From 9fcac7ad2d7a2473f7c0303d28c96ca0c8d9713e Mon Sep 17 00:00:00 2001
From: markjaquith <markjaquith@1a063a9b-81f0-0310-95a4-ce76da25c4cd>
Date: Tue, 9 Sep 2008 19:08:22 +0000
Subject: [PATCH] Put aria-required in the proper place, and use
 htmlspecialchars for sanitizing textarea output. Props Mike Schinkel

git-svn-id: http://svn.automattic.com/wordpress/trunk@8853 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/media.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php
index e839161a99..bb299236cc 100644
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -878,7 +878,7 @@ function get_media_item( $attachment_id, $args = null ) {
 		if ( !empty($field[$field['input']]) )
 			$item .= $field[$field['input']];
 		elseif ( $field['input'] == 'textarea' ) {
-			$item .= "<textarea type='text' id='$name' name='$name'>" . attribute_escape( $field['value'] ) . $aria_required . "</textarea>";
+			$item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . htmlspecialchars( $field['value'] ) . "</textarea>";
 		} else {
 			$item .= "<input type='text' id='$name' name='$name' value='" . attribute_escape( $field['value'] ) . "'" . $aria_required . "/>";
 		}