Improve escaping of variable content

Useful for scenarios when string type variables have HTML tags in them. Prevents inspector layout / HTML output from being affected by such variable content.
qriouslad · Apr 16, 2023 · 2bd2cb9 · 2bd2cb9
1 parent bbcd528
commit 2bd2cb9
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 4 deletions.
diff --git a/.gitignore b/.gitignore
@@ -1,4 +1,7 @@
 sftp-config.json
 notes.txt
 .gitignore
-.DS_Store
+.DS_Store
+admin/css/dump-print-r/dump-print-r.css
+
+admin/css/dump-print-tree/dump-print-tree.css
diff --git a/admin/class-variable-inspector-admin.php b/admin/class-variable-inspector-admin.php
@@ -393,13 +393,13 @@ public function vi_inspection_results()
                                 <a class="item" data-tab="print_r">print_r</a>';
             $output .= '</div>
                             <div class="ui tab varexport" data-tab="var_export">
-                                <pre>' . $variable_content_varexport . '</pre>
+                                <pre>' . esc_html( $variable_content_varexport ) . '</pre>
                             </div>
                             <div class="ui tab vardump" data-tab="var_dump">
-                                <pre>' . $variable_content_vardump . '</pre>
+                                <pre>' . esc_html( $variable_content_vardump ) . '</pre>
                             </div>
                             <div class="ui tab printr" data-tab="print_r">
-                                <pre>' . print_r( $variable_content, true ) . '</pre>
+                                <pre>' . esc_html( print_r( $variable_content, true ) ) . '</pre>
                             </div>';
             $output .= '<script>
                                 jQuery("#' . esc_html( $identifier ) . ' .functions .item")