@@ -607,7 +607,7 @@ public function get_error_message() {
607607 $ output .= '<p> ' . __ ( 'Queries made or created this session were: ' , 'sqlite-database-integration ' ) . '</p> ' ;
608608 $ output .= '<ol> ' ;
609609 foreach ( $ this ->queries as $ q ) {
610- $ output .= '<li> ' . $ q . '</li> ' ;
610+ $ output .= '<li> ' . esc_html ( $ q ) . '</li> ' ;
611611 }
612612 $ output .= '</ol> ' ;
613613 $ output .= '</div> ' ;
@@ -1301,7 +1301,8 @@ private function set_error( $line, $function, $message ) {
13011301 private function convert_to_object () {
13021302 $ _results = array ();
13031303 if ( count ( $ this ->results ) === 0 ) {
1304- echo wp_kses_post ( $ this ->get_error_message () );
1304+ // These messages are properly escaped in the function.
1305+ echo $ this ->get_error_message ();
13051306 } else {
13061307 foreach ( $ this ->results as $ row ) {
13071308 $ _results [] = new WP_SQLite_Object_Array ( $ row );
@@ -1329,7 +1330,8 @@ private function convert_to_columns_object() {
13291330 'Extra ' => '' ,
13301331 );
13311332 if ( empty ( $ this ->_results ) ) {
1332- echo wp_kses_post ( $ this ->get_error_message () );
1333+ // These messages are properly escaped in the function.
1334+ echo $ this ->get_error_message ();
13331335 } else {
13341336 foreach ( $ this ->_results as $ row ) {
13351337 if ( ! is_object ( $ row ) ) {
@@ -1381,7 +1383,8 @@ private function convert_to_index_object() {
13811383 'Comment ' => '' ,
13821384 );
13831385 if ( 0 === count ( $ this ->_results ) ) {
1384- echo wp_kses_post ( $ this ->get_error_message () );
1386+ // These messages are properly escaped in the function.
1387+ echo $ this ->get_error_message ();
13851388 } else {
13861389 foreach ( $ this ->_results as $ row ) {
13871390 if ( 'table ' === $ row ->type && ! stripos ( $ row ->sql , 'primary ' ) ) {
0 commit comments