[wp-trac] Re: [WordPress Trac] #3506: Characters in custom field are not escaped

[WordPress Trac]

#3506: Characters in custom field are not escaped
---------------------+------------------------------------------------------
 Reporter:  llynix   |        Owner:  anonymous
     Type:  defect   |       Status:  new      
 Priority:  low      |    Milestone:  2.2      
Component:  General  |      Version:           
 Severity:  minor    |   Resolution:           
 Keywords:           |  
---------------------+------------------------------------------------------
Comment (by llynix):

 Some additional information.

 The line I'm trying to put in is:
 <div class="video">
         <object type="application/x-shockwave-flash" width="320"
 height="260"
 data="http://onedittyaday.com/flvplayer.swf?file=/movies/whitexmas.flv&autoStart=false;">
                 <param name="movie"
 value="http://onedittyaday.com/flvplayer.swf?file=/movies/whitexmas.flv&autoStart=false;"
 />
         </object>
 </div>

 This gets turned into :

 &lt;div class=&quot;video&quot;&gt;
         &lt;object type=&quot;application/x-shockwave-flash&quot;
 width=&quot;320&quot; height=&quot;260&quot;
 data=&quot;http://onedittyaday.com/flvplayer.swf?file=/movies/whitexmas.flv&amp;autoStart=false;&quot;&gt;
                 &lt;param name=&quot;movie&quot;
 value=&quot;http://onedittyaday.com/flvplayer.swf?file=/movies/whitexmas.flv&amp;autoStart=false;&quot;
 /&gt;
         &lt;/object&gt;

 But if I re-edit it turns into:
 &lt;div class=&quot;video&quot;&gt;
         &lt;object type=&quot;application/x-shockwave-flash&quot;
 width=&quot;320&quot; height=&quot;260&quot;
 data=&quot;http://onedittyaday.com/flvplayer.swf?file=/movies/whitexmas.flv&#038;autoStart=false;&quot;&gt;
                 &lt;param name=&quot;movie&quot;
 value=&quot;http://onedittyaday.com/flvplayer.swf?file=/movies/whitexmas.flv&#038;autoStart=false;&quot;
 /&gt;
         &lt;/object&gt;

 Please notice the &amp; has transformed into &#038;

 This seems to stem from:

 line 868 : admin-functions.php
 <td><textarea name='meta[{$entry['meta_id']}][value]' tabindex='6'
 rows='2' cols='30'>{$entry['meta_value']}</textarea></td>

 {$entry['meta_value']}

-- 
Ticket URL: <http://trac.wordpress.org/ticket/3506#comment:1>
WordPress Trac <http://trac.wordpress.org/>
WordPress blogging software