From f3419ea18192113ebfb66599c0c1332932045c9a Mon Sep 17 00:00:00 2001 From: Andrew Nacin Date: Sat, 25 Dec 2010 18:10:59 +0000 Subject: [PATCH] Revert [16995] due to the way the data enters the db. props garyc40, see #15454. git-svn-id: https://develop.svn.wordpress.org/trunk@17142 602fd350-edb4-49c9-b593-d223f7449a82 --- wp-includes/formatting.php | 12 ++++++------ wp-includes/user.php | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php index 718ad71a78..c0e4f14063 100644 --- a/wp-includes/formatting.php +++ b/wp-includes/formatting.php @@ -1114,8 +1114,8 @@ function force_balance_tags( $text ) { * Acts on text which is about to be edited. * * Unless $richedit is set, it is simply a holder for the 'format_to_edit' - * filter. If $richedit is set true htmlspecialchars() will be run on the - * content, converting special characters to HTMl entities. + * filter. If $richedit is set true htmlspecialchars(), through esc_textarea(), + * will be run on the content, converting special characters to HTML entities. * * @since 0.71 * @@ -1123,10 +1123,10 @@ function force_balance_tags( $text ) { * @param bool $richedit Whether the $content should pass through htmlspecialchars(). Default false. * @return string The text after the filter (and possibly htmlspecialchars()) has been run. */ -function format_to_edit($content, $richedit = false) { - $content = apply_filters('format_to_edit', $content); - if (! $richedit ) - $content = esc_textarea($content); +function format_to_edit( $content, $richedit = false ) { + $content = apply_filters( 'format_to_edit', $content ); + if ( ! $richedit ) + $content = esc_textarea( $content ); return $content; } diff --git a/wp-includes/user.php b/wp-includes/user.php index 2816b23db0..a13628467a 100644 --- a/wp-includes/user.php +++ b/wp-includes/user.php @@ -1202,7 +1202,7 @@ function sanitize_user_field($field, $value, $user_id, $context) { } if ( 'description' == $field ) - $value = esc_textarea( $value ); + $value = esc_html( $value ); // textarea_escaped? else $value = esc_attr($value); } else if ( 'db' == $context ) {