Ticket #7459: 7459-1.patch

src/bp-xprofile/bp-xprofile-filters.php

@@ -358 +358 @@
         }
 
         if ( strpos( $field_value, ',' ) !== false ) {
+                // Comma-separated lists.
                 $list_type = 'comma';
-                $values    = explode( ',', $field_value ); // Comma-separated lists.
+                $values    = explode( ',', $field_value );
         } else {
-                $list_type = 'semicolon';
-                $values = explode( ';', $field_value ); // Semicolon-separated lists.
+                /*
+                 * Semicolon-separated lists.
+                 *
+                 * bp_xprofile_escape_field_data() runs before this function, which often runs esc_html().
+                 * In turn, that encodes HTML entities in the string (";" becomes "'").
+                 *
+                 * Before splitting on the ";" character, decode the HTML entities, and re-encode after.
+                 * This prevents input like "O'Hara" rendering as "O' Hara" (with each of those parts
+                 * having a seperate HTML link).
+                 */
+                $list_type   = 'semicolon';
+                $field_value = wp_specialchars_decode( $field_value, ENT_QUOTES );
+                $values      = explode( ';', $field_value );
+
+                array_walk( $values, function( &$value, $key ) use ( $field_type, $field ) {
+                        $value = bp_xprofile_escape_field_data( $value, $field_type, $field->id );
+                } );
         }
 
         if ( ! empty( $values ) ) {