Early sanitization, late escaping

[peterwilsoncc]

I've made some minor changes to escaping and sanitization for use on a client site. At the moment, they're defensive coding rather than to protect against any flaws.

The changes I've made are:

• unslash and sanitize user (GET, POST, REQUEST) data as read
• add a few instances of escaping: mainly to stop trusting translations

[justintadlock]

I'm not going to accept this pull request because there's a lot of stuff I'm seeing that's simply unnecessary. Mostly, this is when something's already been sanitized or escaped at a different point in the flow. Or, times where the code is checking against a whitelist of accepted values.

However, I am going to keep this open because there's some useful items in there that I'd like to use in the next version.

[peterwilsoncc]

That's fair enough. I wanted to get in the hardening in early/late and leave you the gift of removing the other items the flow :)

Core has been caught out by missing the sanitize early, escape late rule in a few recent releases, so it's something I keep in mind these days.