<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><style type="text/css"><!--
#msg dl { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre, #msg p { overflow: auto; background: #ffc; border: 1px #fc0 solid; padding: 6px; }
#msg ul { overflow: auto; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<title>[11890] branches/2.8/wp-includes: Prophylactic escapes</title>
</head>
<body>

<div id="msg">
<dl>
<dt>Revision</dt> <dd><a href="http://trac.wordpress.org/changeset/11890">11890</a></dd>
<dt>Author</dt> <dd>ryan</dd>
<dt>Date</dt> <dd>2009-08-28 00:22:30 +0000 (Fri, 28 Aug 2009)</dd>
</dl>

<h3>Log Message</h3>
<pre>Prophylactic escapes</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branches28wpincludesauthortemplatephp">branches/2.8/wp-includes/author-template.php</a></li>
<li><a href="#branches28wpincludesbookmarktemplatephp">branches/2.8/wp-includes/bookmark-template.php</a></li>
<li><a href="#branches28wpincludescategorytemplatephp">branches/2.8/wp-includes/category-template.php</a></li>
<li><a href="#branches28wpincludescommenttemplatephp">branches/2.8/wp-includes/comment-template.php</a></li>
<li><a href="#branches28wpincludesgeneraltemplatephp">branches/2.8/wp-includes/general-template.php</a></li>
<li><a href="#branches28wpincludesmediaphp">branches/2.8/wp-includes/media.php</a></li>
<li><a href="#branches28wpincludesposttemplatephp">branches/2.8/wp-includes/post-template.php</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branches28wpincludesauthortemplatephp"></a>
<div class="modfile"><h4>Modified: branches/2.8/wp-includes/author-template.php (11889 => 11890)</h4>
<pre class="diff"><span>
<span class="info">--- branches/2.8/wp-includes/author-template.php        2009-08-28 00:21:42 UTC (rev 11889)
+++ branches/2.8/wp-includes/author-template.php        2009-08-28 00:22:30 UTC (rev 11890)
</span><span class="lines">@@ -132,7 +132,7 @@
</span><span class="cx">  */
</span><span class="cx"> function the_author_link() {
</span><span class="cx">         if ( get_the_author_meta('url') ) {
</span><del>-                echo '&lt;a href=&quot;' . get_the_author_meta('url') . '&quot; title=&quot;' . sprintf(__(&quot;Visit %s&amp;#8217;s website&quot;), get_the_author()) . '&quot; rel=&quot;external&quot;&gt;' . get_the_author() . '&lt;/a&gt;';
</del><ins>+                echo '&lt;a href=&quot;' . get_the_author_meta('url') . '&quot; title=&quot;' . esc_attr( sprintf(__(&quot;Visit %s&amp;#8217;s website&quot;), get_the_author()) ) . '&quot; rel=&quot;external&quot;&gt;' . get_the_author() . '&lt;/a&gt;';
</ins><span class="cx">         } else {
</span><span class="cx">                 the_author();
</span><span class="cx">         }
</span><span class="lines">@@ -181,7 +181,7 @@
</span><span class="cx">         printf(
</span><span class="cx">                 '&lt;a href=&quot;%1$s&quot; title=&quot;%2$s&quot;&gt;%3$s&lt;/a&gt;',
</span><span class="cx">                 get_author_posts_url( $authordata-&gt;ID, $authordata-&gt;user_nicename ),
</span><del>-                sprintf( __( 'Posts by %s' ), esc_attr( get_the_author() ) ),
</del><ins>+                esc_attr( sprintf( __( 'Posts by %s' ), get_the_author() ) ),
</ins><span class="cx">                 get_the_author()
</span><span class="cx">         );
</span><span class="cx"> }
</span><span class="lines">@@ -292,7 +292,7 @@
</span><span class="cx">                         if ( ! $hide_empty )
</span><span class="cx">                                 $link = $name;
</span><span class="cx">                 } else {
</span><del>-                        $link = '&lt;a href=&quot;' . get_author_posts_url($author-&gt;ID, $author-&gt;user_nicename) . '&quot; title=&quot;' . sprintf(__(&quot;Posts by %s&quot;), esc_attr($author-&gt;display_name)) . '&quot;&gt;' . $name . '&lt;/a&gt;';
</del><ins>+                        $link = '&lt;a href=&quot;' . get_author_posts_url($author-&gt;ID, $author-&gt;user_nicename) . '&quot; title=&quot;' . esc_attr( sprintf(__(&quot;Posts by %s&quot;), $author-&gt;display_name) ) . '&quot;&gt;' . $name . '&lt;/a&gt;';
</ins><span class="cx"> 
</span><span class="cx">                         if ( (! empty($feed_image)) || (! empty($feed)) ) {
</span><span class="cx">                                 $link .= ' ';
