Assume that url_shorten() receives unslashed data, as it does in core usage. see #21767.



git-svn-id: https://core.svn.wordpress.org/trunk@23575 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Unslash early, directly on the superglobal. see #21767.



git-svn-id: https://core.svn.wordpress.org/trunk@23576 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Remove an unslash in the deprecated WP_User_Search, as search_term is already unslashed in the constructor. see #21767.



git-svn-id: https://core.svn.wordpress.org/trunk@23577 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Ensure the referer functions operate completely on unslashed data: wp_referer_field(), wp_original_referer_field(), wp_get_referer(), wp_get_original_referer().

Use wp_slash() instead of addslashes().

see #21767.



git-svn-id: https://core.svn.wordpress.org/trunk@23578 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Use distinct error code in wp_authenticate_username_password() when user is a spammer. props sirzooro. fixes #19445.

git-svn-id: https://core.svn.wordpress.org/trunk@23579 1a063a9b-81f0-0310-95a4-ce76da25c4cd