[wp-trac] [WordPress Trac] #49190: Consider escaping get_the_title() in default themes

[WordPress Trac]

#49190: Consider escaping get_the_title() in default themes
---------------------------+------------------------------
 Reporter:  kjellr         |       Owner:  (none)
     Type:  defect (bug)   |      Status:  new
 Priority:  normal         |   Milestone:  Awaiting Review
Component:  Bundled Theme  |     Version:
 Severity:  normal         |  Resolution:
 Keywords:                 |     Focuses:
---------------------------+------------------------------

Comment (by peterwilsoncc):

 Replying to [comment:2 kjellr]:
 > Would `wp_kses_post()` be a suitable replacement in these cases?

 WordPress core runs KSES on the post's title as it's saved so the content
 in the database is considered safe. Therefore there is no need to run
 `wp_kses_post()` on title. It's the same process that makes escaping
 `the_content()` unnecessary.

 The bug is in twentytwenty rather than the other themes.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/49190#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform