories ORDER BY cat_id"); 
    12     echo '        <select name="'.$fieldname.'" size="1">'."\n"; 
    13     foreach ($results as $row) { 
    14       echo "          <option value=\"".$row->cat_id."\""; 
    15       if ($row->cat_id == $selected) 
    16         echo " selected"; 
    17         echo ">".$row->cat_id.": ".htmlspecialchars($row->cat_name); 
    18         if ($row->auto_toggle == 'Y') 
    19             echo ' (auto toggle)'; 
    20         echo "</option>\n"; 
    21     } 
    22     echo "        </select>\n"; 
     9   global $wpdb; 
     10     
     11   $results = $wpdb->get_results("SELECT cat_id, cat_name, auto_toggle FROM $wpdb->linkcategories ORDER BY cat_id"); 
     12   echo "\n<select name='$fieldname' size='1'>\n"; 
     13   foreach ($results as $row) { 
     14       echo "\n\t<option value='$row->cat_id'"; 
     15       if ($row->cat_id == $selected) 
     16           echo " selected='selected'"; 
     17       echo ">$row->cat_id : " . wp_specialchars($row->cat_name); 
     18       if ($row->auto_toggle == 'Y') 
     19           echo ' (auto toggle)'; 
     20       echo "</option>"; 
     21   } 
     22   echo "\n</select>\n"; 
    2323} 
    2424 
    …… 
    5050 
    5151<?php if ($_GET['added']) : ?> 
    52 <div class="updated"><p>Link added.</p></div> 
     52<div class="updated"><p><?php _e('Link added.'); ?></p></div> 
    5353<?php endif; ?> 
    5454<div class="wrap"> 
    …… 
    6060         <tr> 
    6161           <th width="33%" scope="row"><?php _e('URI:') ?></th> 
    62            <td width="67%"><input type="text" name="linkurl" value="<?php echo $_GET['linkurl']; ?>" style="width: 95%;" /></td> 
     62           <td width="67%"><input type="text" name="linkurl" value="<?php echo wp_specialchars($_GET['linkurl'], 1); ?>" style="width: 95%;" /></td> 
    6363         </tr> 
    6464         <tr> 
    6565           <th scope="row"><?php _e('Link Name:') ?></th> 
    66            <td><input type="text" name="name" value="<?php echo urldecode($_GET['name']); ?>" style="width: 95%" /></td> 
     66           <td><input type="text" name="name" value="<?php echo wp_specialchars( urldecode($_GET['name']), 1 ); ?>" style="width: 95%" /></td> 
    6767         </tr> 
    6868         <tr> 

