From c3e1d51c20140d5966e16b584d258663716d602a Mon Sep 17 00:00:00 2001
From: saxmatt <saxmatt@1a063a9b-81f0-0310-95a4-ce76da25c4cd>
Date: Sun, 12 Dec 2004 20:41:19 +0000
Subject: [PATCH] Axing htmlspecialchars because it double-encodes-encodes.
 Better error handling around queries.

git-svn-id: http://svn.automattic.com/wordpress/trunk@1940 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/admin-functions.php                |  6 +-
 wp-admin/bookmarklet.php                    | 27 +++-----
 wp-admin/categories.php                     | 12 ++--
 wp-admin/edit-comments.php                  |  4 +-
 wp-admin/edit-form-advanced.php             |  2 +-
 wp-admin/edit-page-form.php                 |  2 +-
 wp-admin/edit.php                           |  8 ++-
 wp-admin/link-add.php                       | 36 +++++------
 wp-admin/link-categories.php                | 22 +++----
 wp-admin/link-manager.php                   | 69 ++++++++++-----------
 wp-admin/options.php                        |  4 +-
 wp-admin/plugin-editor.php                  |  2 +-
 wp-admin/post.php                           |  4 +-
 wp-admin/profile.php                        | 22 +++----
 wp-admin/sidebar.php                        |  2 +-
 wp-admin/templates.php                      |  6 +-
 wp-admin/theme-editor.php                   |  2 +-
 wp-admin/user-edit.php                      | 25 ++++----
 wp-admin/users.php                          | 28 ++++-----
 wp-comments-popup.php                       |  2 +-
 wp-comments.php                             |  2 +-
 wp-includes/classes.php                     | 54 ++++++++--------
 wp-includes/functions-formatting.php        | 12 ++++
 wp-includes/functions-post.php              |  4 +-
 wp-includes/functions.php                   |  2 +-
 wp-includes/links.php                       |  6 +-
 wp-includes/template-functions-author.php   |  4 +-
 wp-includes/template-functions-category.php |  4 +-
 wp-includes/template-functions-comment.php  |  4 +-
 wp-includes/template-functions-general.php  |  2 +-
 wp-includes/template-functions-post.php     |  6 +-
 wp-includes/vars.php                        |  2 +-
 wp-links-opml.php                           |  4 +-
 wp-trackback.php                            |  4 +-
 xmlrpc.php                                  |  6 +-
 35 files changed, 199 insertions(+), 202 deletions(-)

diff --git a/wp-admin/admin-functions.php b/wp-admin/admin-functions.php
index 98bee84a74..a0a4d8d999 100644
--- a/wp-admin/admin-functions.php
+++ b/wp-admin/admin-functions.php
@@ -90,7 +90,7 @@ function write_nested_categories($categories) {
  foreach($categories as $category) {
    echo '<label for="category-', $category['cat_ID'], '" class="selectit"><input value="', $category['cat_ID'],
      '" type="checkbox" name="post_category[]" id="category-', $category['cat_ID'], '"',
-     ($category['checked'] ? ' checked="checked"' : ""), '/> ', htmlspecialchars($category['cat_name']), "</label>\n";
+     ($category['checked'] ? ' checked="checked"' : ""), '/> ', wp_specialchars($category['cat_name']), "</label>\n";
 
    if(isset($category['children'])) {
      echo "\n<span class='cat-nest'>\n";
@@ -113,7 +113,7 @@ function cat_rows($parent = 0, $level = 0, $categories = 0) {
 	if ($categories) {
 		foreach ($categories as $category) {
 			if ($category->category_parent == $parent) {
-				$category->cat_name = htmlspecialchars($category->cat_name);
+				$category->cat_name = wp_specialchars($category->cat_name);
 				$count = $wpdb->get_var("SELECT COUNT(post_id) FROM $wpdb->post2cat WHERE category_id = $category->cat_ID");
 				$pad = str_repeat('&#8212; ', $level);
 				if ( $user_level > 3 )
@@ -144,7 +144,7 @@ function wp_dropdown_cats($currentcat = 0, $currentparent = 0, $parent = 0, $lev
 		foreach ($categories as $category) { if ($currentcat != $category->cat_ID && $parent == $category->category_parent) {
 			$count = $wpdb->get_var("SELECT COUNT(post_id) FROM $wpdb->post2cat WHERE category_id = $category->cat_ID");
 			$pad = str_repeat('&#8211; ', $level);
-			$category->cat_name = htmlspecialchars($category->cat_name);
+			$category->cat_name = wp_specialchars($category->cat_name);
 			echo "\n\t<option value='$category->cat_ID'";
 			if ($currentparent == $category->cat_ID)
 				echo " selected='selected'";
diff --git a/wp-admin/bookmarklet.php b/wp-admin/bookmarklet.php
index 2bfb1ed478..8f99804a15 100644
--- a/wp-admin/bookmarklet.php
+++ b/wp-admin/bookmarklet.php
@@ -20,8 +20,8 @@ window.close()
 </html>
 <?php
 } else {
-    $popuptitle = htmlspecialchars(stripslashes($popuptitle));
-    $text = htmlspecialchars(stripslashes(urldecode($text)));
+    $popuptitle = wp_specialchars(stripslashes($popuptitle));
+    $text = wp_specialchars(stripslashes(urldecode($text)));
     
     /* big funky fixes for browsers' javascript bugs */
     
@@ -40,24 +40,22 @@ window.close()
         $text = preg_replace($wp_gecko_correction["in"],$wp_gecko_correction["out"],$text);
     }
     
-    $post_title = $_REQUEST['post_title'];
+    $post_title = wp_specialchars($_REQUEST['post_title']);
     if (!empty($post_title)) {
         $post_title =  stripslashes($post_title);
     } else {
         $post_title = $popuptitle;
     }
-// I'm not sure why we're using $edited_post_title in the edit-form.php, but we are
-// and that is what is being included below. For this reason, I am just duplicating
-// the var instead of changing the assignment on the lines above. 
-// -- Alex King 2004-01-07
-    $edited_post_title = htmlspecialchars($post_title);
+
+    $edited_post_title = wp_specialchars($post_title);
 
 // $post_pingback needs to be set in any file that includes edit-form.php
     $post_pingback = get_settings('default_pingback_flag');
     
-    $content = htmlspecialchars($_REQUEST['content']);
-    if (!empty($content)) {
-        $content =  stripslashes($content);
+    $content  = wp_specialchars($_REQUEST['content']);
+	$popupurl = wp_specialchars($_REQUEST['popupurl']);
+    if ( !empty($content) ) {
+        $content = wp_specialchars( stripslashes($_REQUEST['content']) );
     } else {
         $content = '<a href="'.$popupurl.'">'.$popuptitle.'</a>'."\n$text";
     }
@@ -71,14 +69,7 @@ window.close()
 <meta http-equiv="Content-Type" content="text/html; charset=<?php echo get_settings('blog_charset'); ?>" />
 <link rel="stylesheet" href="wp-admin.css" type="text/css" />
 <link rel="shortcut icon" href="../wp-images/wp-favicon.png" />
-<script type="text/javascript">
-<!--
-function launchupload() {
-	window.open ("upload.php", "wpupload", "width=380,height=360,location=0,menubar=0,resizable=1,scrollbars=yes,status=1,toolbar=0");
-}
 
-//-->
-</script>
 <style type="text/css">
 <!--
 
diff --git a/wp-admin/categories.php b/wp-admin/categories.php
index b4d8165ba0..ac574389a8 100644
--- a/wp-admin/categories.php
+++ b/wp-admin/categories.php
@@ -26,7 +26,7 @@ case 'addcat':
 	if ($user_level < 3)
 		die (__('Cheatin&#8217; uh?'));
 	
