[wp-trac] [WordPress Trac] #11040: esc_attr() doesn't strip HTML tags

[WordPress Trac]

#11040: esc_attr() doesn't strip HTML tags
-------------------------+--------------------------------------------------
 Reporter:  kingjeffrey  |        Type:  defect (bug)
   Status:  new          |    Priority:  normal      
Milestone:  2.9          |   Component:  Formatting  
  Version:               |    Severity:  normal      
 Keywords:  needs-patch  |  
-------------------------+--------------------------------------------------
Changes (by dd32):

  * keywords:  has-patch commit => needs-patch


Comment:

 I agree with filosofo, HTML entities are legal in attribue values (Not
 only text areas, but input form elemens, Titles, other attr's). It should
 be escaped appropriately for display rather than messing with the passed
 content.

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/11040#comment:8>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software