  • trunk/wp-admin/link-categories.php

    r1818 r1940  
    2929          die (__("Cheatin' uh ?")); 
    3030 
    31       $cat_name = addslashes($_POST['cat_name']); 
     31      $cat_name = wp_specialchars($_POST['cat_name']); 
    3232      $auto_toggle = $_POST['auto_toggle']; 
    3333      if ($auto_toggle != 'Y') { 
    …… 
    8080  case 'Delete': 
    8181  { 
    82     $cat_id = $_GET['cat_id']; 
     82    $cat_id = (int) $_GET['cat_id']; 
    8383    $cat_name=get_linkcatname($cat_id); 
    8484 
    …… 
    9898  { 
    9999    include_once ('admin-header.php'); 
    100     $cat_id = $_GET['cat_id']; 
     100    $cat_id = (int) $_GET['cat_id']; 
    101101    $row = $wpdb->get_row("SELECT cat_id, cat_name, auto_toggle, show_images, show_description, " 
    102102         . " show_rating, show_updated, sort_order, sort_desc, text_before_link, text_after_link, " 
    …… 
    109109 
    110110<div class="wrap"> 
    111   <h2>Edit &#8220;<?php echo htmlspecialchars($row->cat_name)?>&#8221; Category </h2> 
     111  <h2>Edit &#8220;<?php echo wp_specialchars($row->cat_name)?>&#8221; Category </h2> 
    112112 
    113113  <form name="editcat" method="post"> 
    …… 
    119119<tr> 
    120120    <th width="33%" scope="row"><?php _e('Name:') ?></th> 
    121     <td width="67%"><input name="cat_name" type="text" value="<?php echo htmlspecialchars($row->cat_name)?>" size="30" /></td> 
     121    <td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($row->cat_name)?>" size="30" /></td> 
    122122</tr> 
    123123<tr> 
    …… 
    177177<tr> 
    178178    <th width="33%" scope="row"><?php _e('Before Link:') ?></th> 
    179     <td width="67%"><input type="text" name="text_before_link" size="45" value="<?php echo htmlspecialchars($row->text_before_link)?>" /></td> 
     179    <td width="67%"><input type="text" name="text_before_link" size="45" value="<?php echo wp_specialchars($row->text_before_link)?>" /></td> 
    180180</tr> 
    181181<tr> 
    182182<th scope="row"><?php _e('Between Link and Description:') ?></th> 
    183 <td><input type="text" name="text_after_link" size="45" value="<?php echo htmlspecialchars($row->text_after_link)?>" /></td> 
     183<td><input type="text" name="text_after_link" size="45" value="<?php echo wp_specialchars($row->text_after_link)?>" /></td> 
    184184</tr> 
    185185<tr> 
    186186<th scope="row"><?php _e('After Link:') ?></th> 
    187 <td><input type="text" name="text_after_all" size="45" value="<?php echo htmlspecialchars($row->text_after_all)?>"/></td> 
     187<td><input type="text" name="text_after_all" size="45" value="<?php echo wp_specialchars($row->text_after_all)?>"/></td> 
    188188</tr> 
    189189</table> 
    …… 
    205205    if (isset($submit)) { 
    206206 
    207     $cat_id=$_POST["cat_id"]; 
    208  
    209     $cat_name= $_POST["cat_name"]; 
     207    $cat_id = (int)$_POST["cat_id"]; 
     208 
     209    $cat_name= wp_specialchars($_POST["cat_name"]); 
    210210    $auto_toggle = $_POST["auto_toggle"]; 
    211211    if ($auto_toggle != 'Y') { 
    …… 
    311311?> 
    312312              <tr valign="middle" align="center" <?php echo $style ?> style="border-bottom: 1px dotted #9C9A9C;"> 
    313                 <td><?php echo htmlspecialchars($row->cat_name)?></td> 
     313                <td><?php echo wp_specialchars($row->cat_name)?></td> 
    314314                <td ><?php echo $row->cat_id?></td> 
    315315                <td><?php echo $row->auto_toggle?></td> 