-	$cat_name= $_POST['cat_name'];
+	$cat_name= wp_specialchars($_POST['cat_name']);
 	$id_result = $wpdb->get_row("SHOW TABLE STATUS LIKE '$wpdb->categories'");
 	$cat_ID = $id_result->Auto_increment;
 	$category_nicename = sanitize_title($cat_name, $cat_ID);
@@ -64,7 +64,7 @@ break;
 case 'edit':
 
     require_once ('admin-header.php');
-    $cat_ID = intval($_GET['cat_ID']);
+    $cat_ID = (int) $_GET['cat_ID'];
     $category = $wpdb->get_row("SELECT * FROM $wpdb->categories WHERE cat_ID = '$cat_ID'");
     $cat_name = $category->cat_name;
     ?>
@@ -75,12 +75,12 @@ case 'edit':
 	  <table class="editform" width="100%" cellspacing="2" cellpadding="5">
 		<tr>
 		  <th width="33%" scope="row"><?php _e('Category name:') ?></th>
-		  <td width="67%"><input name="cat_name" type="text" value="<?php echo htmlspecialchars($cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
+		  <td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
 <input type="hidden" name="cat_ID" value="<?php echo $cat_ID ?>" /></td>
 		</tr>
 		<tr>
 			<th scope="row"><?php _e('Category slug:') ?></th>
-			<td><input name="category_nicename" type="text" value="<?php echo htmlspecialchars($category->category_nicename); ?>" size="40" /></td>
+			<td><input name="category_nicename" type="text" value="<?php echo wp_specialchars($category->category_nicename); ?>" size="40" /></td>
 		</tr>
 		<tr>
 			<th scope="row"><?php _e('Category parent:') ?></th>
@@ -92,7 +92,7 @@ case 'edit':
 		</tr>
 		<tr>
 			<th scope="row"><?php _e('Description:') ?></th>
-			<td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo htmlspecialchars($category->category_description, ENT_NOQUOTES); ?></textarea></td>
+			<td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description, 1); ?></textarea></td>
 		</tr>
 		</table>
 	  <p class="submit"><input type="submit" name="submit" value="<?php _e('Edit category') ?> &raquo;" /></p>
@@ -107,7 +107,7 @@ case 'editedcat':
 	if ($user_level < 3)
 		die (__('Cheatin&#8217; uh?'));
 	
-	$cat_name = $_POST['cat_name'];
+	$cat_name = wp_specialchars($_POST['cat_name']);
 	$cat_ID = (int) $_POST['cat_ID'];
 	$category_nicename = sanitize_title($_POST['category_nicename'], $cat_ID);
 	$category_description = $_POST['category_description'];
diff --git a/wp-admin/edit-comments.php b/wp-admin/edit-comments.php
index 5d68fa6c07..5ed716a3d8 100644
--- a/wp-admin/edit-comments.php
+++ b/wp-admin/edit-comments.php
@@ -6,7 +6,7 @@ $parent_file = 'edit.php';
 
 require_once('admin-header.php');
 if (empty($_GET['mode'])) $mode = 'view';
-else $mode = htmlspecialchars($_GET['mode']);
+else $mode = wp_specialchars($_GET['mode'], 1);
 ?>
 
 <script type="text/javascript">
@@ -29,7 +29,7 @@ function checkAll(form)
 <form name="searchform" action="" method="get"> 
   <fieldset> 
   <legend><?php _e('Show Comments That Contain...') ?></legend> 
-  <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo htmlspecialchars($_GET['s']); ?>" size="17" /> 
+  <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo wp_specialchars($_GET['s'], 1); ?>" size="17" /> 
   <input type="submit" name="submit" value="<?php _e('Search') ?>"  />  
   <input type="hidden" name="mode" value="<?php echo $mode; ?>" />
   <?php _e('(Searches within comment text, e-mail, URI, and IP address.)') ?>
diff --git a/wp-admin/edit-form-advanced.php b/wp-admin/edit-form-advanced.php
index d7cbdb7903..a1871bb627 100644
--- a/wp-admin/edit-form-advanced.php
+++ b/wp-admin/edit-form-advanced.php
@@ -128,7 +128,7 @@ if ('publish' != $post_status || 0 == $post_ID) {
 <?php
 }
 ?>
-	<input name="referredby" type="hidden" id="referredby" value="<?php echo htmlspecialchars($_SERVER['HTTP_REFERER']); ?>" />
+	<input name="referredby" type="hidden" id="referredby" value="<?php echo wp_specialchars($_SERVER['HTTP_REFERER']); ?>" />
 </p>
 
 <?php do_action('edit_form_advanced', ''); ?>
diff --git a/wp-admin/edit-page-form.php b/wp-admin/edit-page-form.php
index 30f24a11c1..f14aff3760 100644
--- a/wp-admin/edit-page-form.php
+++ b/wp-admin/edit-page-form.php
@@ -77,7 +77,7 @@ edCanvas = document.getElementById('content');
 
 <p class="submit">
   <input name="savepage" type="submit" id="savepage" tabindex="6" value="<?php $post_ID ? _e('Edit Page') :_e('Create New Page') ?> &raquo;" /> 
-  <input name="referredby" type="hidden" id="referredby" value="<?php if (isset($_SERVER['HTTP_REFERER'])) echo htmlspecialchars($_SERVER['HTTP_REFERER']); ?>" />
+  <input name="referredby" type="hidden" id="referredby" value="<?php if (isset($_SERVER['HTTP_REFERER'])) echo wp_specialchars($_SERVER['HTTP_REFERER']); ?>" />
 </p>
 
 <fieldset id="pageoptions">
diff --git a/wp-admin/edit.php b/wp-admin/edit.php
index 37a941ad6a..e44c0823c2 100644
--- a/wp-admin/edit.php
+++ b/wp-admin/edit.php
@@ -5,6 +5,8 @@ $title = __('Posts');
 $parent_file = 'edit.php';
 require_once('admin-header.php');
 
+$_GET['m'] = (int) $_GET['m'];
+
 get_currentuserinfo();
 
 $drafts = $wpdb->get_results("SELECT ID, post_title FROM $wpdb->posts WHERE post_status = 'draft' AND post_author = $user_ID");
@@ -65,7 +67,7 @@ if ($drafts || $other_drafts) {
 if ( isset( $_GET['m'] ) ) {
 	echo $month[substr( $_GET['m'], 4, 2 )] . ' ' . substr( $_GET['m'], 0, 4 );
 } elseif ( isset( $_GET['s'] ) ) {
-	printf(__('Search for &#8220;%s&#8221;'), htmlspecialchars($_GET['s']) );
+	printf(__('Search for &#8220;%s&#8221;'), wp_specialchars($_GET['s']) );
 } else {
 	_e('Last 15 Posts');
 }
@@ -90,7 +92,7 @@ if ( isset( $_GET['m'] ) ) {
 			$arc_year  = $arc_row->yyear;
 			$arc_month = $arc_row->mmonth;
 			
-			if( isset($_GET['m']) && $arc_year . zeroise($arc_month, 2) == $_GET['m'] )
+			if( isset($_GET['m']) && $arc_year . zeroise($arc_month, 2) == (int) $_GET['m'] )
 				$default = 'selected="selected"';
 			else
 				$default = null;
@@ -121,7 +123,7 @@ if ( isset( $_GET['m'] ) ) {
   </tr> 
 <?php
 $what_to_show = 'posts';
-if ( empty($_GET['m']) && empty($_GET['s']) ) {
+if ( empty($_GET['m']) || 0 == $_GET['m'] && empty($_GET['s']) ) {
   $showposts = 15;
 } else {
   $nopaging = true;
diff --git a/wp-admin/link-add.php b/wp-admin/link-add.php
index 0df3efc424..5a3615e78e 100644
--- a/wp-admin/link-add.php
+++ b/wp-admin/link-add.php
@@ -1,25 +1,25 @@
 <?php
 require_once('admin.php');
 
