WP-API · joehoyle · Dec 1, 2015 · Nov 27, 2015 · Nov 29, 2015 · Nov 30, 2015
diff --git a/lib/endpoints/class-wp-rest-posts-controller.php b/lib/endpoints/class-wp-rest-posts-controller.php
@@ -251,8 +251,8 @@ public function update_item( $request ) {
 		if ( is_wp_error( $post ) ) {
 			return $post;
 		}
-
-		$post_id = wp_update_post( $post, true );
+		// convert the post object to an array, otherwise wp_update_post will expect non-escaped input
+		$post_id = wp_update_post( (array) $post, true );
 		if ( is_wp_error( $post_id ) ) {
 			if ( in_array( $post_id->get_error_code(), array( 'db_update_error' ) ) ) {
 				$post_id->add_data( array( 'status' => 500 ) );

diff --git a/tests/test-rest-posts-controller.php b/tests/test-rest-posts-controller.php
@@ -727,6 +727,19 @@ public function test_create_post_with_invalid_date_gmt() {
 		$this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
 	}

+	public function test_create_post_with_quotes_in_title() {
+		wp_set_current_user( $this->editor_id );
+
+		$request = new WP_REST_Request( 'POST', '/wp/v2/posts' );
+		$params = $this->set_post_data( array(
+			'title' => "Rob O'Rourke's Diary",
+		) );
+		$request->set_body_params( $params );
+		$response = $this->server->dispatch( $request );
+		$new_data = $response->get_data();
+		$this->assertEquals( "Rob O'Rourke's Diary", $new_data['title']['raw'] );
+	}
+
 	public function test_update_item() {
 		wp_set_current_user( $this->editor_id );

@@ -1023,6 +1036,19 @@ public function test_update_password_protected_post_with_sticky_fails() {
 		$this->assertErrorResponse( 'rest_invalid_field', $response, 400 );
 	}

+	public function test_update_post_with_quotes_in_title() {
+		wp_set_current_user( $this->editor_id );
+
+		$request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', $this->post_id ) );
+		$params = $this->set_post_data( array(
+			'title' => "Rob O'Rourke's Diary",
+		) );
+		$request->set_body_params( $params );
+		$response = $this->server->dispatch( $request );
+		$new_data = $response->get_data();
+		$this->assertEquals( "Rob O'Rourke's Diary", $new_data['title']['raw'] );
+	}
+
 	public function test_delete_item() {
 		$post_id = $this->factory->post->create( array( 'post_title' => 'Deleted post' ) );
 		wp_set_current_user( $this->editor_id );