From e376455b1778310b1aa74b1b4a8956f2a83fc143 Mon Sep 17 00:00:00 2001 From: Andrew Nacin Date: Wed, 6 Apr 2011 21:28:52 +0000 Subject: [PATCH] Make underscores valid in sanitize_html_class. fixes #17067. git-svn-id: https://develop.svn.wordpress.org/trunk@17614 602fd350-edb4-49c9-b593-d223f7449a82 --- wp-includes/formatting.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php index c4f53e9c97..4b190c0669 100644 --- a/wp-includes/formatting.php +++ b/wp-includes/formatting.php @@ -876,7 +876,7 @@ function sanitize_sql_orderby( $orderby ){ /** * Santizes a html classname to ensure it only contains valid characters * - * Strips the string down to A-Z,a-z,0-9,'-' if this results in an empty + * Strips the string down to A-Z,a-z,0-9,_,-. If this results in an empty * string then it will return the alternative value supplied. * * @todo Expand to support the full range of CDATA that a class attribute can contain. @@ -890,10 +890,10 @@ function sanitize_sql_orderby( $orderby ){ */ function sanitize_html_class( $class, $fallback = '' ) { //Strip out any % encoded octets - $sanitized = preg_replace('|%[a-fA-F0-9][a-fA-F0-9]|', '', $class); + $sanitized = preg_replace( '|%[a-fA-F0-9][a-fA-F0-9]|', '', $class ); - //Limit to A-Z,a-z,0-9,'-' - $sanitized = preg_replace('/[^A-Za-z0-9-]/', '', $sanitized); + //Limit to A-Z,a-z,0-9,_,- + $sanitized = preg_replace( '/[^A-Za-z0-9_-]/', '', $sanitized ); if ( '' == $sanitized ) $sanitized = $fallback;