  • trunk/wp-admin/link-manager.php

    r1856 r1940  
    3333        if ($row->cat_id == $selected) 
    3434            echo " selected='selected'"; 
    35         echo ">$row->cat_id: ".htmlspecialchars($row->cat_name); 
     35        echo ">$row->cat_id: ".wp_specialchars($row->cat_name); 
    3636        if ('Y' == $row->auto_toggle) 
    3737            echo ' (auto toggle)'; 
    …… 
    161161    check_admin_referer(); 
    162162 
    163     $link_url = $_POST['linkurl']; 
     163    $link_url = wp_specialchars($_POST['linkurl']); 
    164164    $link_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $link_url) ? $link_url : 'http://' . $link_url;  
    165     $link_name = $_POST['name']; 
    166     $link_image = $_POST['image']; 
     165    $link_name = wp_specialchars($_POST['name']); 
     166    $link_image = wp_specialchars($_POST['image']); 
    167167    $link_target = $_POST['target']; 
    168168    $link_category = $_POST['category']; 
    …… 
    172172    $link_rel = $_POST['rel']; 
    173173    $link_notes = $_POST['notes']; 
    174     $link_rss_uri =  $_POST['rss_uri']; 
     174    $link_rss_uri =  wp_specialchars($_POST['rss_uri']); 
    175175    $auto_toggle = get_autotoggle($link_category); 
    176176 
    …… 
    208208      check_admin_referer(); 
    209209 
    210       $link_id = $_POST['link_id']; 
    211       $link_url = $_POST['linkurl']; 
     210      $link_id = (int) $_POST['link_id']; 
     211      $link_url = wp_specialchars($_POST['linkurl']); 
    212212      $link_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $link_url) ? $link_url : 'http://' . $link_url;  
    213       $link_name = $_POST['name']; 
    214       $link_image = $_POST['image']; 
    215       $link_target = $_POST['target']; 
     213      $link_name = wp_specialchars($_POST['name']); 
     214      $link_image = wp_specialchars($_POST['image']); 
     215      $link_target = wp_specialchars($_POST['target']); 
    216216      $link_category = $_POST['category']; 
    217217      $link_description = $_POST['description']; 
    …… 
    271271  } // end Delete 
    272272 
    273   case 'linkedit': 
    274   { 
     273  case 'linkedit': { 
    275274    $xfn = true; 
    276275    include_once ('admin-header.php'); 
    277     if ($user_level < 5) { 
     276    if ($user_level < 5) 
    278277      die(__('You do not have sufficient permissions to edit the links for this blog.')); 
    279     } 
     278 
    280279    $link_id = (int) $_GET['link_id']; 
    281     $row = $wpdb->get_row("SELECT *  
    282     FROM $wpdb->links  
    283     WHERE link_id = $link_id"); 
     280    $row = $wpdb->get_row("SELECT * FROM $wpdb->links WHERE link_id = $link_id"); 
    284281 
    285282    if ($row) { 
    286       $link_url = htmlspecialchars($row->link_url); 
    287       $link_name = htmlspecialchars($row->link_name); 
     283      $link_url = wp_specialchars($row->link_url, 1); 
     284      $link_name = wp_specialchars($row->link_name, 1); 
    288285      $link_image = $row->link_image; 
    289286      $link_target = $row->link_target; 
    290287      $link_category = $row->link_category; 
    291       $link_description = htmlspecialchars($row->link_description); 
     288      $link_description = wp_specialchars($row->link_description); 
    292289      $link_visible = $row->link_visible; 
    293290      $link_rating = $row->link_rating; 
    294291      $link_rel = $row->link_rel; 
    295       $link_notes = htmlspecialchars($row->link_notes); 
    296       $link_rss_uri = htmlspecialchars($row->link_rss); 
    297     } 
     292      $link_notes = wp_specialchars($row->link_notes); 
     293      $link_rss_uri = wp_specialchars($row->link_rss); 
     294    } else { 
     295        die( __('Link not found.') );  
     296    } 
    298297 
    299298?> 
    …… 
    493492<p class="submit"><input type="submit" name="submit" value="<?php _e('Save Changes &raquo;') ?>" /> 
    494493          <input type="hidden" name="action" value="editlink" /> 
    495           <input type="hidden" name="link_id" value="<?php echo $link_id; ?>" /> 
    496           <input type="hidden" name="order_by" value="<?php echo $order_by ?>" /> 
    497           <input type="hidden" name="cat_id" value="<?php echo $cat_id ?>" /></p> 
     494          <input type="hidden" name="link_id" value="<?php echo (int) $link_id; ?>" /> 
     495          <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" /> 
     496          <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" /></p> 
    498497  </form>  
    499498</div> 
    …… 
    599598      if ($row->cat_id == $cat_id) 
    600599        echo " selected='selected'"; 
    601         echo ">".$row->cat_id.": ".htmlspecialchars($row->cat_name); 
     600        echo ">".$row->cat_id.": ".wp_specialchars($row->cat_name); 
    602601        if ($row->auto_toggle == 'Y') 
    603602            echo ' (auto toggle)'; 
    …… 
    631630    <input type="hidden" name="link_id" value="" /> 
    632631    <input type="hidden" name="action" value="" /> 
    633     <input type="hidden" name="order_by" value="<?php echo $order_by ?>" /> 
    634     <input type="hidden" name="cat_id" value="<?php echo $cat_id ?>" /> 
     632    <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" /> 
     633    <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" /> 
    635634  <table width="100%" cellpadding="3" cellspacing="3"> 
    636635    <tr> 
    …… 
    661660    if ($links) { 
    662661        foreach ($links as $link) { 
    663             $link->link_name = htmlspecialchars($link->link_name); 
    664             $link->link_category = htmlspecialchars($link->link_category); 
    665             $link->link_description = htmlspecialchars($link->link_description); 
    666             $link->link_url = htmlspecialchars($link->link_url); 
     662            $link->link_name = wp_specialchars($link->link_name); 
     663            $link->link_category = wp_specialchars($link->link_category); 
     664            $link->link_description = wp_specialchars($link->link_description); 
     665            $link->link_url = wp_specialchars($link->link_url); 
    667666            $short_url = str_replace('http://', '', $link->link_url); 
    668667            $short_url = str_replace('www.', '', $short_url); 
    …… 
    754753?> 
    755754 
    756  
    757  
    758755<?php include('admin-footer.php'); ?> 