-$title = 'Add Link';
+$title = __('Add Link');
 $this_file = 'link-manager.php';
 $parent_file = 'link-manager.php';
 
 function category_dropdown($fieldname, $selected = 0) {
-    global $wpdb;
-
-    $results = $wpdb->get_results("SELECT cat_id, cat_name, auto_toggle FROM $wpdb->linkcategories ORDER BY cat_id");
-    echo '        <select name="'.$fieldname.'" size="1">'."\n";
-    foreach ($results as $row) {
-      echo "          <option value=\"".$row->cat_id."\"";
-      if ($row->cat_id == $selected)
-        echo " selected";
-        echo ">".$row->cat_id.": ".htmlspecialchars($row->cat_name);
-        if ($row->auto_toggle == 'Y')
-            echo ' (auto toggle)';
-        echo "</option>\n";
-    }
-    echo "        </select>\n";
+	global $wpdb;
+	
+	$results = $wpdb->get_results("SELECT cat_id, cat_name, auto_toggle FROM $wpdb->linkcategories ORDER BY cat_id");
+	echo "\n<select name='$fieldname' size='1'>\n";
+	foreach ($results as $row) {
+		echo "\n\t<option value='$row->cat_id'";
+		if ($row->cat_id == $selected)
+			echo " selected='selected'";
+		echo ">$row->cat_id : " . wp_specialchars($row->cat_name);
+		if ($row->auto_toggle == 'Y')
+			echo ' (auto toggle)';
+		echo "</option>";
+	}
+	echo "\n</select>\n";
 }
 
 $wpvarstoreset = array('action', 'cat_id', 'linkurl', 'name', 'image',
@@ -49,7 +49,7 @@ require('admin-header.php');
 ?>
 
 <?php if ($_GET['added']) : ?>
-<div class="updated"><p>Link added.</p></div>
+<div class="updated"><p><?php _e('Link added.'); ?></p></div>
 <?php endif; ?>
 <div class="wrap">
 <h2><?php _e('<strong>Add</strong> a link:') ?></h2>
@@ -59,11 +59,11 @@ require('admin-header.php');
         <table class="editform" width="100%" cellspacing="2" cellpadding="5">
          <tr>
            <th width="33%" scope="row"><?php _e('URI:') ?></th>
-           <td width="67%"><input type="text" name="linkurl" value="<?php echo $_GET['linkurl']; ?>" style="width: 95%;" /></td>
+           <td width="67%"><input type="text" name="linkurl" value="<?php echo wp_specialchars($_GET['linkurl'], 1); ?>" style="width: 95%;" /></td>
          </tr>
          <tr>
            <th scope="row"><?php _e('Link Name:') ?></th>
-           <td><input type="text" name="name" value="<?php echo urldecode($_GET['name']); ?>" style="width: 95%" /></td>
+           <td><input type="text" name="name" value="<?php echo wp_specialchars( urldecode($_GET['name']), 1 ); ?>" style="width: 95%" /></td>
          </tr>
          <tr>
          	<th scope="row"><?php _e('Short description:') ?></th>
diff --git a/wp-admin/link-categories.php b/wp-admin/link-categories.php
index 00a7e82cd3..128e440a46 100644
--- a/wp-admin/link-categories.php
+++ b/wp-admin/link-categories.php
@@ -28,7 +28,7 @@ switch ($action) {
       if ($user_level < 5)
           die (__("Cheatin' uh ?"));
 
-      $cat_name = addslashes($_POST['cat_name']);
+      $cat_name = wp_specialchars($_POST['cat_name']);
       $auto_toggle = $_POST['auto_toggle'];
       if ($auto_toggle != 'Y') {
           $auto_toggle = 'N';
@@ -79,7 +79,7 @@ switch ($action) {
   } // end addcat
   case 'Delete':
   {
-    $cat_id = $_GET['cat_id'];
+    $cat_id = (int) $_GET['cat_id'];
     $cat_name=get_linkcatname($cat_id);
 
     if ($cat_id=="1")
@@ -97,7 +97,7 @@ switch ($action) {
   case 'Edit':
   {
     include_once ('admin-header.php');
-    $cat_id = $_GET['cat_id'];
+    $cat_id = (int) $_GET['cat_id'];
     $row = $wpdb->get_row("SELECT cat_id, cat_name, auto_toggle, show_images, show_description, "
          . " show_rating, show_updated, sort_order, sort_desc, text_before_link, text_after_link, "
          . " text_after_all, list_limit FROM $wpdb->linkcategories WHERE cat_id=$cat_id");
@@ -108,7 +108,7 @@ switch ($action) {
 ?>
 
 <div class="wrap">
-  <h2>Edit &#8220;<?php echo htmlspecialchars($row->cat_name)?>&#8221; Category </h2>
+  <h2>Edit &#8220;<?php echo wp_specialchars($row->cat_name)?>&#8221; Category </h2>
 
   <form name="editcat" method="post">
       <input type="hidden" name="action" value="editedcat" />
@@ -118,7 +118,7 @@ switch ($action) {
 <table class="editform" width="100%" cellspacing="2" cellpadding="5">
 <tr>
 	<th width="33%" scope="row"><?php _e('Name:') ?></th>
-	<td width="67%"><input name="cat_name" type="text" value="<?php echo htmlspecialchars($row->cat_name)?>" size="30" /></td>
+	<td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($row->cat_name)?>" size="30" /></td>
 </tr>
 <tr>
 	<th scope="row"><?php _e('Show:') ?></th>
@@ -176,15 +176,15 @@ switch ($action) {
 <table class="editform" width="100%" cellspacing="2" cellpadding="5">
 <tr>
 	<th width="33%" scope="row"><?php _e('Before Link:') ?></th>
-	<td width="67%"><input type="text" name="text_before_link" size="45" value="<?php echo htmlspecialchars($row->text_before_link)?>" /></td>
+	<td width="67%"><input type="text" name="text_before_link" size="45" value="<?php echo wp_specialchars($row->text_before_link)?>" /></td>
 </tr>
 <tr>
 <th scope="row"><?php _e('Between Link and Description:') ?></th>
-<td><input type="text" name="text_after_link" size="45" value="<?php echo htmlspecialchars($row->text_after_link)?>" /></td>
+<td><input type="text" name="text_after_link" size="45" value="<?php echo wp_specialchars($row->text_after_link)?>" /></td>
 </tr>
 <tr>
 <th scope="row"><?php _e('After Link:') ?></th>
-<td><input type="text" name="text_after_all" size="45" value="<?php echo htmlspecialchars($row->text_after_all)?>"/></td>
+<td><input type="text" name="text_after_all" size="45" value="<?php echo wp_specialchars($row->text_after_all)?>"/></td>
 </tr>
 </table>
 </fieldset>
@@ -204,9 +204,9 @@ switch ($action) {
     $submit=$_POST["submit"];
     if (isset($submit)) {
 
-    $cat_id=$_POST["cat_id"];
+    $cat_id = (int)$_POST["cat_id"];
 
-    $cat_name= $_POST["cat_name"];
+    $cat_name= wp_specialchars($_POST["cat_name"]);
     $auto_toggle = $_POST["auto_toggle"];
     if ($auto_toggle != 'Y') {
         $auto_toggle = 'N';
@@ -310,7 +310,7 @@ foreach ($results as $row) {
     $style = ($i % 2) ? ' class="alternate"' : '';
 ?>
               <tr valign="middle" align="center" <?php echo $style ?> style="border-bottom: 1px dotted #9C9A9C;">
-                <td><?php echo htmlspecialchars($row->cat_name)?></td>
+                <td><?php echo wp_specialchars($row->cat_name)?></td>
 				<td ><?php echo $row->cat_id?></td>
                 <td><?php echo $row->auto_toggle?></td>
                 <td><?php echo $row->show_images?></td>
diff --git a/wp-admin/link-manager.php b/wp-admin/link-manager.php
index 46fd57ccdd..3a10eef93e 100644
--- a/wp-admin/link-manager.php
+++ b/wp-admin/link-manager.php
@@ -32,7 +32,7 @@ function category_dropdown($fieldname, $selected = 0) {
 		echo "\n\t<option value='$row->cat_id'";
 		if ($row->cat_id == $selected)
 			echo " selected='selected'";
-		echo ">$row->cat_id: ".htmlspecialchars($row->cat_name);
+		echo ">$row->cat_id: ".wp_specialchars($row->cat_name);
 		if ('Y' == $row->auto_toggle)
 			echo ' (auto toggle)';
 		echo "</option>\n";
@@ -160,10 +160,10 @@ switch ($action) {
   {
     check_admin_referer();
 
