diff --git a/includes/classes/Feature/Search/Synonyms.php b/includes/classes/Feature/Search/Synonyms.php index 05d823138e..2dc3cbede6 100644 --- a/includes/classes/Feature/Search/Synonyms.php +++ b/includes/classes/Feature/Search/Synonyms.php @@ -187,7 +187,7 @@ public function admin_notices() { return; } - $update = filter_input( INPUT_GET, 'ep_synonym_update', FILTER_SANITIZE_STRING ); + $update = filter_input( INPUT_GET, 'ep_synonym_update', FILTER_SANITIZE_SPECIAL_CHARS ); if ( ! in_array( $update, [ 'success', 'error-update-post', 'error-update-index' ], true ) ) { return; @@ -327,7 +327,7 @@ public function validate_synonym( $synonym ) { return false; } - return filter_var( trim( $synonym ), FILTER_SANITIZE_STRING ); + return sanitize_text_field( $synonym, true ); } /** @@ -386,13 +386,13 @@ public function add_search_synonyms( $mapping, $index ) { * @return void */ public function handle_update_synonyms() { - $nonce = filter_input( INPUT_POST, $this->get_nonce_field(), FILTER_SANITIZE_STRING ); - $referer = filter_input( INPUT_POST, '_wp_http_referer', FILTER_SANITIZE_STRING ); + $nonce = filter_input( INPUT_POST, $this->get_nonce_field(), FILTER_SANITIZE_SPECIAL_CHARS ); + $referer = filter_input( INPUT_POST, '_wp_http_referer', FILTER_SANITIZE_URL ); $post_id = false; if ( wp_verify_nonce( $nonce, $this->get_nonce_action() ) ) { - $synonyms = filter_input( INPUT_POST, $this->get_synonym_field(), FILTER_SANITIZE_STRING ); - $mode = filter_input( INPUT_POST, 'synonyms_editor_mode', FILTER_SANITIZE_STRING ); + $synonyms = filter_input( INPUT_POST, $this->get_synonym_field(), FILTER_CALLBACK, [ 'options' => 'wp_strip_all_tags' ] ); + $mode = filter_input( INPUT_POST, 'synonyms_editor_mode', FILTER_SANITIZE_SPECIAL_CHARS ); $content = trim( sanitize_textarea_field( $synonyms ) ); // Content can't be empty.