</span><span class="lines">@@ -301,8 +301,8 @@
</span><span class="cx">                                 $link .= '&lt;a href=&quot;' . get_author_feed_link($author-&gt;ID) . '&quot;';
</span><span class="cx"> 
</span><span class="cx">                                 if ( !empty($feed) ) {
</span><del>-                                        $title = ' title=&quot;' . $feed . '&quot;';
-                                        $alt = ' alt=&quot;' . $feed . '&quot;';
</del><ins>+                                        $title = ' title=&quot;' . esc_attr($feed) . '&quot;';
+                                        $alt = ' alt=&quot;' . esc_attr($feed) . '&quot;';
</ins><span class="cx">                                         $name = $feed;
</span><span class="cx">                                         $link .= $title;
</span><span class="cx">                                 }
</span><span class="lines">@@ -310,7 +310,7 @@
</span><span class="cx">                                 $link .= '&gt;';
</span><span class="cx"> 
</span><span class="cx">                                 if ( !empty($feed_image) )
</span><del>-                                        $link .= &quot;&lt;img src=\&quot;$feed_image\&quot; style=\&quot;border: none;\&quot;$alt$title&quot; . ' /&gt;';
</del><ins>+                                        $link .= &quot;&lt;img src=\&quot;&quot; . esc_url($feed_image) . &quot;\&quot; style=\&quot;border: none;\&quot;$alt$title&quot; . ' /&gt;';
</ins><span class="cx">                                 else
</span><span class="cx">                                         $link .= $name;
</span><span class="cx"> 
</span></span></pre></div>
<a id="branches28wpincludesbookmarktemplatephp"></a>
<div class="modfile"><h4>Modified: branches/2.8/wp-includes/bookmark-template.php (11889 => 11890)</h4>
<pre class="diff"><span>
<span class="info">--- branches/2.8/wp-includes/bookmark-template.php        2009-08-28 00:21:42 UTC (rev 11889)
+++ branches/2.8/wp-includes/bookmark-template.php        2009-08-28 00:22:30 UTC (rev 11890)
</span><span class="lines">@@ -90,7 +90,7 @@
</span><span class="cx"> 
</span><span class="cx">                 $rel = $bookmark-&gt;link_rel;
</span><span class="cx">                 if ( '' != $rel )
</span><del>-                        $rel = ' rel=&quot;' . $rel . '&quot;';
</del><ins>+                        $rel = ' rel=&quot;' . esc_attr($rel) . '&quot;';
</ins><span class="cx"> 
</span><span class="cx">                 $target = $bookmark-&gt;link_target;
</span><span class="cx">                 if ( '' != $target )
</span></span></pre></div>
<a id="branches28wpincludescategorytemplatephp"></a>
<div class="modfile"><h4>Modified: branches/2.8/wp-includes/category-template.php (11889 => 11890)</h4>
<pre class="diff"><span>
<span class="info">--- branches/2.8/wp-includes/category-template.php        2009-08-28 00:21:42 UTC (rev 11889)
+++ branches/2.8/wp-includes/category-template.php        2009-08-28 00:22:30 UTC (rev 11890)
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         if ( $link )
</span><del>-                $chain .= '&lt;a href=&quot;' . get_category_link( $parent-&gt;term_id ) . '&quot; title=&quot;' . sprintf( __( &quot;View all posts in %s&quot; ), $parent-&gt;cat_name ) . '&quot;&gt;'.$name.'&lt;/a&gt;' . $separator;
</del><ins>+                $chain .= '&lt;a href=&quot;' . get_category_link( $parent-&gt;term_id ) . '&quot; title=&quot;' . esc_attr( sprintf( __( &quot;View all posts in %s&quot; ), $parent-&gt;cat_name ) ) . '&quot;&gt;'.$name.'&lt;/a&gt;' . $separator;
</ins><span class="cx">         else
</span><span class="cx">                 $chain .= $name.$separator;
</span><span class="cx">         return $chain;
</span><span class="lines">@@ -190,17 +190,17 @@
</span><span class="cx">                                 case 'multiple':
</span><span class="cx">                                         if ( $category-&gt;parent )
</span><span class="cx">                                                 $thelist .= get_category_parents( $category-&gt;parent, true, $separator );
</span><del>-                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) . '&quot; ' . $rel . '&gt;' . $category-&gt;name.'&lt;/a&gt;&lt;/li&gt;';