-    $link_url = $_POST['linkurl'];
+    $link_url = wp_specialchars($_POST['linkurl']);
     $link_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $link_url) ? $link_url : 'http://' . $link_url; 
-    $link_name = $_POST['name'];
-    $link_image = $_POST['image'];
+    $link_name = wp_specialchars($_POST['name']);
+    $link_image = wp_specialchars($_POST['image']);
     $link_target = $_POST['target'];
     $link_category = $_POST['category'];
     $link_description = $_POST['description'];
@@ -171,7 +171,7 @@ switch ($action) {
     $link_rating = $_POST['rating'];
     $link_rel = $_POST['rel'];
     $link_notes = $_POST['notes'];
-	$link_rss_uri =  $_POST['rss_uri'];
+	$link_rss_uri =  wp_specialchars($_POST['rss_uri']);
     $auto_toggle = get_autotoggle($link_category);
 
     if ($user_level < 5)
@@ -207,12 +207,12 @@ switch ($action) {
 
       check_admin_referer();
 
-      $link_id = $_POST['link_id'];
-      $link_url = $_POST['linkurl'];
+      $link_id = (int) $_POST['link_id'];
+      $link_url = wp_specialchars($_POST['linkurl']);
       $link_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $link_url) ? $link_url : 'http://' . $link_url; 
-      $link_name = $_POST['name'];
-      $link_image = $_POST['image'];
-      $link_target = $_POST['target'];
+      $link_name = wp_specialchars($_POST['name']);
+      $link_image = wp_specialchars($_POST['image']);
+      $link_target = wp_specialchars($_POST['target']);
       $link_category = $_POST['category'];
       $link_description = $_POST['description'];
       $link_visible = $_POST['visible'];
@@ -270,31 +270,30 @@ switch ($action) {
     break;
   } // end Delete
 
-  case 'linkedit':
-  {
+  case 'linkedit': {
 	$xfn = true;
     include_once ('admin-header.php');
-    if ($user_level < 5) {
+    if ($user_level < 5)
       die(__('You do not have sufficient permissions to edit the links for this blog.'));
-    }
+
     $link_id = (int) $_GET['link_id'];
-    $row = $wpdb->get_row("SELECT * 
-	FROM $wpdb->links 
-	WHERE link_id = $link_id");
+    $row = $wpdb->get_row("SELECT * FROM $wpdb->links WHERE link_id = $link_id");
 
     if ($row) {
-      $link_url = htmlspecialchars($row->link_url);
-      $link_name = htmlspecialchars($row->link_name);
+      $link_url = wp_specialchars($row->link_url, 1);
+      $link_name = wp_specialchars($row->link_name, 1);
       $link_image = $row->link_image;
       $link_target = $row->link_target;
       $link_category = $row->link_category;
-      $link_description = htmlspecialchars($row->link_description);
+      $link_description = wp_specialchars($row->link_description);
       $link_visible = $row->link_visible;
       $link_rating = $row->link_rating;
       $link_rel = $row->link_rel;
-      $link_notes = htmlspecialchars($row->link_notes);
-	  $link_rss_uri = htmlspecialchars($row->link_rss);
-    }
+      $link_notes = wp_specialchars($row->link_notes);
+	  $link_rss_uri = wp_specialchars($row->link_rss);
+    } else {
+		die( __('Link not found.') ); 
+	}
 
 ?>
 
@@ -492,9 +491,9 @@ switch ($action) {
 </fieldset>
 <p class="submit"><input type="submit" name="submit" value="<?php _e('Save Changes &raquo;') ?>" />
           <input type="hidden" name="action" value="editlink" />
-          <input type="hidden" name="link_id" value="<?php echo $link_id; ?>" />
-          <input type="hidden" name="order_by" value="<?php echo $order_by ?>" />
-          <input type="hidden" name="cat_id" value="<?php echo $cat_id ?>" /></p>
+          <input type="hidden" name="link_id" value="<?php echo (int) $link_id; ?>" />
+          <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
+          <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" /></p>
   </form> 
 </div>
 <?php
@@ -598,7 +597,7 @@ function checkAll(form)
       echo "          <option value=\"".$row->cat_id."\"";
       if ($row->cat_id == $cat_id)
         echo " selected='selected'";
-        echo ">".$row->cat_id.": ".htmlspecialchars($row->cat_name);
+        echo ">".$row->cat_id.": ".wp_specialchars($row->cat_name);
         if ($row->auto_toggle == 'Y')
             echo ' (auto toggle)';
         echo "</option>\n";
@@ -630,8 +629,8 @@ function checkAll(form)
 
     <input type="hidden" name="link_id" value="" />
     <input type="hidden" name="action" value="" />
-    <input type="hidden" name="order_by" value="<?php echo $order_by ?>" />
-    <input type="hidden" name="cat_id" value="<?php echo $cat_id ?>" />
+    <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
+    <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
   <table width="100%" cellpadding="3" cellspacing="3">
     <tr>
       <th width="15%"><?php _e('Name') ?></th>
@@ -660,10 +659,10 @@ function checkAll(form)
     $links = $wpdb->get_results($sql);
     if ($links) {
         foreach ($links as $link) {
-      	    $link->link_name = htmlspecialchars($link->link_name);
-      	    $link->link_category = htmlspecialchars($link->link_category);
-      	    $link->link_description = htmlspecialchars($link->link_description);
-            $link->link_url = htmlspecialchars($link->link_url);
+      	    $link->link_name = wp_specialchars($link->link_name);
+      	    $link->link_category = wp_specialchars($link->link_category);
+      	    $link->link_description = wp_specialchars($link->link_description);
+            $link->link_url = wp_specialchars($link->link_url);
             $short_url = str_replace('http://', '', $link->link_url);
             $short_url = str_replace('www.', '', $short_url);
             if ('/' == substr($short_url, -1))
@@ -753,6 +752,4 @@ LINKS;
 } // end case
 ?>
 
-
-
-<?php include('admin-footer.php'); ?>
+<?php include('admin-footer.php'); ?>
\ No newline at end of file
diff --git a/wp-admin/options.php b/wp-admin/options.php
index 1edc47cc3c..dd972f44f1 100644
--- a/wp-admin/options.php
+++ b/wp-admin/options.php
@@ -48,7 +48,7 @@ case 'update':
             // should we even bother checking?
             if ($user_level >= $option->option_admin_level) {
                 $old_val = $option->option_value;
-                $new_val = $_POST[$option->option_name];
+                $new_val = wp_specialchars($_POST[$option->option_name]);
                 if (!$new_val) {
                     if (3 == $option->option_type)
                         $new_val = '';
@@ -88,7 +88,7 @@ default:
 $options = $wpdb->get_results("SELECT * FROM $wpdb->options ORDER BY option_name");
 
 foreach ($options as $option) :
-	$value = htmlspecialchars($option->option_value);
+	$value = wp_specialchars($option->option_value);
 	echo "
 <tr>
 	<th scope='row'><label for='$option->option_name'>$option->option_name</label></th>
diff --git a/wp-admin/plugin-editor.php b/wp-admin/plugin-editor.php
index 16de1cfe9a..ff65035ad8 100644
--- a/wp-admin/plugin-editor.php
+++ b/wp-admin/plugin-editor.php
@@ -67,7 +67,7 @@ default:
 	if (!$error) {
 		$f = fopen($real_file, 'r');
 		$content = fread($f, filesize($real_file));
-		$content = htmlspecialchars($content);
+		$content = wp_specialchars($content);
 	}
 
 	?>
diff --git a/wp-admin/post.php b/wp-admin/post.php
index d17721f218..3ef0c49f1a 100644
--- a/wp-admin/post.php
+++ b/wp-admin/post.php
@@ -656,7 +656,7 @@ default:
 		$post_pingback = get_settings('default_pingback_flag');
 		$default_post_cat = get_settings('default_category');
 
