Batch operations example doesn't do proper sanitizing

Good catch!

This issue relates to http://api.drupal.org/api/group/batch/6

That page already has a note:

Note: if the batch 'title', 'init_message', 'progress_message', or 'error_message' could contain any user input, it is the responsibility of the code calling batch_set() to sanitize them first with a function like check_plain() or filter_xss().

But then the example code doesn't actually do that.

I'm not sure whether the 'results' have to be check_plain()'ed though... Someone should verify that.

The D7 version of this documentation is nearly (or completely?) identical, and suffers from the same problem. So it should be fixed there first and then ported back to D6.

If that's the case, then that should be added to the note about sanitizing the other stuff.

This patch adds check_plain() around user input in both examples. Also extended the note that lists the fields that require sanitizing.

Looks good -- thanks for the patch!

One thing: we need to leave the version at 8.x, commit to 8.x first, and then to 7.x. The reason being that we don't want older versions of Drupal to have fixes that the newer versions don't already have. So I am setting the version to 8.x and clicking "re-test" so that the test bot can verify that the patch applies and doesn't break anything in the 8.x code base.

#5: 852120-5-batch-example-sanitize.patch queued for re-testing.

Committed to 7.x and 8.x. Thanks!