Escape URLs interpolated into markup - #814

Open

obenland wants to merge 13 commits into

WordPress:trunkfrom

obenland:trac/escape-url-output

Commits on Aug 28, 2026

Escape URLs interpolated into markup.

obenland
and
claude
committed
ef2f31e
BuddyPress.org, WordPress.tv: Use get_theme_file_uri() for theme assets.

obenland
and
claude
committed
6c3e2c9
PHPCS: Treat wporg_login_wordpress_url() as pre-escaped output.

obenland
and
claude
committed
a7de769
Browse Happy, bb-base: Escape the remaining URLs in output.

obenland
and
claude
committed
04a56ff
Escape URLs held in variables.

obenland
and
claude
committed
498ef49
Openverse: Sanitize the request path used to build the redirect target.

obenland
and
claude
committed
c45efbd
Escape variables that carry prebuilt links.

obenland
and
claude
committed
7462c8f
Escape the remaining URLs the sniff could not follow.

obenland
and
claude
committed
27ab3bf
Escape plugin tags and handbook titles where they are assembled.

obenland
and
claude
committed
2c6adf2
Escape the archive, edit and feed links.

obenland
and
claude
committed
bf1fc83
Address review feedback on the URL escaping sweep.

obenland
and
claude
committed
368a3e9
Escape WPTV search and OGG link outputs
obenland
committed
a24c8dd
Forums: Split the review notice's chained assignment.

obenland
and
claude
committed
3e90209