From 6cbdd69a1e8e90f60d506f3ae87f768df2ecf094 Mon Sep 17 00:00:00 2001
From: Andrew Ozz <azaozz@git.wordpress.org>
Date: Sun, 15 Mar 2009 07:59:12 +0000
Subject: [PATCH] Fully escape Post/Page titles, props Viper007Bond, fixes
 #9322

git-svn-id: https://develop.svn.wordpress.org/trunk@10787 602fd350-edb4-49c9-b593-d223f7449a82
---
 wp-admin/edit-form-advanced.php | 2 +-
 wp-admin/edit-page-form.php     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/wp-admin/edit-form-advanced.php b/wp-admin/edit-form-advanced.php
index 1eb3365e2e..96c0f3f785 100644
--- a/wp-admin/edit-form-advanced.php
+++ b/wp-admin/edit-form-advanced.php
@@ -595,7 +595,7 @@ else
 <div id="post-body-content" class="has-sidebar-content">
 <div id="titlediv">
 <div id="titlewrap">
-	<input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape($post->post_title); ?>" id="title" autocomplete="off" />
+	<input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape( htmlspecialchars( $post->post_title ) ); ?>" id="title" autocomplete="off" />
 </div>
 <div class="inside">
 <?php $sample_permalink_html = get_sample_permalink_html($post->ID); ?>
diff --git a/wp-admin/edit-page-form.php b/wp-admin/edit-page-form.php
index 1050c2baae..5af9821a33 100644
--- a/wp-admin/edit-page-form.php
+++ b/wp-admin/edit-page-form.php
@@ -443,7 +443,7 @@ $side_meta_boxes = do_meta_boxes('page', 'side', $post);
 
 <div id="titlediv">
 <div id="titlewrap">
-  <input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape( $post->post_title ); ?>" id="title" autocomplete="off" />
+  <input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape( htmlspecialchars( $post->post_title ) ); ?>" id="title" autocomplete="off" />
 </div>
 <div class="inside">
 <?php $sample_permalink_html = get_sample_permalink_html($post->ID); ?>