Skip to content

Script Loader: Deprecate wp_sanitize_script_attributes() #10742

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sirreal wants to merge 5 commits into
base: trunk
Choose a base branch
from
+36 −31
Open

Script Loader: Deprecate wp_sanitize_script_attributes() #10742

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fbe4635
Deprecate wp_sanitize_script_attributes()
sirreal Jan 15, 2026
cab23a2
Add deprecation expectation to tests
sirreal Jan 15, 2026
6d024aa
Add trailing period to deprecated annotation.
sirreal Jan 15, 2026
33c12e6
Move to deprecated.php
sirreal Jan 15, 2026
7159a13
Merge branch 'trunk' into 64511/deprecate-wp_sanitize_script_attributes
sirreal Jan 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions src/wp-includes/deprecated.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6479,3 +6479,33 @@ function wp_print_auto_sizes_contain_css_fix() {
<style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style>
<?php
}

/**
* Sanitizes an attributes array into an attributes string to be placed inside a `<script>` tag.
*
* This function is deprecated, use {@see wp_get_script_tag()} or {@see wp_get_inline_script_tag()} instead.
*
* @since 5.7.0
* @deprecated 7.0.0 Use wp_get_script_tag() or wp_get_inline_script_tag().
* @see wp_get_script_tag()
* @see wp_get_inline_script_tag()
*
* @param array<string, string|bool> $attributes Key-value pairs representing `<script>` tag attributes.
* @return string String made of sanitized `<script>` tag attributes.
*/
function wp_sanitize_script_attributes( $attributes ) {
_deprecated_function( __FUNCTION__, '7.0.0', 'wp_get_script_tag() or wp_get_inline_script_tag()' );

$attributes_string = '';
foreach ( $attributes as $attribute_name => $attribute_value ) {
if ( is_bool( $attribute_value ) ) {
if ( $attribute_value ) {
$attributes_string .= ' ' . esc_attr( $attribute_name );
}
} else {
$attributes_string .= sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_value ) );
}
}
return $attributes_string;
}

31 changes: 0 additions & 31 deletions src/wp-includes/script-loader.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2874,37 +2874,6 @@ function wp_enqueue_editor_format_library_assets() {
wp_enqueue_style( 'wp-format-library' );
}

/**
* Sanitizes an attributes array into an attributes string to be placed inside a `<script>` tag.
*
* Automatically injects type attribute if needed.
* Used by {@see wp_get_script_tag()} and {@see wp_get_inline_script_tag()}.
*
* @since 5.7.0
*
* @param array<string, string|bool> $attributes Key-value pairs representing `<script>` tag attributes.
* @return string String made of sanitized `<script>` tag attributes.
*/
function wp_sanitize_script_attributes( $attributes ) {
$attributes_string = '';

/*
* If HTML5 script tag is supported, only the attribute name is added
* to $attributes_string for entries with a boolean value, and that are true.
*/
foreach ( $attributes as $attribute_name => $attribute_value ) {
if ( is_bool( $attribute_value ) ) {
if ( $attribute_value ) {
$attributes_string .= ' ' . esc_attr( $attribute_name );
}
} else {
$attributes_string .= sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_value ) );
}
}

return $attributes_string;
}

/**
* Formats `<script>` loader tags.
*
Expand Down
6 changes: 6 additions & 0 deletions tests/phpunit/tests/dependencies/wpSanitizeScriptAttributes.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
class Tests_Dependencies_wpSanitizeScriptAttributes extends WP_UnitTestCase {

public function test_sanitize_script_attributes_type_set() {
$this->setExpectedDeprecated( 'wp_sanitize_script_attributes' );
$this->assertSame(
' type="application/javascript" src="https://DOMAIN.TLD/PATH/FILE.js" nomodule',
wp_sanitize_script_attributes(
Expand All @@ -24,6 +25,7 @@ public function test_sanitize_script_attributes_type_set() {
}

public function test_sanitize_script_attributes_type_not_set() {
$this->setExpectedDeprecated( 'wp_sanitize_script_attributes' );
$this->assertSame(
' src="https://DOMAIN.TLD/PATH/FILE.js" nomodule',
wp_sanitize_script_attributes(
Expand All @@ -38,13 +40,15 @@ public function test_sanitize_script_attributes_type_not_set() {


public function test_sanitize_script_attributes_no_attributes() {
$this->setExpectedDeprecated( 'wp_sanitize_script_attributes' );
$this->assertSame(
'',
wp_sanitize_script_attributes( array() )
);
}

public function test_sanitize_script_attributes_relative_src() {
$this->setExpectedDeprecated( 'wp_sanitize_script_attributes' );
$this->assertSame(
' src="PATH/FILE.js" nomodule',
wp_sanitize_script_attributes(
Expand All @@ -59,6 +63,7 @@ public function test_sanitize_script_attributes_relative_src() {


public function test_sanitize_script_attributes_only_false_boolean_attributes() {
$this->setExpectedDeprecated( 'wp_sanitize_script_attributes' );
$this->assertSame(
'',
wp_sanitize_script_attributes(
Expand All @@ -71,6 +76,7 @@ public function test_sanitize_script_attributes_only_false_boolean_attributes()
}

public function test_sanitize_script_attributes_only_true_boolean_attributes() {
$this->setExpectedDeprecated( 'wp_sanitize_script_attributes' );
$this->assertSame(
' async nomodule',
wp_sanitize_script_attributes(
Expand Down
Loading