[wp-trac] [WordPress Trac] #57133: $type should be escaping in 'user-new.php'

[WordPress Trac]

#57133: $type should be escaping in 'user-new.php'
-------------------------------------+-------------------------------------
 Reporter:  monzuralam               |       Owner:  (none)
     Type:  defect (bug)             |      Status:  new
 Priority:  normal                   |   Milestone:  Awaiting Review
Component:  Users                    |     Version:  trunk
 Severity:  normal                   |  Resolution:
 Keywords:  has-patch close 2nd-     |     Focuses:  administration,
  opinion                            |  coding-standards
-------------------------------------+-------------------------------------
Changes (by SergeyBiryukov):

 * keywords:  has-patch => has-patch close 2nd-opinion


Comment:

 Hi there, welcome back to WordPress Trac! Thanks for the ticket and the
 PR.

 I don't see why these values should be escaped:
 * `$type` is a [source:tags/6.1.1/src/wp-admin/user-
 new.php?marks=422,423,426,427,445,446#L416 hardcoded value] of either
 `email` or `text`, not a user-supplied value, so escaping is redundant.
 * `$label` is a translatable string. Core translations are considered safe
 because we have a review process for them, see #42639 and the discussion
 in #30724. (Also related: #32233, #44637.)

 In WordPress core and older bundled themes, strings are generally only
 escaped in attributes or in `<option>` tags. However, this was recently
 reconsidered for newer bundled themes, see comment:5:ticket:54127.

 Some other related tickets: #47384, #47385, #49535, #49536, #49537,
 #56110.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/57133#comment:4>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform