id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
7423	in WP_Query, sanitization breaks usage of multiple post_status values	markjaquith	markjaquith	"I was trying to get WP_Query to give me all draft OR future posts by other authors, but found that it would not accept comma-separated post_status values.  Turns out we're using {{{sanitize_user()}}} on the query values of post_status which breaks that functionality.  We need to allow commas so that WP_Query can process {{{post_status=draft,future}}}

Switching that {{{sanitize_user()}}} line to a {{{[^a-z0-9,_-] preg_replace()}}} sanitization line allowed my WP_Query call to work as intended.

We're also doing that sanitization on post_type, but it doesn't look like the functionality to accept multiple post_type values is there (and it's certainly less useful than accepting multiple post_statuses)."	defect (bug)	closed	high	2.6.1	General	2.6	normal	fixed