Ensure URIs are escaped before being output

dxw · Feb 12, 2025 · cc43edc · cc43edc
1 parent c378841
commit cc43edc
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/lib/pagination.php b/lib/pagination.php
@@ -58,7 +58,7 @@ function pagination($q = null, $mode = null, $uri = null)
 		}
 		printf('<a href="%s" rel="previous">
       Previous <span class="hidden">page</span>
-    </a>', $uri);
+    </a>', esc_url($uri));
 		echo "</div>";
 	}
 
@@ -116,7 +116,7 @@ function pagination($q = null, $mode = null, $uri = null)
     <a href="%s" rel="next">
       Next <span class="hidden">page</span>
     </a>
-  </div>', $uri);
+  </div>', esc_url($uri));
 	}
 
 	$_SERVER['REQUEST_URI'] = $_;