Skip to content

Commit 2f8089f

Browse files
committed
EscapeOutput: add highlight_string() to escaping functions
While intended for code highlighting of PHP code, based on some tests I've run, the output of the PHP native `highlight_string()` function does appear to be safe, so I'm proposing to add this to the list of `$escapingFunctions`. Note: I'd appreciate some scrutiny of this PR. I wouldn't want to inadvertently add an unsafe function to the list. Refs: * https://3v4l.org/mYK5A * https://www.php.net/manual/en/function.highlight-string.php
1 parent 45ecdf0 commit 2f8089f

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

WordPress/Sniff.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ abstract class Sniff implements PHPCS_Sniff {
149149
'filter_input' => true,
150150
'filter_var' => true,
151151
'floatval' => true,
152+
'highlight_string' => true,
152153
'intval' => true,
153154
'json_encode' => true,
154155
'like_escape' => true,

0 commit comments

Comments
 (0)