  • trunk/wp-admin/options.php

    r1915 r1940  
    4949            if ($user_level >= $option->option_admin_level) { 
    5050                $old_val = $option->option_value; 
    51                 $new_val = $_POST[$option->option_name]; 
     51                $new_val = wp_specialchars($_POST[$option->option_name]); 
    5252                if (!$new_val) { 
    5353                    if (3 == $option->option_type) 
    …… 
    8989 
    9090foreach ($options as $option) : 
    91     $value = htmlspecialchars($option->option_value); 
     91    $value = wp_specialchars($option->option_value); 
    9292    echo " 
    9393<tr> 

  • trunk/wp-admin/plugin-editor.php

    r1897 r1940  
    6868        $f = fopen($real_file, 'r'); 
    6969        $content = fread($f, filesize($real_file)); 
    70         $content = htmlspecialchars($content); 
     70        $content = wp_specialchars($content); 
    7171    } 
    7272 

  • trunk/wp-admin/post.php

    r1917 r1940  
    657657        $default_post_cat = get_settings('default_category'); 
    658658 
    659         $content = htmlspecialchars($content); 
     659        $content = wp_specialchars($content); 
    660660        $content = apply_filters('default_content', $content); 
    661661        $edited_post_title = apply_filters('default_title', $edited_post_title); 
    …… 
    678678if ($is_NS4 || $is_gecko) { 
    679679?> 
    680 <a href="javascript:if(navigator.userAgent.indexOf('Safari') >= 0){Q=getSelection();}else{Q=document.selection?document.selection.createRange().text:document.getSelection();}void(window.open('<?php echo get_settings('siteurl') ?>/wp-admin/bookmarklet.php?text='+encodeURIComponent(Q)+'&amp;popupurl='+encodeURIComponent(location.href)+'&amp;popuptitle='+encodeURIComponent(document.title),'<?php _e('WordPress bookmarklet') ?>','scrollbars=yes,width=600,height=460,left=100,top=150,status=yes'));"><?php printf(__('Press It - %s'), htmlspecialchars(get_settings('blogname'))); ?></a>  
     680<a href="javascript:if(navigator.userAgent.indexOf('Safari') >= 0){Q=getSelection();}else{Q=document.selection?document.selection.createRange().text:document.getSelection();}void(window.open('<?php echo get_settings('siteurl') ?>/wp-admin/bookmarklet.php?text='+encodeURIComponent(Q)+'&amp;popupurl='+encodeURIComponent(location.href)+'&amp;popuptitle='+encodeURIComponent(document.title),'<?php _e('WordPress bookmarklet') ?>','scrollbars=yes,width=600,height=460,left=100,top=150,status=yes'));"><?php printf(__('Press It - %s'), wp_specialchars(get_settings('blogname'))); ?></a>  
    681681<?php 
    682682} else if ($is_winIE) { 