-		$content = htmlspecialchars($content);
+		$content = wp_specialchars($content);
 		$content = apply_filters('default_content', $content);
 		$edited_post_title = apply_filters('default_title', $edited_post_title);
 		$excerpt = apply_filters('default_excerpt', $excerpt);
@@ -677,7 +677,7 @@ $bookmarklet_height= (get_settings('use_trackback')) ? 480 : 440;
 
 if ($is_NS4 || $is_gecko) {
 ?>
-<a href="javascript:if(navigator.userAgent.indexOf('Safari') >= 0){Q=getSelection();}else{Q=document.selection?document.selection.createRange().text:document.getSelection();}void(window.open('<?php echo get_settings('siteurl') ?>/wp-admin/bookmarklet.php?text='+encodeURIComponent(Q)+'&amp;popupurl='+encodeURIComponent(location.href)+'&amp;popuptitle='+encodeURIComponent(document.title),'<?php _e('WordPress bookmarklet') ?>','scrollbars=yes,width=600,height=460,left=100,top=150,status=yes'));"><?php printf(__('Press It - %s'), htmlspecialchars(get_settings('blogname'))); ?></a> 
+<a href="javascript:if(navigator.userAgent.indexOf('Safari') >= 0){Q=getSelection();}else{Q=document.selection?document.selection.createRange().text:document.getSelection();}void(window.open('<?php echo get_settings('siteurl') ?>/wp-admin/bookmarklet.php?text='+encodeURIComponent(Q)+'&amp;popupurl='+encodeURIComponent(location.href)+'&amp;popuptitle='+encodeURIComponent(document.title),'<?php _e('WordPress bookmarklet') ?>','scrollbars=yes,width=600,height=460,left=100,top=150,status=yes'));"><?php printf(__('Press It - %s'), wp_specialchars(get_settings('blogname'))); ?></a> 
 <?php
 } else if ($is_winIE) {
 ?>
diff --git a/wp-admin/profile.php b/wp-admin/profile.php
index 36dd3e5264..c140bf322e 100644
--- a/wp-admin/profile.php
+++ b/wp-admin/profile.php
@@ -1,10 +1,10 @@
 <?php 
 require_once('admin.php');
 
-$title = "Profile";
+$title = 'Profile';
 $parent_file = 'profile.php';
 
-$wpvarstoreset = array('action','redirect','profile','user');
+$wpvarstoreset = array('action', 'profile', 'user');
 for ($i=0; $i<count($wpvarstoreset); $i += 1) {
 	$wpvar = $wpvarstoreset[$i];
 	if (!isset($$wpvar)) {
@@ -66,18 +66,18 @@ case 'update':
 		setcookie('wordpresspass_' . COOKIEHASH, md5(md5($newuser_pass)), time() + 31536000, COOKIEPATH);
 	}
 
-	$newuser_firstname = $_POST['newuser_firstname'];
-	$newuser_lastname = $_POST['newuser_lastname'];
+	$newuser_firstname = wp_specialchars($_POST['newuser_firstname']);
+	$newuser_lastname = wp_specialchars($_POST['newuser_lastname']);
 	$newuser_nickname = $_POST['newuser_nickname'];
     $newuser_nicename = sanitize_title($newuser_nickname);
-	$newuser_icq = $_POST['newuser_icq'];
-	$newuser_aim = $_POST['newuser_aim'];
-	$newuser_msn = $_POST['newuser_msn'];
-	$newuser_yim = $_POST['newuser_yim'];
-	$newuser_email = $_POST['newuser_email'];
-	$newuser_url = $_POST['newuser_url'];
+	$newuser_icq = wp_specialchars($_POST['newuser_icq']);
+	$newuser_aim = wp_specialchars($_POST['newuser_aim']);
+	$newuser_msn = wp_specialchars($_POST['newuser_msn']);
+	$newuser_yim = wp_specialchars($_POST['newuser_yim']);
+	$newuser_email = wp_specialchars($_POST['newuser_email']);
+	$newuser_url = wp_specialchars($_POST['newuser_url')];
 	$newuser_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $newuser_url) ? $newuser_url : 'http://' . $newuser_url; 
-	$newuser_idmode=$_POST['newuser_idmode'];
+	$newuser_idmode = wp_specialchars($_POST['newuser_idmode']);
 	$user_description = $_POST['user_description'];
 
 	$result = $wpdb->query("UPDATE $wpdb->users SET user_firstname='$newuser_firstname', $updatepassword user_lastname='$newuser_lastname', user_nickname='$newuser_nickname', user_icq='$newuser_icq', user_email='$newuser_email', user_url='$newuser_url', user_aim='$newuser_aim', user_msn='$newuser_msn', user_yim='$newuser_yim', user_idmode='$newuser_idmode', user_description = '$user_description', user_nicename = '$newuser_nicename' WHERE ID = $user_ID");
diff --git a/wp-admin/sidebar.php b/wp-admin/sidebar.php
index dd00e9b6aa..eff1ce3183 100644
--- a/wp-admin/sidebar.php
+++ b/wp-admin/sidebar.php
@@ -30,7 +30,7 @@ if ('b' == $_GET['a']) {
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
 <title>WordPress &#8250; Sidebar</title>
-<meta http-equiv="Content-Type" content="text/html; charset=<?php echo $blog_charset ?>" />
+<meta http-equiv="Content-Type" content="text/html; charset=<?php bloginfo('blog_charset'); ?>" />
 <link rel="stylesheet" href="wp-admin.css" type="text/css" />
 <link rel="shortcut icon" href="../wp-images/wp-favicon.png" />
 <style type="text/css" media="screen">
diff --git a/wp-admin/templates.php b/wp-admin/templates.php
index 54edac600d..9d04906f92 100644
--- a/wp-admin/templates.php
+++ b/wp-admin/templates.php
@@ -63,7 +63,7 @@ default:
 	if (!$error) {
 		$f = fopen($real_file, 'r');
 		$content = fread($f, filesize($real_file));
-		$content = htmlspecialchars($content);
+		$content = wp_specialchars($content);
 	}
 
 	?>
@@ -73,9 +73,9 @@ default:
  <div class="wrap"> 
 <?php
 if (is_writeable($real_file)) {
-	echo '<h2>' . sprintf(__('Editing <strong>%s</strong>'), $file) . '</h2>';
+	echo '<h2>' . sprintf(__('Editing <strong>%s</strong>'), wp_specialchars($file) ) . '</h2>';
 } else {
-	echo '<h2>' . sprintf(__('Browsing <strong>%s</strong>'), $file) . '</h2>';
+	echo '<h2>' . sprintf(__('Browsing <strong>%s</strong>'), wp_specialchars($file) ) . '</h2>';
 }
 ?>
 <div id="templateside">
diff --git a/wp-admin/theme-editor.php b/wp-admin/theme-editor.php
index f65d91af17..d06c6a20b5 100644
--- a/wp-admin/theme-editor.php
+++ b/wp-admin/theme-editor.php
@@ -73,7 +73,7 @@ default:
 	if (!$error) {
 		$f = fopen($real_file, 'r');
 		$content = fread($f, filesize($real_file));
-		$content = htmlspecialchars($content);
+		$content = wp_specialchars($content);
 	}
 
 	?>
diff --git a/wp-admin/user-edit.php b/wp-admin/user-edit.php
index 6aa8897429..e746257967 100644
--- a/wp-admin/user-edit.php
+++ b/wp-admin/user-edit.php
@@ -45,19 +45,19 @@ if ($_POST['pass1'] == '') {
 	$updatepassword = "user_pass=MD5('$new_pass'), ";
 }
 
