Search term should be escaped but not sanitized

xwp · Jul 18, 2024 · c33a537 · c33a537
1 parent c7787cd
commit c33a537
Showing 1 changed file with 1 addition and 5 deletions.
diff --git a/classes/class-list-table.php b/classes/class-list-table.php
@@ -908,18 +908,14 @@ public function filter_option( $args ) {
 	 * @return void
 	 */
 	public function filter_search() {
-		$search = null;
-		if ( isset( $_GET['search'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-			$search = sanitize_key( wp_unslash( $_GET['search'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-		}
 		printf(
 			'<p class="search-box">
 				<label class="screen-reader-text" for="record-search-input">%1$s:</label>
 				<input type="search" id="record-search-input" name="search" value="%2$s" />
 				<input type="submit" name="" id="search-submit" class="button" value="%3$s" />
 			</p>',
 			esc_html__( 'Search Records', 'stream' ),
-			esc_attr( $search ),
+			esc_attr( ! empty( $_GET['search'] ) ? $_GET['search'] : '' ), // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 			esc_attr__( 'Search Records', 'stream' )
 		);
 	}