[wp-trac] [WordPress Trac] #18875: CSS classes for WP List Table are not properly sanitized

[WordPress Trac]

#18875: CSS classes for WP List Table are not properly sanitized
----------------------------+-----------------------
 Reporter:  sbressler       |       Owner:  scottbre
     Type:  defect (bug)    |      Status:  new
 Priority:  normal          |   Milestone:  3.3
Component:  Administration  |     Version:  3.1
 Severity:  normal          |  Resolution:
 Keywords:  has-patch       |
----------------------------+-----------------------

Comment (by sbressler):

 Finally got around to investigating this. `$_args['plural']` is used as a
 CSS class (in the base class as well as the plugins list class) and as a
 nonce. `$_args['singular']` is used only as a CSS class (in the base
 class). In all cases, I think converting spaces to dashes make the most
 sense. As such, I think sanitize_title makes the most sense.

 However, if performance is a significant concern with using
 `sanitize_title()`, using `sanitize_html_class()` or `sanitize_key()`
 would be fine.

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/18875#comment:6>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software