Changeset 7965 for trunk/bp-themes/bp-default/activity/post-form.php

Timestamp:

02/22/2014 03:50:03 PM (13 years ago)

Author:

djpaul

Message:

Improve string and textarea output escaping throughout BuddyPress.

File:

• trunk/bp-themes/bp-default/activity/post-form.php (modified) (1 diff)

trunk/bp-themes/bp-default/activity/post-form.php

@@ -28 +28 @@
         <div id="whats-new-content">
                 <div id="whats-new-textarea">
-                        <textarea name="whats-new" id="whats-new" cols="50" rows="10"><?php if ( isset( $_GET['r'] ) ) : ?>@<?php echo esc_attr( $_GET['r'] ); ?> <?php endif; ?></textarea>
+                        <textarea name="whats-new" id="whats-new" cols="50" rows="10"><?php if ( isset( $_GET['r'] ) ) : ?>@<?php echo esc_textarea( $_GET['r'] ); ?> <?php endif; ?></textarea>
                 </div>
 
                 <div id="whats-new-options">
                         <div id="whats-new-submit">
-                                <input type="submit" name="aw-whats-new-submit" id="aw-whats-new-submit" value="<?php _e( 'Post Update', 'buddypress' ); ?>" />
+                                <input type="submit" name="aw-whats-new-submit" id="aw-whats-new-submit" value="<?php esc_attr_e( 'Post Update', 'buddypress' ); ?>" />
                         </div>