</del><ins>+                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . esc_attr( sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) ) . '&quot; ' . $rel . '&gt;' . $category-&gt;name.'&lt;/a&gt;&lt;/li&gt;';
</ins><span class="cx">                                         break;
</span><span class="cx">                                 case 'single':
</span><del>-                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) . '&quot; ' . $rel . '&gt;';
</del><ins>+                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . esc_attr( sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) ) . '&quot; ' . $rel . '&gt;';
</ins><span class="cx">                                         if ( $category-&gt;parent )
</span><span class="cx">                                                 $thelist .= get_category_parents( $category-&gt;parent, false, $separator );
</span><span class="cx">                                         $thelist .= $category-&gt;name.'&lt;/a&gt;&lt;/li&gt;';
</span><span class="cx">                                         break;
</span><span class="cx">                                 case '':
</span><span class="cx">                                 default:
</span><del>-                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) . '&quot; ' . $rel . '&gt;' . $category-&gt;cat_name.'&lt;/a&gt;&lt;/li&gt;';
</del><ins>+                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . esc_attr( sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) ) . '&quot; ' . $rel . '&gt;' . $category-&gt;cat_name.'&lt;/a&gt;&lt;/li&gt;';
</ins><span class="cx">                         }
</span><span class="cx">                 }
</span><span class="cx">                 $thelist .= '&lt;/ul&gt;';
</span><span class="lines">@@ -213,17 +213,17 @@
</span><span class="cx">                                 case 'multiple':
</span><span class="cx">                                         if ( $category-&gt;parent )
</span><span class="cx">                                                 $thelist .= get_category_parents( $category-&gt;parent, true, $separator );
</span><del>-                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) . '&quot; ' . $rel . '&gt;' . $category-&gt;cat_name.'&lt;/a&gt;';
</del><ins>+                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . esc_attr( sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) ) . '&quot; ' . $rel . '&gt;' . $category-&gt;cat_name.'&lt;/a&gt;';
</ins><span class="cx">                                         break;
</span><span class="cx">                                 case 'single':
</span><del>-                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) . '&quot; ' . $rel . '&gt;';
</del><ins>+                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . esc_attr( sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) ) . '&quot; ' . $rel . '&gt;';
</ins><span class="cx">                                         if ( $category-&gt;parent )
</span><span class="cx">                                                 $thelist .= get_category_parents( $category-&gt;parent, false, $separator );
</span><span class="cx">                                         $thelist .= &quot;$category-&gt;cat_name&lt;/a&gt;&quot;;
</span><span class="cx">                                         break;
</span><span class="cx">                                 case '':
</span><span class="cx">                                 default:
</span><del>-                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) . '&quot; ' . $rel . '&gt;' . $category-&gt;name.'&lt;/a&gt;';
</del><ins>+                                        $thelist .= '&lt;a href=&quot;' . get_category_link( $category-&gt;term_id ) . '&quot; title=&quot;' . esc_attr( sprintf( __( &quot;View all posts in %s&quot; ), $category-&gt;name ) ) . '&quot; ' . $rel . '&gt;' . $category-&gt;name.'&lt;/a&gt;';
</ins><span class="cx">                         }
</span><span class="cx">                         ++$i;
</span><span class="cx">                 }
</span><span class="lines">@@ -352,6 +352,8 @@
</span><span class="cx">                 $tab_index_attribute = &quot; tabindex=\&quot;$tab_index\&quot;&quot;;
</span><span class="cx"> 