  • trunk/wp-admin/profile.php

    r1866 r1940  
    22require_once('admin.php'); 
    33 
    4 $title = "Profile"; 
     4$title = 'Profile'; 
    55$parent_file = 'profile.php'; 
    66 
    7 $wpvarstoreset = array('action','redirect','profile','user'); 
     7$wpvarstoreset = array('action', 'profile', 'user'); 
    88for ($i=0; $i<count($wpvarstoreset); $i += 1) { 
    99    $wpvar = $wpvarstoreset[$i]; 
    …… 
    6767    } 
    6868 
    69     $newuser_firstname = $_POST['newuser_firstname']; 
    70     $newuser_lastname = $_POST['newuser_lastname']; 
     69    $newuser_firstname = wp_specialchars($_POST['newuser_firstname']); 
     70    $newuser_lastname = wp_specialchars($_POST['newuser_lastname']); 
    7171    $newuser_nickname = $_POST['newuser_nickname']; 
    7272    $newuser_nicename = sanitize_title($newuser_nickname); 
    73     $newuser_icq = $_POST['newuser_icq']; 
    74     $newuser_aim = $_POST['newuser_aim']; 
    75     $newuser_msn = $_POST['newuser_msn']; 
    76     $newuser_yim = $_POST['newuser_yim']; 
    77     $newuser_email = $_POST['newuser_email']; 
    78     $newuser_url = $_POST['newuser_url']; 
     73    $newuser_icq = wp_specialchars($_POST['newuser_icq']); 
     74    $newuser_aim = wp_specialchars($_POST['newuser_aim']); 
     75    $newuser_msn = wp_specialchars($_POST['newuser_msn']); 
     76    $newuser_yim = wp_specialchars($_POST['newuser_yim']); 
     77    $newuser_email = wp_specialchars($_POST['newuser_email']); 
     78    $newuser_url = wp_specialchars($_POST['newuser_url')]; 
    7979    $newuser_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $newuser_url) ? $newuser_url : 'http://' . $newuser_url;  
    80     $newuser_idmode=$_POST['newuser_idmode']; 
     80    $newuser_idmode = wp_specialchars($_POST['newuser_idmode']); 
    8181    $user_description = $_POST['user_description']; 
    8282 

  • trunk/wp-admin/sidebar.php

    r1429 r1940  
    3131<head> 
    3232<title>WordPress &#8250; Sidebar</title> 
    33 <meta http-equiv="Content-Type" content="text/html; charset=<?php echo $blog_charset ?>" /> 
     33<meta http-equiv="Content-Type" content="text/html; charset=<?php bloginfo('blog_charset'); ?>" /> 
    3434<link rel="stylesheet" href="wp-admin.css" type="text/css" /> 
    3535<link rel="shortcut icon" href="../wp-images/wp-favicon.png" /> 

  • trunk/wp-admin/templates.php

    r1938 r1940  
    6464        $f = fopen($real_file, 'r'); 
    6565        $content = fread($f, filesize($real_file)); 
    66         $content = htmlspecialchars($content); 
     66        $content = wp_specialchars($content); 
    6767    } 
    6868 
    …… 
    7474<?php 
    7575if (is_writeable($real_file)) { 
    76     echo '<h2>' . sprintf(__('Editing <strong>%s</strong>'), $file) . '</h2>'; 
     76    echo '<h2>' . sprintf(__('Editing <strong>%s</strong>'), wp_specialchars($file) ) . '</h2>'; 
    7777} else { 
    78     echo '<h2>' . sprintf(__('Browsing <strong>%s</strong>'), $file) . '</h2>'; 
     78    echo '<h2>' . sprintf(__('Browsing <strong>%s</strong>'), wp_specialchars($file) ) . '</h2>'; 
    7979} 
    8080?> 

  • trunk/wp-admin/theme-editor.php

    r1881 r1940  
    7474        $f = fopen($real_file, 'r'); 
    7575        $content = fread($f, filesize($real_file)); 
    76         $content = htmlspecialchars($content); 
     76        $content = wp_specialchars($content); 
    7777    } 
    7878 

