wp_insert_post incorrectly escapes HTML comments when they include tags

Question

I'm working on writing a script to import data from a custom CMS into Wordpress. As part of this, I need to import the post content exactly, without modifying anything. However, some of the posts contain HTML comments which contain tags, and this seems to be confusing Wordpress.

I've distilled my script down into a small representative example:

<?php

$_SERVER['HTTP_HOST'] = 'localhost';
require_once('/var/www/wordpress/wp-load.php');

$post = array(
  'post_content' => 'This is <!-- a comment -->',
  'post_status' => 'publish'
);

wp_insert_post($post);

This works fine, and I get exactly what you would expect. If I view the source of the post in my browser, I get:

<div class="entry-content">
  <p>This is <!-- a comment --></p>
</div><!-- .entry-content -->

But if my comment contains tags in it (for example, replace the post_content with This is <!-- <p>a comment</p> -->), Wordpress escapes the comment delimiters and parses the tags inside. The comment becomes visible, and when I view source, it looks like this:

<div class="entry-content">
  <p>This is &lt;!&#8211;
    <p>a comment</p>
  <p> &#8211;&gt;</p>
</div><!-- .entry-content -->

How can I prevent Wordpress from breaking the comment delimiters and parsing the tags inside? For the record, I'm on Wordpress 3.3.1 in Ubuntu 12.04.

EDIT: Just tried it on Wordpress 3.4; the problem still occurs.

Answer 1

The following program:

<?php

$_SERVER['HTTP_HOST'] = 'localhost';
require_once('wp-load.php');

$post = array(
  'post_title' => 'HTML Escape',
  'post_content' => 'This is <!-- a comment --><br/>This is <!-- <p>a comment</p> -->',
  'post_status' => 'publish'
);

$id = wp_insert_post($post);
$post = get_post($id);
var_export( esc_html( $post->post_content ) );
?>

Outputs the following in the browser:

'This is <!-- a comment --><br/>This is <!-- <p>a comment</p> -->'

So it looks like your loop might be the one that is changing the post content.