</span><span class="cx">         $categories = get_categories( $r );
</span><ins>+        $name = esc_attr($name);
+        $class = esc_attr($class);
</ins><span class="cx"> 
</span><span class="cx">         $output = '';
</span><span class="cx">         if ( ! empty( $categories ) ) {
</span></span></pre></div>
<a id="branches28wpincludescommenttemplatephp"></a>
<div class="modfile"><h4>Modified: branches/2.8/wp-includes/comment-template.php (11889 => 11890)</h4>
<pre class="diff"><span>
<span class="info">--- branches/2.8/wp-includes/comment-template.php        2009-08-28 00:21:42 UTC (rev 11889)
+++ branches/2.8/wp-includes/comment-template.php        2009-08-28 00:22:30 UTC (rev 11890)
</span><span class="lines">@@ -338,6 +338,8 @@
</span><span class="cx">                 $classes = array_merge($classes, $class);
</span><span class="cx">         }
</span><span class="cx"> 
</span><ins>+        $classes = array_map('esc_attr', $classes);
+
</ins><span class="cx">         return apply_filters('comment_class', $classes, $class, $comment_id, $post_id);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -940,7 +942,7 @@
</span><span class="cx">         $number = get_comments_number( $id );
</span><span class="cx"> 
</span><span class="cx">         if ( 0 == $number &amp;&amp; !comments_open() &amp;&amp; !pings_open() ) {
</span><del>-                echo '&lt;span' . ((!empty($css_class)) ? ' class=&quot;' . $css_class . '&quot;' : '') . '&gt;' . $none . '&lt;/span&gt;';
</del><ins>+                echo '&lt;span' . ((!empty($css_class)) ? ' class=&quot;' . esc_attr( $css_class ) . '&quot;' : '') . '&gt;' . $none . '&lt;/span&gt;';
</ins><span class="cx">                 return;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -972,7 +974,7 @@
</span><span class="cx"> 
</span><span class="cx">         echo apply_filters( 'comments_popup_link_attributes', '' );
</span><span class="cx"> 
</span><del>-        echo ' title=&quot;' . sprintf( __('Comment on %s'), $title ) . '&quot;&gt;';
</del><ins>+        echo ' title=&quot;' . esc_attr( sprintf( __('Comment on %s'), $title ) ) . '&quot;&gt;';
</ins><span class="cx">         comments_number( $zero, $one, $more, $number );
</span><span class="cx">         echo '&lt;/a&gt;';
</span><span class="cx"> }
</span></span></pre></div>
<a id="branches28wpincludesgeneraltemplatephp"></a>
<div class="modfile"><h4>Modified: branches/2.8/wp-includes/general-template.php (11889 => 11890)</h4>
<pre class="diff"><span>
<span class="info">--- branches/2.8/wp-includes/general-template.php        2009-08-28 00:21:42 UTC (rev 11889)
+++ branches/2.8/wp-includes/general-template.php        2009-08-28 00:22:30 UTC (rev 11890)
</span><span class="lines">@@ -1023,7 +1023,7 @@
</span><span class="cx"> 
</span><span class="cx">         /* translators: Calendar caption: 1: month name, 2: 4-digit year */
</span><span class="cx">         $calendar_caption = _x('%1$s %2$s', 'calendar caption');
</span><del>-        echo '&lt;table id=&quot;wp-calendar&quot; summary=&quot;' . __('Calendar') . '&quot;&gt;
</del><ins>+        echo '&lt;table id=&quot;wp-calendar&quot; summary=&quot;' . esc_attr__('Calendar') . '&quot;&gt;
</ins><span class="cx">         &lt;caption&gt;' . sprintf($calendar_caption, $wp_locale-&gt;get_month($thismonth), date('Y', $unixmonth)) . '&lt;/caption&gt;
</span><span class="cx">         &lt;thead&gt;
</span><span class="cx">         &lt;tr&gt;';
</span><span class="lines">@@ -1036,6 +1036,7 @@
</span><span class="cx"> 
</span><span class="cx">         foreach ( $myweek as $wd ) {
</span><span class="cx">                 $day_name = (true == $initial) ? $wp_locale-&gt;get_weekday_initial($wd) : $wp_locale-&gt;get_weekday_abbrev($wd);
</span><ins>+                $wd = esc_attr($wd);
</ins><span class="cx">                 echo &quot;\n\t\t&lt;th abbr=\&quot;$wd\&quot; scope=\&quot;col\&quot; title=\&quot;$wd\&quot;&gt;$day_name&lt;/th&gt;&quot;;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -1058,8 +1059,8 @@
</span><span class="cx"> 
</span><span class="cx">         if ( $next ) {
</span><span class="cx">                 echo &quot;\n\t\t&quot;.'&lt;td abbr=&quot;' . $wp_locale-&gt;get_month($next-&gt;month) . '&quot; colspan=&quot;3&quot; id=&quot;next&quot;&gt;&lt;a href=&quot;' .