-$new_user_login  = $_POST['new_user_login'];
-$new_firstname   = $_POST['new_firstname'];
-$new_lastname    = $_POST['new_lastname'];
+$new_user_login  = wp_specialchars($_POST['new_user_login']);
+$new_firstname   = wp_specialchars($_POST['new_firstname']);
+$new_lastname    = wp_specialchars($_POST['new_lastname']);
 $new_nickname    = $_POST['new_nickname'];
 $new_nicename    = sanitize_title($new_nickname, $user_id);
-$new_icq         = $_POST['new_icq'];
-$new_aim         = $_POST['new_aim'];
-$new_msn         = $_POST['new_msn'];
-$new_yim         = $_POST['new_yim'];
-$new_email       = $_POST['new_email'];
-$new_url         = $_POST['new_url'];
+$new_icq         = wp_specialchars($_POST['new_icq']);
+$new_aim         = wp_specialchars($_POST['new_aim']);
+$new_msn         = wp_specialchars($_POST['new_msn']);
+$new_yim         = wp_specialchars($_POST['new_yim']);
+$new_email       = wp_specialchars($_POST['new_email']);
+$new_url         = wp_specialchars($_POST['new_url']);
 $new_url         = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $new_url) ? $new_url : 'http://' . $new_url; 
-$new_idmode      = $_POST['new_idmode'];
+$new_idmode      = wp_specialchars($_POST['new_idmode']);
 $new_description = $_POST['new_description'];
 
 $result = $wpdb->query("UPDATE $wpdb->users SET user_login = '$new_user_login', user_firstname = '$new_firstname', $updatepassword user_lastname='$new_lastname', user_nickname='$new_nickname', user_icq='$new_icq', user_email='$new_email', user_url='$new_url', user_aim='$new_aim', user_msn='$new_msn', user_yim='$new_yim', user_idmode='$new_idmode', user_description = '$new_description', user_nicename = '$new_nicename' WHERE ID = $user_id");
@@ -195,7 +195,6 @@ if ($edituser->user_level >= $user_level) die( __('You do not have permission to
 <?php
 break;
 }
-	
-/* </Team> */
+
 include('admin-footer.php');
-?>
+?>
\ No newline at end of file
diff --git a/wp-admin/users.php b/wp-admin/users.php
index 2ab3f3fc8a..055cd61d14 100644
--- a/wp-admin/users.php
+++ b/wp-admin/users.php
@@ -4,7 +4,7 @@ require_once('admin.php');
 $title = __('Users');
 $parent_file = 'users.php';
 	
-$wpvarstoreset = array('action','standalone','redirect','profile');
+$wpvarstoreset = array('action');
 for ($i=0; $i<count($wpvarstoreset); $i += 1) {
 	$wpvar = $wpvarstoreset[$i];
 	if (!isset($$wpvar)) {
@@ -24,17 +24,13 @@ switch ($action) {
 case 'adduser':
 	check_admin_referer();
 
-	function filter($value)	{
-		return ereg('^[a-zA-Z0-9\_-\|]+$',$value);
-	}
-
-	$user_login = $_POST['user_login'];
-	$pass1 = $_POST['pass1'];
-	$pass2 = $_POST['pass2'];
-	$user_email = $_POST['email'];
-	$user_firstname = $_POST['firstname'];
-	$user_lastname = $_POST['lastname'];
-	$user_uri = $_POST['uri'];
+	$user_login     = wp_specialchars($_POST['user_login']);
+	$pass1          = $_POST['pass1'];
+	$pass2          = $_POST['pass2'];
+	$user_email     = wp_specialchars($_POST['email']);
+	$user_firstname = wp_specialchars($_POST['firstname']);
+	$user_lastname  = wp_specialchars($_POST['lastname']);
+	$user_uri       = wp_specialchars($_POST['uri']);
 		
 	/* checking login has been typed */
 	if ($user_login == '') {
@@ -130,7 +126,7 @@ case 'delete':
 
 	check_admin_referer();
 
-	$id = intval($_GET['id']);
+	$id = (int) $_GET['id'];
 
 	if (!$id) {
 		header('Location: users.php');
@@ -228,8 +224,8 @@ default:
 </div>
 
 <?php
-	$users = $wpdb->get_results("SELECT * FROM $wpdb->users WHERE user_level = 0 ORDER BY ID");
-	if ($users) {
+$users = $wpdb->get_results("SELECT * FROM $wpdb->users WHERE user_level = 0 ORDER BY ID");
+if ($users) {
 ?>
 <div class="wrap">
 	<h2><?php _e('Registered Users') ?></h2>
@@ -330,4 +326,4 @@ break;
 }
 
 include('admin-footer.php');
-?>
+?>
\ No newline at end of file
diff --git a/wp-comments-popup.php b/wp-comments-popup.php
index 57e6122f61..d27bb42db7 100644
--- a/wp-comments-popup.php
+++ b/wp-comments-popup.php
@@ -63,7 +63,7 @@ if (!empty($commentstatus->post_password) && $_COOKIE['wp-postpass_'. COOKIEHASH
 	  <input type="text" name="author" id="author" class="textarea" value="<?php echo $comment_author; ?>" size="28" tabindex="1" />
 	   <label for="author"><?php _e("Name"); ?></label>
 	<input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
-	<input type="hidden" name="redirect_to" value="<?php echo htmlspecialchars($_SERVER["REQUEST_URI"]); ?>" />
+	<input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER["REQUEST_URI"]); ?>" />
 	</p>
 
 	<p>
diff --git a/wp-comments.php b/wp-comments.php
index a92bc12d55..2a23ba1c03 100644
--- a/wp-comments.php
+++ b/wp-comments.php
@@ -41,7 +41,7 @@
 	  <input type="text" name="author" id="author" class="textarea" value="<?php echo $comment_author; ?>" size="28" tabindex="1" />
 	   <label for="author"><?php _e('Name'); ?></label> <?php if ($req) _e('(required)'); ?>
 	<input type="hidden" name="comment_post_ID" value="<?php echo $post->ID; ?>" />
-	<input type="hidden" name="redirect_to" value="<?php echo htmlspecialchars($_SERVER['REQUEST_URI']); ?>" />
+	<input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER['REQUEST_URI']); ?>" />
 	</p>
 
 	<p>
diff --git a/wp-includes/classes.php b/wp-includes/classes.php
index 7beb0e9f8d..853502d736 100644
--- a/wp-includes/classes.php
+++ b/wp-includes/classes.php
@@ -57,6 +57,7 @@ class WP_Query {
 		parse_str($query, $qv);
 		$this->query = $query;
 		$this->query_vars = $qv;
+		$qv['m'] =  (int) $qv['m'];
 
 		if ('' != $qv['name']) {
 			$this->is_single = true;
@@ -71,54 +72,53 @@ class WP_Query {
 			$this->is_single = false;
 		}
 
-		if ('' != $qv['second']) {
+		if ( (int) $qv['second']) {
 			$this->is_time = true;
 			$this->is_date = true;
 		}
 
-		if ('' != $qv['minute']) {
+		if ( (int) $qv['minute']) {
 			$this->is_time = true;
 			$this->is_date = true;
 		}
 
-		if ('' != $qv['hour']) {
+		if ( (int) $qv['hour']) {
 			$this->is_time = true;
-	    $this->is_date = true;
+			$this->is_date = true;
 		}
 
-		if ('' != $qv['day']) {
+		if ( (int) $qv['day']) {
 			if (! $this->is_date) {
 				$this->is_day = true;
 				$this->is_date = true;
 			}
 		}
 
-		if ('' != $qv['monthnum']) {
+		if ( (int)  $qv['monthnum']) {
 			if (! $this->is_date) {
 				$this->is_month = true;
 				$this->is_date = true;
 			}
 		}
 
-		if ('' != $qv['year']) {
+		if ( (int)  $qv['year']) {
 			if (! $this->is_date) {
 				$this->is_year = true;
 				$this->is_date = true;
 			}
 		}
 
-		if ('' != $qv['m']) {
+		if ( (int)  $qv['m']) {
 			$this->is_date = true;
-
 			if (strlen($qv['m']) > 9) {
-	      $this->is_time = true;
-	    } else if (strlen($qv['m']) > 7) {
-	      $this->is_day = true;
-	    } else if (strlen($qv['m']) > 5) {
-	      $this->is_month = true;
-	    } else {
-	      $this->is_year = true;
-	    }
+				$this->is_time = true;
+			} else if (strlen($qv['m']) > 7) {
+				$this->is_day = true;
+			} else if (strlen($qv['m']) > 5) {
+				$this->is_month = true;
+			} else {
+				$this->is_year = true;
+			}
 		}
 
 		if ('' != $qv['w']) {
@@ -232,7 +232,7 @@ class WP_Query {
 		$wp_posts_post_date_field = "post_date"; // "DATE_ADD(post_date, INTERVAL '$add_hours:$add_minutes' HOUR_MINUTE)";
 