  • trunk/wp-admin/user-edit.php

    r1924 r1940  
    4646} 
    4747 
    48 $new_user_login  = $_POST['new_user_login']; 
    49 $new_firstname   = $_POST['new_firstname']; 
    50 $new_lastname    = $_POST['new_lastname']; 
     48$new_user_login  = wp_specialchars($_POST['new_user_login']); 
     49$new_firstname   = wp_specialchars($_POST['new_firstname']); 
     50$new_lastname    = wp_specialchars($_POST['new_lastname']); 
    5151$new_nickname    = $_POST['new_nickname']; 
    5252$new_nicename    = sanitize_title($new_nickname, $user_id); 
    53 $new_icq         = $_POST['new_icq']; 
    54 $new_aim         = $_POST['new_aim']; 
    55 $new_msn         = $_POST['new_msn']; 
    56 $new_yim         = $_POST['new_yim']; 
    57 $new_email       = $_POST['new_email']; 
    58 $new_url         = $_POST['new_url']; 
     53$new_icq         = wp_specialchars($_POST['new_icq']); 
     54$new_aim         = wp_specialchars($_POST['new_aim']); 
     55$new_msn         = wp_specialchars($_POST['new_msn']); 
     56$new_yim         = wp_specialchars($_POST['new_yim']); 
     57$new_email       = wp_specialchars($_POST['new_email']); 
     58$new_url         = wp_specialchars($_POST['new_url']); 
    5959$new_url         = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $new_url) ? $new_url : 'http://' . $new_url;  
    60 $new_idmode      = $_POST['new_idmode']; 
     60$new_idmode      = wp_specialchars($_POST['new_idmode']); 
    6161$new_description = $_POST['new_description']; 
    6262 
    …… 
    196196break; 
    197197} 
    198      
    199 /* </Team> */ 
     198 
    200199include('admin-footer.php'); 
    201200?> 

  • trunk/wp-admin/users.php

    r1902 r1940  
    55$parent_file = 'users.php'; 
    66     
    7 $wpvarstoreset = array('action','standalone','redirect','profile'); 
     7$wpvarstoreset = array('action'); 
    88for ($i=0; $i<count($wpvarstoreset); $i += 1) { 
    99    $wpvar = $wpvarstoreset[$i]; 
    …… 
    2525    check_admin_referer(); 
    2626 
    27     function filter($value) { 
    28         return ereg('^[a-zA-Z0-9\_-\|]+$',$value); 
    29     } 
    30  
    31     $user_login = $_POST['user_login']; 
    32     $pass1 = $_POST['pass1']; 
    33     $pass2 = $_POST['pass2']; 
    34     $user_email = $_POST['email']; 
    35     $user_firstname = $_POST['firstname']; 
    36     $user_lastname = $_POST['lastname']; 
    37     $user_uri = $_POST['uri']; 
     27    $user_login     = wp_specialchars($_POST['user_login']); 
     28    $pass1          = $_POST['pass1']; 
     29    $pass2          = $_POST['pass2']; 
     30    $user_email     = wp_specialchars($_POST['email']); 
     31    $user_firstname = wp_specialchars($_POST['firstname']); 
     32    $user_lastname  = wp_specialchars($_POST['lastname']); 
     33    $user_uri       = wp_specialchars($_POST['uri']); 
    3834         
    3935    /* checking login has been typed */ 
    …… 
    131127    check_admin_referer(); 
    132128 
    133     $id = intval($_GET['id']); 
     129    $id = (int) $_GET['id']; 
    134130 
    135131    if (!$id) { 
    …… 
    229225 
    230226<?php 
    231    $users = $wpdb->get_results("SELECT * FROM $wpdb->users WHERE user_level = 0 ORDER BY ID"); 
    232    if ($users) { 
     227$users = $wpdb->get_results("SELECT * FROM $wpdb->users WHERE user_level = 0 ORDER BY ID"); 
     228if ($users) { 
    233229?> 
    234230<div class="wrap"> 

  • trunk/wp-comments-popup.php

    r1855 r1940  
    6464       <label for="author"><?php _e("Name"); ?></label> 
    6565    <input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" /> 
    66     <input type="hidden" name="redirect_to" value="<?php echo htmlspecialchars($_SERVER["REQUEST_URI"]); ?>" /> 
     66    <input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER["REQUEST_URI"]); ?>" /> 
    6767    </p> 
    6868 

  • trunk/wp-comments.php

    r1855 r1940  
    4242       <label for="author"><?php _e('Name'); ?></label> <?php if ($req) _e('(required)'); ?> 
    4343    <input type="hidden" name="comment_post_ID" value="<?php echo $post->ID; ?>" /> 
    44     <input type="hidden" name="redirect_to" value="<?php echo htmlspecialchars($_SERVER['REQUEST_URI']); ?>" /> 
     44    <input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER['REQUEST_URI']); ?>" /> 
    4545    </p> 
    4646 

