wp_insert_post incorrectly escapes HTML comments when they include tags

The following program:

<?php

$_SERVER['HTTP_HOST'] = 'localhost';
require_once('wp-load.php');

$post = array(
  'post_title' => 'HTML Escape',
  'post_content' => 'This is <!-- a comment --><br/>This is <!-- <p>a comment</p> -->',
  'post_status' => 'publish'
);

$id = wp_insert_post($post);
$post = get_post($id);
var_export( esc_html( $post->post_content ) );
?>

Outputs the following in the browser:

'This is <!-- a comment --><br/>This is <!-- <p>a comment</p> -->'

So it looks like your loop might be the one that is changing the post content.

Leave a Comment