Changeset 61427

Timestamp:

01/03/2026 10:24:48 PM (3 months ago)

Author:

SergeyBiryukov

Message:

Bundled Themes: Consistently escape get_search_query() in search.php templates.

Props sabernhardt, himshekhar07, petitphp, karmatosed, SergeyBiryukov.
Fixes #58127.

Location:

trunk/src/wp-content/themes

Files:

• twentyeleven/search.php (modified) (1 diff)
• twentyfifteen/search.php (modified) (1 diff)
• twentyfourteen/search.php (modified) (1 diff)
• twentynineteen/search.php (modified) (1 diff)
• twentyseventeen/search.php (modified) (1 diff)
• twentysixteen/search.php (modified) (1 diff)
• twentyten/search.php (modified) (1 diff)
• twentythirteen/search.php (modified) (1 diff)
• twentytwelve/search.php (modified) (1 diff)
• twentytwenty/index.php (modified) (1 diff)
• twentytwentyone/search.php (modified) (1 diff)
• twentytwentyone/template-parts/content/content-none.php (modified) (1 diff)

trunk/src/wp-content/themes/twentyeleven/search.php

@@ -19 +19 @@
                     <?php
                     /* translators: %s: Search query. */
-                    printf( __( 'Search Results for: %s', 'twentyeleven' ), '<span>' . get_search_query() . '</span>' );
+                    printf( __( 'Search Results for: %s', 'twentyeleven' ), '<span>' . esc_html( get_search_query( false ) ) . '</span>' );
                     ?>
                     </h1>

trunk/src/wp-content/themes/twentyfifteen/search.php

@@ -19 +19 @@
                 <?php
                 /* translators: %s: Search query. */
-                printf( __( 'Search Results for: %s', 'twentyfifteen' ), get_search_query() );
+                printf( __( 'Search Results for: %s', 'twentyfifteen' ), esc_html( get_search_query( false ) ) );
                 ?>
                 </h1>

trunk/src/wp-content/themes/twentyfourteen/search.php

@@ -19 +19 @@
                 <?php
                 /* translators: %s: Search query. */
-                printf( __( 'Search Results for: %s', 'twentyfourteen' ), get_search_query() );
+                printf( __( 'Search Results for: %s', 'twentyfourteen' ), esc_html( get_search_query( false ) ) );
                 ?>
                 </h1>

trunk/src/wp-content/themes/twentynineteen/search.php

@@ -21 +21 @@
                 <h1 class="page-title">
                     <?php _e( 'Search results for: ', 'twentynineteen' ); ?>
-                    <span class="page-description"><?php echo get_search_query(); ?></span>
+                    <span class="page-description"><?php echo esc_html( get_search_query( false ) ); ?></span>
                 </h1>
             </header><!-- .page-header -->

trunk/src/wp-content/themes/twentyseventeen/search.php

@@ -20 +20 @@
             <?php
             /* translators: Search query. */
-            printf( __( 'Search Results for: %s', 'twentyseventeen' ), '<span>' . get_search_query() . '</span>' );
+            printf( __( 'Search Results for: %s', 'twentyseventeen' ), '<span>' . esc_html( get_search_query( false ) ) . '</span>' );
             ?>
             </h1>

trunk/src/wp-content/themes/twentysixteen/search.php

@@ -19 +19 @@
                 <?php
                 /* translators: %s: The search query. */
-                printf( __( 'Search Results for: %s', 'twentysixteen' ), '<span>' . esc_html( get_search_query() ) . '</span>' );
+                printf( __( 'Search Results for: %s', 'twentysixteen' ), '<span>' . esc_html( get_search_query( false ) ) . '</span>' );
                 ?>
                 </h1>

trunk/src/wp-content/themes/twentyten/search.php

@@ -17 +17 @@
                 <?php
                 /* translators: %s: Search query. */
-                printf( __( 'Search Results for: %s', 'twentyten' ), '<span>' . get_search_query() . '</span>' );
+                printf( __( 'Search Results for: %s', 'twentyten' ), '<span>' . esc_html( get_search_query( false ) ) . '</span>' );
                 ?>
                 </h1>

trunk/src/wp-content/themes/twentythirteen/search.php

@@ -19 +19 @@
                 <?php
                 /* translators: %s: Search query. */
-                printf( __( 'Search Results for: %s', 'twentythirteen' ), get_search_query() );
+                printf( __( 'Search Results for: %s', 'twentythirteen' ), esc_html( get_search_query( false ) ) );
                 ?>
                 </h1>

trunk/src/wp-content/themes/twentytwelve/search.php

@@ -19 +19 @@
                 <?php
                 /* translators: %s: Search query. */
-                printf( __( 'Search Results for: %s', 'twentytwelve' ), '<span>' . get_search_query() . '</span>' );
+                printf( __( 'Search Results for: %s', 'twentytwelve' ), '<span>' . esc_html( get_search_query( false ) ) . '</span>' );
                 ?>
                 </h1>

trunk/src/wp-content/themes/twentytwenty/index.php

@@ -32 +32 @@
 
         $archive_title = sprintf(
-            '%1$s %2$s',
+            '%1$s “%2$s”',
             '<span class="color-accent">' . __( 'Search:', 'twentytwenty' ) . '</span>',
-            '&ldquo;' . get_search_query() . '&rdquo;'
+            esc_html( get_search_query( false ) )
         );
 

trunk/src/wp-content/themes/twentytwentyone/search.php

@@ -20 +20 @@
                 /* translators: %s: Search term. */
                 esc_html__( 'Results for "%s"', 'twentytwentyone' ),
-                '<span class="page-description search-term">' . esc_html( get_search_query() ) . '</span>'
+                '<span class="page-description search-term">' . esc_html( get_search_query( false ) ) . '</span>'
             );
             ?>

trunk/src/wp-content/themes/twentytwentyone/template-parts/content/content-none.php

@@ -21 +21 @@
                     /* translators: %s: Search term. */
                     esc_html__( 'Results for "%s"', 'twentytwentyone' ),
-                    '<span class="page-description search-term">' . esc_html( get_search_query() ) . '</span>'
+                    '<span class="page-description search-term">' . esc_html( get_search_query( false ) ) . '</span>'
                 );
                 ?>