  • trunk/wp-includes/classes.php

    r1933 r1940  
    5858        $this->query = $query; 
    5959        $this->query_vars = $qv; 
     60        $qv['m'] =  (int) $qv['m']; 
    6061 
    6162        if ('' != $qv['name']) { 
    …… 
    7273        } 
    7374 
    74         if ('' != $qv['second']) { 
     75        if ( (int) $qv['second']) { 
    7576            $this->is_time = true; 
    7677            $this->is_date = true; 
    7778        } 
    7879 
    79         if ('' != $qv['minute']) { 
     80        if ( (int) $qv['minute']) { 
    8081            $this->is_time = true; 
    8182            $this->is_date = true; 
    8283        } 
    8384 
    84         if ('' != $qv['hour']) { 
     85        if ( (int) $qv['hour']) { 
    8586            $this->is_time = true; 
    86         $this->is_date = true; 
    87         } 
    88  
    89         if ('' != $qv['day']) { 
     87           $this->is_date = true; 
     88        } 
     89 
     90        if ( (int) $qv['day']) { 
    9091            if (! $this->is_date) { 
    9192                $this->is_day = true; 
    …… 
    9495        } 
    9596 
    96         if ('' != $qv['monthnum']) { 
     97        if ( (int) $qv['monthnum']) { 
    9798            if (! $this->is_date) { 
    9899                $this->is_month = true; 
    …… 
    101102        } 
    102103 
    103         if ('' != $qv['year']) { 
     104        if ( (int) $qv['year']) { 
    104105            if (! $this->is_date) { 
    105106                $this->is_year = true; 
    …… 
    108109        } 
    109110 
    110         if ('' != $qv['m']) { 
     111        if ( (int) $qv['m']) { 
    111112            $this->is_date = true; 
    112  
    113113            if (strlen($qv['m']) > 9) { 
    114           $this->is_time = true; 
    115         } else if (strlen($qv['m']) > 7) { 
    116           $this->is_day = true; 
    117         } else if (strlen($qv['m']) > 5) { 
    118           $this->is_month = true; 
    119         } else { 
    120           $this->is_year = true; 
    121         } 
     114               $this->is_time = true; 
     115           } else if (strlen($qv['m']) > 7) { 
     116               $this->is_day = true; 
     117           } else if (strlen($qv['m']) > 5) { 
     118               $this->is_month = true; 
     119           } else { 
     120               $this->is_year = true; 
     121           } 
    122122        } 
    123123 
    …… 
    233233 
    234234        // If a month is specified in the querystring, load that month 
    235         if ('' != $q['m']) { 
     235        if ( (int) $q['m'] ) { 
    236236            $q['m'] = '' . preg_replace('|[^0-9]|', '', $q['m']); 
    237237            $where .= ' AND YEAR(post_date)=' . substr($q['m'], 0, 4); 
    …… 
    248248        } 
    249249 
    250         if ('' != $q['hour']) { 
     250        if ( (int) $q['hour'] ) { 
    251251            $q['hour'] = '' . intval($q['hour']); 
    252252            $where .= " AND HOUR(post_date)='" . $q['hour'] . "'"; 
    253253        } 
    254254 
    255         if ('' != $q['minute']) { 
     255        if ( (int) $q['minute'] ) { 
    256256            $q['minute'] = '' . intval($q['minute']); 
    257257            $where .= " AND MINUTE(post_date)='" . $q['minute'] . "'"; 
    258258        } 
    259259 
    260         if ('' != $q['second']) { 
     260        if ( (int) $q['second'] ) { 
    261261            $q['second'] = '' . intval($q['second']); 
    262262            $where .= " AND SECOND(post_date)='" . $q['second'] . "'"; 
    263263        } 
    264264 
    265         if ('' != $q['year']) { 
     265        if ( (int) $q['year'] ) { 
    266266            $q['year'] = '' . intval($q['year']); 
    267267            $where .= " AND YEAR(post_date)='" . $q['year'] . "'"; 
    268268        } 
    269269 
    270         if ('' != $q['monthnum']) { 
     270        if ( (int) $q['monthnum'] ) { 
    271271            $q['monthnum'] = '' . intval($q['monthnum']); 
    272272