</span><del>-                get_month_link($next-&gt;year, $next-&gt;month) . '&quot; title=&quot;' . sprintf(__('View posts for %1$s %2$s'), $wp_locale-&gt;get_month($next-&gt;month),
-                        date('Y', mktime(0, 0 , 0, $next-&gt;month, 1, $next-&gt;year))) . '&quot;&gt;' . $wp_locale-&gt;get_month_abbrev($wp_locale-&gt;get_month($next-&gt;month)) . ' &amp;raquo;&lt;/a&gt;&lt;/td&gt;';
</del><ins>+                get_month_link($next-&gt;year, $next-&gt;month) . '&quot; title=&quot;' . esc_attr( sprintf(__('View posts for %1$s %2$s'), $wp_locale-&gt;get_month($next-&gt;month) ,
+                        date('Y', mktime(0, 0 , 0, $next-&gt;month, 1, $next-&gt;year))) ) . '&quot;&gt;' . $wp_locale-&gt;get_month_abbrev($wp_locale-&gt;get_month($next-&gt;month)) . ' &amp;raquo;&lt;/a&gt;&lt;/td&gt;';
</ins><span class="cx">         } else {
</span><span class="cx">                 echo &quot;\n\t\t&quot;.'&lt;td colspan=&quot;3&quot; id=&quot;next&quot; class=&quot;pad&quot;&gt;&amp;nbsp;&lt;/td&gt;';
</span><span class="cx">         }
</span><span class="lines">@@ -1116,7 +1117,7 @@
</span><span class="cx">         // See how much we should pad in the beginning
</span><span class="cx">         $pad = calendar_week_mod(date('w', $unixmonth)-$week_begins);
</span><span class="cx">         if ( 0 != $pad )
</span><del>-                echo &quot;\n\t\t&quot;.'&lt;td colspan=&quot;'.$pad.'&quot; class=&quot;pad&quot;&gt;&amp;nbsp;&lt;/td&gt;';
</del><ins>+                echo &quot;\n\t\t&quot;.'&lt;td colspan=&quot;'. esc_attr($pad) .'&quot; class=&quot;pad&quot;&gt;&amp;nbsp;&lt;/td&gt;';
</ins><span class="cx"> 
</span><span class="cx">         $daysinmonth = intval(date('t', $unixmonth));
</span><span class="cx">         for ( $day = 1; $day &lt;= $daysinmonth; ++$day ) {
</span><span class="lines">@@ -1130,7 +1131,7 @@
</span><span class="cx">                         echo '&lt;td&gt;';
</span><span class="cx"> 
</span><span class="cx">                 if ( in_array($day, $daywithpost) ) // any posts today?
</span><del>-                                echo '&lt;a href=&quot;' . get_day_link($thisyear, $thismonth, $day) . &quot;\&quot; title=\&quot;$ak_titles_for_day[$day]\&quot;&gt;$day&lt;/a&gt;&quot;;
</del><ins>+                                echo '&lt;a href=&quot;' . get_day_link($thisyear, $thismonth, $day) . &quot;\&quot; title=\&quot;&quot; . esc_attr($ak_titles_for_day[$day]) . &quot;\&quot;&gt;$day&lt;/a&gt;&quot;;
</ins><span class="cx">                 else
</span><span class="cx">                         echo $day;
</span><span class="cx">                 echo '&lt;/td&gt;';
</span><span class="lines">@@ -1141,7 +1142,7 @@
</span><span class="cx"> 
</span><span class="cx">         $pad = 7 - calendar_week_mod(date('w', mktime(0, 0 , 0, $thismonth, $day, $thisyear))-$week_begins);
</span><span class="cx">         if ( $pad != 0 &amp;&amp; $pad != 7 )
</span><del>-                echo &quot;\n\t\t&quot;.'&lt;td class=&quot;pad&quot; colspan=&quot;'.$pad.'&quot;&gt;&amp;nbsp;&lt;/td&gt;';
</del><ins>+                echo &quot;\n\t\t&quot;.'&lt;td class=&quot;pad&quot; colspan=&quot;'. esc_attr($pad) .'&quot;&gt;&amp;nbsp;&lt;/td&gt;';
</ins><span class="cx"> 
</span><span class="cx">         echo &quot;\n\t&lt;/tr&gt;\n\t&lt;/tbody&gt;\n\t&lt;/table&gt;&quot;;
</span><span class="cx"> 
</span></span></pre></div>
<a id="branches28wpincludesmediaphp"></a>
