Correctly check presence with stripos

sirreal · westonruter · web-flow · commit 2ea6a12b257b · 2025-12-18T12:23:38.000+01:00
Co-authored-by: Weston Ruter &lt;westonruter@gmail.com&gt;
diff --git a/src/wp-includes/customize/class-wp-customize-custom-css-setting.php b/src/wp-includes/customize/class-wp-customize-custom-css-setting.php
@@ -171,7 +171,7 @@ public function validate( $value ) {
 		 *
 		 * @see https://html.spec.whatwg.org/multipage/parsing.html#generic-raw-text-element-parsing-algorithm
 		 */
-		if ( stripos( $css, '</style' ) ) {
+		if ( false !== stripos( $css, '</style' ) ) {
 			$validity->add( 'illegal_markup', __( 'CSS must not contain possible closing STYLE tag "</style".' ) );
 		}
 
diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php
@@ -677,7 +677,7 @@ protected function validate_custom_css( $css ) {
 		 *
 		 * @see https://html.spec.whatwg.org/multipage/parsing.html#generic-raw-text-element-parsing-algorithm
 		 */
-		if ( stripos( $css, '</style' ) ) {
+		if ( false !== stripos( $css, '</style' ) ) {
 			return new WP_Error(
 				'rest_custom_css_illegal_markup',
 				__( 'Markup is not allowed in CSS.' ),

Original file line number	Diff line number	Diff line change
`@@ -171,7 +171,7 @@ public function validate( $value ) {`
`171`	`171`	`*`
`172`	`172`	`* @see https://html.spec.whatwg.org/multipage/parsing.html#generic-raw-text-element-parsing-algorithm`
`173`	`173`	`*/`
`174`		`- if ( stripos( $css, '</style' ) ) {`
	`174`	`+ if ( false !== stripos( $css, '</style' ) ) {`
`175`	`175`	`$validity->add( 'illegal_markup', __( 'CSS must not contain possible closing STYLE tag "</style".' ) );`
`176`	`176`	`}`
`177`	`177`
Original file line number	Diff line number	Diff line change
`@@ -677,7 +677,7 @@ protected function validate_custom_css( $css ) {`
`677`	`677`	`*`
`678`	`678`	`* @see https://html.spec.whatwg.org/multipage/parsing.html#generic-raw-text-element-parsing-algorithm`
`679`	`679`	`*/`
`680`		`- if ( stripos( $css, '</style' ) ) {`
	`680`	`+ if ( false !== stripos( $css, '</style' ) ) {`
`681`	`681`	`return new WP_Error(`
`682`	`682`	`'rest_custom_css_illegal_markup',`
`683`	`683`	`__( 'Markup is not allowed in CSS.' ),`