From 4172074cea70fdce46e3f9f73bc6fdf4a336997b Mon Sep 17 00:00:00 2001 From: Jon Surrell Date: Thu, 21 Aug 2025 16:26:07 +0200 Subject: [PATCH 1/2] With no `e` eval PCRE flag, remove stripslashes --- src/wp-includes/kses.php | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/wp-includes/kses.php b/src/wp-includes/kses.php index a94542ead0b54..c401c119716ec 100644 --- a/src/wp-includes/kses.php +++ b/src/wp-includes/kses.php @@ -1097,8 +1097,6 @@ function _wp_kses_split_callback( $matches ) { * @return string Fixed HTML element */ function wp_kses_split2( $content, $allowed_html, $allowed_protocols ) { - $content = wp_kses_stripslashes( $content ); - /* * The regex pattern used to split HTML into chunks attempts * to split on HTML token boundaries. This function should From 881191dc74f105d8efaf60426d15ae416f4de46b Mon Sep 17 00:00:00 2001 From: Jon Surrell Date: Thu, 21 Aug 2025 16:48:18 +0200 Subject: [PATCH 2/2] Deprecate it. --- src/wp-includes/kses.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/wp-includes/kses.php b/src/wp-includes/kses.php index c401c119716ec..91924f7173a90 100644 --- a/src/wp-includes/kses.php +++ b/src/wp-includes/kses.php @@ -1818,10 +1818,13 @@ function wp_kses_no_null( $content, $options = null ) { * * @since 1.0.0 * + * @deprecated 6.9.0 Not necessary since the `e` PCRE modifier was removed in PHP 7.0. + * * @param string $content String to strip slashes from. * @return string Fixed string with quoted slashes. */ function wp_kses_stripslashes( $content ) { + _deprecated_function( __FUNCTION__, '6.9.0' ); return preg_replace( '%\\\\"%', '"', $content ); }