| @@ -526,8 +526,10 @@ | ||
| 526 | 526 | $tag = $this->enhance_existing_srcset( $tag, $new_srcset_entries, $is_slashed ); |
| 527 | 527 | } else { |
| 528 | 528 | // Add new srcset attribute |
| 529 | 529 | $srcset_value = implode( ', ', $new_srcset_entries ); |
| 530 | + // Escape backreference metacharacters so this value can't be expanded by preg_replace() below. | |
| 531 | + $srcset_value = addcslashes( $srcset_value, '\\$' ); | |
| 530 | 532 | $srcset_attr = $is_slashed ? 'srcset=\"' . addcslashes( $srcset_value, '"' ) . '\"' : 'srcset="' . $srcset_value . '"'; |
| 531 | 533 | |
| 532 | 534 | // Insert srcset attribute after the src attribute |
| 533 | 535 | $tag = preg_replace( '/(src=["\'][^"\']*["\'])/i', '$1 ' . $srcset_attr, $tag ); |
| @@ -571,8 +573,10 @@ | ||
| 571 | 573 | } |
| 572 | 574 | ); |
| 573 | 575 | |
| 574 | 576 | $sizes_value = implode( ', ', $sizes_entries ); |
| 577 | + // Escape backreference metacharacters before wrapping, see add_missing_srcset_attributes() above. | |
| 578 | + $sizes_value = addcslashes( $sizes_value, '\\$' ); | |
| 575 | 579 | $sizes_attr = $is_slashed ? 'sizes=\"' . addcslashes( $sizes_value, '"' ) . '\"' : 'sizes="' . $sizes_value . '"'; |
| 576 | 580 | |
| 577 | 581 | // Insert sizes attribute after srcset |
| 578 | 582 | $tag = preg_replace( '/(srcset=["\'][^"\']*["\'])/i', '$1 ' . $sizes_attr, $tag ); |
| @@ -625,8 +629,10 @@ | ||
| 625 | 629 | } |
| 626 | 630 | ); |
| 627 | 631 | |
| 628 | 632 | $enhanced_srcset = implode( ', ', $all_entries ); |
| 633 | + // Escape backreference metacharacters so this value can't be expanded by preg_replace() below. | |
| 634 | + $enhanced_srcset = addcslashes( $enhanced_srcset, '\\$' ); | |
| 629 | 635 | $srcset_attr = $is_slashed ? 'srcset=\"' . addcslashes( $enhanced_srcset, '"' ) . '\"' : 'srcset="' . $enhanced_srcset . '"'; |
| 630 | 636 | |
| 631 | 637 | // Replace existing srcset |
| 632 | 638 | $tag = preg_replace( '/srcset=["\'][^"\']*["\']/i', $srcset_attr, $tag ); |
| @@ -666,8 +672,10 @@ | ||
| 666 | 672 | } |
| 667 | 673 | ); |
| 668 | 674 | |
| 669 | 675 | $enhanced_sizes = implode( ', ', $all_entries ); |
| 676 | + // Escape backreference metacharacters before wrapping, see enhance_existing_srcset() above. | |
| 677 | + $enhanced_sizes = addcslashes( $enhanced_sizes, '\\$' ); | |
| 670 | 678 | $sizes_attr = $is_slashed ? 'sizes=\"' . addcslashes( $enhanced_sizes, '"' ) . '\"' : 'sizes="' . $enhanced_sizes . '"'; |
| 671 | 679 | |
| 672 | 680 | // Replace existing sizes |
| 673 | 681 | $tag = preg_replace( '/sizes=["\'][^"\']*["\']/i', $sizes_attr, $tag ); |