 		// If a month is specified in the querystring, load that month
-		if ('' != $q['m']) {
+		if ( (int) $q['m'] ) {
 			$q['m'] = '' . preg_replace('|[^0-9]|', '', $q['m']);
 			$where .= ' AND YEAR(post_date)=' . substr($q['m'], 0, 4);
 			if (strlen($q['m'])>5)
@@ -247,32 +247,32 @@ class WP_Query {
 				$where .= ' AND SECOND(post_date)=' . substr($q['m'], 12, 2);
 		}
 
-		if ('' != $q['hour']) {
+		if ( (int) $q['hour'] ) {
 			$q['hour'] = '' . intval($q['hour']);
 			$where .= " AND HOUR(post_date)='" . $q['hour'] . "'";
 		}
 
-		if ('' != $q['minute']) {
+		if ( (int) $q['minute'] ) {
 			$q['minute'] = '' . intval($q['minute']);
 			$where .= " AND MINUTE(post_date)='" . $q['minute'] . "'";
 		}
 
-		if ('' != $q['second']) {
+		if ( (int) $q['second'] ) {
 			$q['second'] = '' . intval($q['second']);
 			$where .= " AND SECOND(post_date)='" . $q['second'] . "'";
 		}
 
-		if ('' != $q['year']) {
+		if ( (int) $q['year'] ) {
 			$q['year'] = '' . intval($q['year']);
 			$where .= " AND YEAR(post_date)='" . $q['year'] . "'";
 		}
 
-		if ('' != $q['monthnum']) {
+		if ( (int) $q['monthnum'] ) {
 			$q['monthnum'] = '' . intval($q['monthnum']);
 			$where .= " AND MONTH(post_date)='" . $q['monthnum'] . "'";
 		}
 
-		if ('' != $q['day']) {
+		if ( (int) $q['day'] ) {
 			$q['day'] = '' . intval($q['day']);
 			$where .= " AND DAYOFMONTH(post_date)='" . $q['day'] . "'";
 		}
@@ -287,15 +287,15 @@ class WP_Query {
 		}
 
 
-		if ('' != $q['w']) {
+		if ( (int) $q['w'] ) {
 			$q['w'] = ''.intval($q['w']);
 			$where .= " AND WEEK(post_date, 1)='" . $q['w'] . "'";
 		}
 
 		// If a post number is specified, load that post
 		if (($q['p'] != '') && ($q['p'] != 'all')) {
-			$q['p'] = intval($q['p']);
-			$where = ' AND ID = '.$q['p'];
+			$q['p'] =  (int) $q['p'];
+			$where = ' AND ID = ' . $q['p'];
 		}
 
 		if (($q['page_id'] != '') && ($q['page_id'] != 'all')) {
diff --git a/wp-includes/functions-formatting.php b/wp-includes/functions-formatting.php
index 7d9e7aaf8f..f3945d34a5 100644
--- a/wp-includes/functions-formatting.php
+++ b/wp-includes/functions-formatting.php
@@ -97,6 +97,18 @@ function seems_utf8($Str) { # by bmorel at ssi dot fr
 	return true;
 }
 
+function wp_specialchars( $text, $quotes = 0 ) {
+	// Like htmlspecialchars except don't double-encode HTML entities
+	$text = preg_replace('/&([^#])(?![a-z12]{1,8};)/', '&#038;$1', $text);-
+	$text = str_replace('<', '&lt;', $text);
+	$text = str_replace('>', '&gt;', $text);
+	if ( $quotes ) {
+		$text = str_replace('"', '&quot;', $text);
+		$text = str_replace('"', '&#039;', $text);
+	}
+	return $text;
+}
+
 function utf8_uri_encode( $utf8_string ) {
   $unicode = '';        
   $values = array();
diff --git a/wp-includes/functions-post.php b/wp-includes/functions-post.php
index dfacc3a857..0e20fcb2d7 100644
--- a/wp-includes/functions-post.php
+++ b/wp-includes/functions-post.php
@@ -389,12 +389,12 @@ function wp_new_comment($commentdata) {
 	$comment_post_ID = (int) $comment_post_ID;
 
 	$comment_author = strip_tags($comment_author);
-	$comment_author = htmlspecialchars($comment_author);
+	$comment_author = wp_specialchars($comment_author);
 
 	$comment_author_email = preg_replace('/[^a-z+_.@-]/i', '', $comment_author_email);
 
 	$comment_author_url = strip_tags($comment_author_url);
-	$comment_author_url = htmlspecialchars($comment_author_url);
+	$comment_author_url = wp_specialchars($comment_author_url);
 
 	$comment_content = apply_filters('comment_content_presave', $comment_content);
 
diff --git a/wp-includes/functions.php b/wp-includes/functions.php
index 74cef3506a..d2f130de60 100644
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -361,7 +361,7 @@ function get_option($option) {
 }
 
 function form_option($option) {
-	echo htmlspecialchars( get_option($option) );
+	echo htmlspecialchars( get_option($option), ENT_QUOTES );
 }
 
 function get_alloptions() {
diff --git a/wp-includes/links.php b/wp-includes/links.php
index eb691c4b98..e4690d947f 100644
--- a/wp-includes/links.php
+++ b/wp-includes/links.php
@@ -176,14 +176,14 @@ function get_links($category = -1, $before = '', $after = '<br />',
         }
         $the_link = '#';
         if (($row->link_url != null) && ($row->link_url != '')) {
-            $the_link = htmlspecialchars($row->link_url);
+            $the_link = wp_specialchars($row->link_url);
         }
         $rel = $row->link_rel;
         if ($rel != '') {
             $rel = " rel='$rel'";
         }
-        $desc = htmlspecialchars($row->link_description, ENT_QUOTES);
-        $name = htmlspecialchars($row->link_name, ENT_QUOTES);
+        $desc = wp_specialchars($row->link_description, ENT_QUOTES);
+        $name = wp_specialchars($row->link_name, ENT_QUOTES);
 
         $title = $desc;
 
diff --git a/wp-includes/template-functions-author.php b/wp-includes/template-functions-author.php
index 0f01367e64..da575e0fcc 100644
--- a/wp-includes/template-functions-author.php
+++ b/wp-includes/template-functions-author.php
@@ -72,7 +72,7 @@ function the_author_posts() {
 function the_author_posts_link($idmode='') {
     global $id, $authordata;
 
-    echo '<a href="' . get_author_link(0, $authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), htmlspecialchars(the_author($idmode, false))) . '">' . the_author($idmode, false) . '</a>';
+    echo '<a href="' . get_author_link(0, $authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars(the_author($idmode, false))) . '">' . the_author($idmode, false) . '</a>';
 }
 
 
@@ -141,7 +141,7 @@ function list_authors($optioncount = false, $exclude_admin = true, $show_fullnam
         if ($posts == 0) {
             if (! $hide_empty) echo $name;
         } else {
-            $link = '<a href="' . get_author_link(0, $author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), htmlspecialchars($author->user_nickname)) . '">' . $name . '</a>';
+            $link = '<a href="' . get_author_link(0, $author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars($author->user_nickname)) . '">' . $name . '</a>';
 
             if ( (! empty($feed_image)) || (! empty($feed)) ) {
                 
diff --git a/wp-includes/template-functions-category.php b/wp-includes/template-functions-category.php
index 431bc60393..b51058363f 100644
--- a/wp-includes/template-functions-category.php
+++ b/wp-includes/template-functions-category.php
@@ -356,9 +356,9 @@ function list_cats($optionall = 1, $all = 'All', $sort_column = 'ID', $sort_orde
 			$num_found++;
 			$link = '<a href="'.get_category_link(0, $category->cat_ID, $category->category_nicename).'" ';
 			if ($use_desc_for_title == 0 || empty($category->category_description)) {
-				$link .= 'title="'. sprintf(__("View all posts filed under %s"), htmlspecialchars($category->cat_name)) . '"';
+				$link .= 'title="'. sprintf(__("View all posts filed under %s"), wp_specialchars($category->cat_name)) . '"';
 			} else {
-				$link .= 'title="' . htmlspecialchars($category->category_description) . '"';
+				$link .= 'title="' . wp_specialchars($category->category_description) . '"';
 			}
 			$link .= '>';
 			$link .= apply_filters('list_cats', $category->cat_name).'</a>';
diff --git a/wp-includes/template-functions-comment.php b/wp-includes/template-functions-comment.php
index d7c3a7e81e..b0751fc86b 100644
--- a/wp-includes/template-functions-comment.php
+++ b/wp-includes/template-functions-comment.php
@@ -282,7 +282,7 @@ function comment_author_rss() {
 	if (empty($comment->comment_author)) {
 		echo 'Anonymous';
 	} else {
-		echo htmlspecialchars(apply_filters('comment_author', $comment->comment_author));
+		echo wp_specialchars(apply_filters('comment_author', $comment->comment_author));
 	}
 }
 
