Fix Email Escaping Bug in WordPress Notifications

Overview

This pull request fixes a critical bug where WordPress was incorrectly escaping special characters (like apostrophes) in email addresses for certain notifications, resulting in malformed email addresses with backslashes (e.g., o\'connor@example.com instead of o'connor@example.com).

This addresses the inconsistent email handling where some notifications worked correctly while others failed validation or delivery for email addresses containing special characters.

Trac Ticket: #54416

Issue Fixed

Email Addresses With Special Characters Show Backslashes in Notifications

• Problem:
  Email addresses containing special characters (apostrophes, quotes, etc.) were being escaped in certain WordPress notifications:

  • Email change confirmations: Used slashed $_POST['email'] data directly
  • Email change notifications: Used slashed $user['user_email'] data directly
  • Password change notifications: Used slashed $user['user_email'] data directly
  • Result: Recipients received emails with backslashes (o\'connor@example.com) or emails failed validation entirely

• Root Cause:
  WordPress's add_magic_quotes() function adds slashes to all $_POST data and user arrays, but the affected email functions were using this slashed data directly without calling wp_unslash() first.

• Solution:
  Applied wp_unslash() to all email address usages in the affected functions to ensure clean, properly formatted email addresses in all notifications.

Code Changes

1. Email Change Confirmation (send_confirmation_on_profile_email)

// Before (buggy)
if ( ! is_email( $_POST['email'] ) ) {
    // Email validation fails for addresses with apostrophes
}
wp_mail( $_POST['email'], $subject, $content );
// Sends to: o\'connor@example.com

// After (fixed)
if ( ! is_email( wp_unslash( $_POST['email'] ) ) ) {
    // Email validation works correctly
}
wp_mail( wp_unslash( $_POST['email'] ), $subject, $content );
// Sends to: o'connor@example.com

2. Email Change Notification (wp_update_user)

// Before (buggy)
$email_change_email = array(
    'to' => $user['user_email'], // Contains backslashes
);
$content = str_replace( '###EMAIL###', $user['user_email'], $content );
// Results in: o\'connor@example.com

// After (fixed)
$email_change_email = array(
    'to' => wp_unslash( $user['user_email'] ), // Clean email
);
$content = str_replace( '###EMAIL###', wp_unslash( $user['user_email'] ), $content );
// Results in: o'connor@example.com

3. Password Change Notification (wp_update_user)

// Before (buggy)
$pass_change_email = array(
    'to' => $user['user_email'], // Contains backslashes
);
$content = str_replace( '###EMAIL###', $user['user_email'], $content );
// Results in: o\'connor@example.com

// After (fixed)
$pass_change_email = array(
    'to' => wp_unslash( $user['user_email'] ), // Clean email
);
$content = str_replace( '###EMAIL###', wp_unslash( $user['user_email'] ), $content );
// Results in: o'connor@example.com

Testing Instructions

Test Case 1: Email Change Confirmation

1. Create a user account with a normal email address (e.g., user@example.com)
2. Log in and go to Profile → Account Management
3. Change email to one with an apostrophe (e.g., o'connor@example.com)
4. Click Update Profile
5. Expected:
   • Email validation should pass (no error message)
   • Confirmation email should be sent to o'connor@example.com (without backslashes)
   • Email content should display o'connor@example.com (without backslashes)

Test Case 2: Email Change Notification

1. Complete the email change confirmation process from Test Case 1
2. Click the confirmation link in the email
3. Expected:
   • Notification email should be sent to the OLD email address (user@example.com)
   • Email content should mention the new email as o'connor@example.com (without backslashes)
   • Email should be properly delivered and readable

Test Case 3: Password Change Notification

1. Create or use a user account with an email containing special characters (e.g., user's.email@example.com)
2. Change the user's password (either through profile or admin)
3. Expected:
   • Password change notification should be sent to user's.email@example.com (without backslashes)
   • Email content should display user's.email@example.com (without backslashes)
   • Email should be properly delivered and readable