Ticket #12416: 12416.3.diff

wp-includes/meta.php

@@ -21 +21 @@
  *
  * @param string $meta_type Type of object metadata is for (e.g., comment, post, or user)
  * @param int $object_id ID of the object metadata is for
- * @param string $meta_key Metadata key
+ * @param string $meta_key Metadata key. Expected unslashed.
  * @param string $meta_value Metadata value
  * @param bool $unique Optional, default is false.  Whether the specified metadata key should be
  *              unique for the object.  If true, and the object already has a value for the specified
@@ -42 +42 @@
 
         $column = esc_sql($meta_type . '_id');
 
-        // expected_slashed ($meta_key)
-        $meta_key = stripslashes($meta_key);
-
         if ( $unique && $wpdb->get_var( $wpdb->prepare(
                 "SELECT COUNT(*) FROM $table WHERE meta_key = %s AND $column = %d",
                 $meta_key, $object_id ) ) )
@@ -82 +79 @@
  *
  * @param string $meta_type Type of object metadata is for (e.g., comment, post, or user)
  * @param int $object_id ID of the object metadata is for
- * @param string $meta_key Metadata key
+ * @param string $meta_key Metadata key. Expected unslashed.
  * @param string $meta_value Metadata value
  * @param string $prev_value Optional.  If specified, only update existing metadata entries with
  *              the specified value.  Otherwise, update all entries.
@@ -103 +100 @@
         $column = esc_sql($meta_type . '_id');
         $id_column = 'user' == $meta_type ? 'umeta_id' : 'meta_id';
 
-        // expected_slashed ($meta_key)
-        $meta_key = stripslashes($meta_key);
-
         if ( ! $meta_id = $wpdb->get_var( $wpdb->prepare( "SELECT $id_column FROM $table WHERE meta_key = %s AND $column = %d", $meta_key, $object_id ) ) )
                 return add_metadata($meta_type, $object_id, $meta_key, $meta_value);
 
@@ -143 +137 @@
  *
  * @param string $meta_type Type of object metadata is for (e.g., comment, post, or user)
  * @param int $object_id ID of the object metadata is for
- * @param string $meta_key Metadata key
+ * @param string $meta_key Metadata key. Expected unslashed.
  * @param string $meta_value Optional. Metadata value.  If specified, only delete metadata entries
  *              with this value.  Otherwise, delete all entries with the specified meta_key.
  * @param bool $delete_all Optional, default is false.  If true, delete matching metadata entries
@@ -165 +159 @@
 
         $type_column = esc_sql($meta_type . '_id');
         $id_column = 'user' == $meta_type ? 'umeta_id' : 'meta_id';
-        // expected_slashed ($meta_key)
-        $meta_key = stripslashes($meta_key);
+
         $meta_value = maybe_serialize( stripslashes_deep($meta_value) );
 
         $query = $wpdb->prepare( "SELECT $id_column FROM $table WHERE meta_key = %s", $meta_key );