When customizing most titles, & is getting escaped twice
-
When customizing a block and giving it a title that contains an &, we get an ugly & on the page instead.
I looked through the code, and I’m totally unsurprised why: Very sadly found this in too many places to count:
$value = isset( $values[$key] ) ? esc_attr( $values[$key][0] ) : '';
$value = htmlspecialchars($value);Are you not aware that
esc_attrcontainshtmlspecialchars?
esc_attr -> _wp_specialchars
_wp_specialchars -> htmlspecialchars
-
Hey devs, just wanted to say thanks for starting to fix this issue! I saw in v2.8 that someone went through and resolved most of the issues with
class-job-single-view.php.With that said, I realized this issue was more widespread than just
class-job-single-view.php. It also applies toinclude/class-job-add-edit.phpwhich I didn’t see any changes for yet (I should’ve mentioned it sooner). I found that specifically if we add an & to the position title, after saving, it re-renders triple-escaped, meaning we get &. If we save again, this then actually applies to the position page, and it worsens each time.Again, I fixed this in my copy, but it doesn’t look like your code has fixed this yet. So, I’ll update and then apply my fix for this file, and see how it goes. EDIT: Worked fine after I applied my patch.
______________________________________________________________________________________
In general, though, to properly escape in WP plugins, you should follow these rules:
- Never escape anywhere except in the html directly. This ensures that double escaping never occurs, and also that lack of escaping never happens (which is in fact still true in some small places in the plugin). Your html strings therefore should be made up exclusively of:
- quoted literals,
esc_attrcalls, andesc_htmlcalls.- Only break this rule if it is absolutely necessary to inject strings containing html (which is generally very rare). In this case, it might be worth using a variable name convention to indicate a var that represents html.
esc_htmlshould always be used for escaping non-html contents within html (again, just don’t escape a string if it must contain html).- e.g.,
'<option ...>' . esc_html(...) . '</option>'
- e.g.,
esc_attrshould be used for escaping within attributes.- e.g.,
'<input value="' . esc_attr(...) . '">.
- e.g.,
______________________________________________________________________________________
There’s also a minor bug in
admin/script.jsthat occurs when I use text mode instead of tinymce (which I always do). On line 839 (or so?) we havetinymce.get(editor_id).getContent()buttinymce.get(editor_id)returns null if I’m in text mode. It seems to work fine if I just break it up and only continue if the editor exists.______________________________________________________________________________________
I would be more than willing to contribute, but I use github pretty much exclusively. I don’t see a github repo – just an SVN repo, and I’m not familiar with connecting github to an SVN repo..
Thanks again!
- Never escape anywhere except in the html directly. This ensures that double escaping never occurs, and also that lack of escaping never happens (which is in fact still true in some small places in the plugin). Your html strings therefore should be made up exclusively of:
The topic ‘When customizing most titles, & is getting escaped twice’ is closed to new replies.