<div class="modfile"><h4>Modified: branches/2.8/wp-includes/media.php (11889 => 11890)</h4>
<pre class="diff"><span>
<span class="info">--- branches/2.8/wp-includes/media.php        2009-08-28 00:21:42 UTC (rev 11889)
+++ branches/2.8/wp-includes/media.php        2009-08-28 00:22:30 UTC (rev 11890)
</span><span class="lines">@@ -591,9 +591,9 @@
</span><span class="cx">         if ( 1 &gt; (int) $width || empty($caption) )
</span><span class="cx">                 return $content;
</span><span class="cx"> 
</span><del>-        if ( $id ) $id = 'id=&quot;' . $id . '&quot; ';
</del><ins>+        if ( $id ) $id = 'id=&quot;' . esc_attr($id) . '&quot; ';
</ins><span class="cx"> 
</span><del>-        return '&lt;div ' . $id . 'class=&quot;wp-caption ' . $align . '&quot; style=&quot;width: ' . (10 + (int) $width) . 'px&quot;&gt;'
</del><ins>+        return '&lt;div ' . $id . 'class=&quot;wp-caption ' . esc_attr($align) . '&quot; style=&quot;width: ' . (10 + (int) $width) . 'px&quot;&gt;'
</ins><span class="cx">         . do_shortcode( $content ) . '&lt;p class=&quot;wp-caption-text&quot;&gt;' . $caption . '&lt;/p&gt;&lt;/div&gt;';
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branches28wpincludesposttemplatephp"></a>
<div class="modfile"><h4>Modified: branches/2.8/wp-includes/post-template.php (11889 => 11890)</h4>
<pre class="diff"><span>
<span class="info">--- branches/2.8/wp-includes/post-template.php        2009-08-28 00:21:42 UTC (rev 11889)
+++ branches/2.8/wp-includes/post-template.php        2009-08-28 00:22:30 UTC (rev 11890)
</span><span class="lines">@@ -342,6 +342,8 @@
</span><span class="cx">                 $classes = array_merge($classes, $class);
</span><span class="cx">         }
</span><span class="cx"> 
</span><ins>+        $classes = array_map('esc_attr', $classes);
+
</ins><span class="cx">         return apply_filters('post_class', $classes, $class, $post_id);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -478,6 +480,8 @@
</span><span class="cx">                 $classes = array_merge($classes, $class);
</span><span class="cx">         }
</span><span class="cx"> 
</span><ins>+        $classes = array_map('esc_attr', $classes);
+
</ins><span class="cx">         return apply_filters('body_class', $classes, $class);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -706,6 +710,7 @@
</span><span class="cx"> 
</span><span class="cx">         $pages = get_pages($r);
</span><span class="cx">         $output = '';
</span><ins>+        $name = esc_attr($name);
</ins><span class="cx"> 
</span><span class="cx">         if ( ! empty($pages) ) {
</span><span class="cx">                 $output = &quot;&lt;select name=\&quot;$name\&quot; id=\&quot;$name\&quot;&gt;\n&quot;;
</span><span class="lines">@@ -842,7 +847,7 @@
</span><span class="cx">         if ( $menu )
</span><span class="cx">                 $menu = '&lt;ul&gt;' . $menu . '&lt;/ul&gt;';
</span><span class="cx"> 
</span><del>-        $menu = '&lt;div class=&quot;' . $args['menu_class'] . '&quot;&gt;' . $menu . &quot;&lt;/div&gt;\n&quot;;
</del><ins>+        $menu = '&lt;div class=&quot;' . esc_attr($args['menu_class']) . '&quot;&gt;' . $menu . &quot;&lt;/div&gt;\n&quot;;
</ins><span class="cx">         $menu = apply_filters( 'wp_page_menu', $menu, $args );
</span><span class="cx">         if ( $args['echo'] )
</span><span class="cx">                 echo $menu;
</span></span></pre>
</div>
</div>

</body>
</html>