@@ -292,7 +292,7 @@ function comment_text_rss() {
 	$comment_text = str_replace('<pingback />', '', $comment_text);
 	$comment_text = apply_filters('comment_text', $comment_text);
 	$comment_text = strip_tags($comment_text);
-	$comment_text = htmlspecialchars($comment_text);
+	$comment_text = wp_specialchars($comment_text);
 	echo $comment_text;
 }
 
diff --git a/wp-includes/template-functions-general.php b/wp-includes/template-functions-general.php
index 32c40ef426..9b302f40e4 100644
--- a/wp-includes/template-functions-general.php
+++ b/wp-includes/template-functions-general.php
@@ -235,7 +235,7 @@ function single_month_title($prefix = '', $display = true ) {
 /* link navigation hack by Orien http://icecode.com/ */
 function get_archives_link($url, $text, $format = 'html', $before = '', $after = '') {
 	$text = wptexturize($text);
-    $title_text = htmlspecialchars($text, ENT_QUOTES);
+    $title_text = wp_specialchars($text, 1);
 
 	if ('link' == $format) {
 		return "\t<link rel='archives' title='$title_text' href='$url' />\n";
diff --git a/wp-includes/template-functions-post.php b/wp-includes/template-functions-post.php
index ec25c3c109..afd0542cc1 100644
--- a/wp-includes/template-functions-post.php
+++ b/wp-includes/template-functions-post.php
@@ -69,7 +69,7 @@ function the_content_rss($more_link_text='(more...)', $stripteaser=0, $more_file
 		$encode_html = 2;
 	}
 	if ($encode_html == 1) {
-		$content = htmlspecialchars($content);
+		$content = wp_specialchars($content);
 		$cut = 0;
 	} elseif ($encode_html == 0) {
 		$content = make_url_footnote($content);
@@ -146,7 +146,7 @@ function the_excerpt_rss($cut = 0, $encode_html = 0) {
         $encode_html = 2;
     }
     if ($encode_html == 1) {
-        $output = htmlspecialchars($output);
+        $output = wp_specialchars($output);
         $cut = 0;
     } elseif ($encode_html == 0) {
         $output = make_url_footnote($output);
@@ -334,7 +334,7 @@ function wp_list_pages($args = '') {
 
 		$title = apply_filters('the_title', $page->post_title);
 
-		echo '<a href="' . get_page_link($page->ID) . '" title="' . htmlspecialchars($title) . '">' . $title . '</a>';
+		echo '<a href="' . get_page_link($page->ID) . '" title="' . wp_specialchars($title) . '">' . $title . '</a>';
 		echo '</li>';
 	}
 }
diff --git a/wp-includes/vars.php b/wp-includes/vars.php
index 620787eca5..cb9426e889 100644
--- a/wp-includes/vars.php
+++ b/wp-includes/vars.php
@@ -182,7 +182,7 @@ foreach($wpsmiliestrans as $smiley => $img) {
 define('COOKIEPATH', preg_replace('|https?://[^/]+|i', '', get_settings('home') . '/' ) );
 
 // Some default filters
-add_filter('bloginfo','htmlspecialchars');
+add_filter('bloginfo','wp_specialchars');
 add_filter('category_description', 'wptexturize');
 add_filter('list_cats', 'wptexturize');
 add_filter('comment_author', 'wptexturize');
diff --git a/wp-links-opml.php b/wp-links-opml.php
index 4822e202ea..dd1aaf932f 100644
--- a/wp-links-opml.php
+++ b/wp-links-opml.php
@@ -43,12 +43,12 @@ FROM $wpdb->links
 <?php
              } // end if not first time
 ?>
-        <outline type="category" title="<?php echo(htmlspecialchars(stripslashes($result->cat_name))) ?>">
+        <outline type="category" title="<?php echo wp_specialchars($result->cat_name); ?>">
 <?php
              $prev_cat_id = $result->link_category;
         } // end if new category
 ?>
-            <outline title="<?php echo(htmlspecialchars(stripslashes($result->link_name))) ?>" type="link" xmlUrl="<?php echo $result->link_rss; ?>" htmlUrl="<?php echo($result->link_url) ?>"/>
+            <outline title="<?php echo wp_specialchars($result->link_name); ?>" type="link" xmlUrl="<?php echo $result->link_rss; ?>" htmlUrl="<?php echo($result->link_url) ?>"/>
 <?php
         } // end foreach
     } // end if
diff --git a/wp-trackback.php b/wp-trackback.php
index 18285ffc40..31b29415a6 100644
--- a/wp-trackback.php
+++ b/wp-trackback.php
@@ -82,11 +82,11 @@ if ( !empty($tb_url) && !empty($title) && !empty($tb_url) ) {
 	if ('closed' == $pingstatus)
 		trackback_response(1, 'Sorry, trackbacks are closed for this item.');
 
-	$title = strip_tags( htmlspecialchars( $title ) );
+	$title =  wp_specialchars( strip_tags( $title ) );
 	$title = (strlen($title) > 250) ? substr($title, 0, 250) . '...' : $title;
 	$excerpt = strip_tags($excerpt);
 	$excerpt = (strlen($excerpt) > 255) ? substr($excerpt, 0, 252) . '...' : $excerpt;
-	$blog_name = htmlspecialchars($blog_name);
+	$blog_name = wp_specialchars($blog_name);
 	$blog_name = (strlen($blog_name) > 250) ? substr($blog_name, 0, 250) . '...' : $blog_name;
 
 	$comment_post_ID = $tb_id;
diff --git a/xmlrpc.php b/xmlrpc.php
index 766127ce6f..a6558ac8b7 100644
--- a/xmlrpc.php
+++ b/xmlrpc.php
@@ -763,8 +763,8 @@ class wp_xmlrpc_server extends IXR_Server {
 	      $struct['categoryId'] = $cat['cat_ID'];
 	      $struct['description'] = $cat['cat_name'];
 	      $struct['categoryName'] = $cat['cat_name'];
-	      $struct['htmlUrl'] = htmlspecialchars(get_category_link(false, $cat['cat_ID'], $cat['cat_name']));
-	      $struct['rssUrl'] = htmlspecialchars(get_category_rss_link(false, $cat['cat_ID'], $cat['cat_name']));
+	      $struct['htmlUrl'] = wp_specialchars(get_category_link(false, $cat['cat_ID'], $cat['cat_name']));
+	      $struct['rssUrl'] = wp_specialchars(get_category_rss_link(false, $cat['cat_ID'], $cat['cat_name']));
 
 	      $categories_struct[] = $struct;
 	    }
@@ -1213,7 +1213,7 @@ class wp_xmlrpc_server extends IXR_Server {
 		$title = (!strlen($matchtitle[1])) ? $pagelinkedfrom : $matchtitle[1];
 		$original_context = strip_tags($context);
 		$context = '[...] ';
-		$context = htmlspecialchars($original_context);
+		$context = wp_specialchars($original_context);
 		$context .= ' [...]';
 		$original_pagelinkedfrom = $pagelinkedfrom;
 		$pagelinkedfrom = addslashes($pagelinkedfrom);