Ticket #14516: stripslashes-db-values-on-install-2.patch

wp-admin/setup-config.php

@@ -152 +152 @@
         break;
 
         case 2:
-        $dbname  = trim($_POST['dbname']);
-        $uname   = trim($_POST['uname']);
-        $passwrd = trim($_POST['pwd']);
-        $dbhost  = trim($_POST['dbhost']);
+        $dbname  = trim(stripslashes($_POST['dbname']));
+        $uname   = trim(stripslashes($_POST['uname']));
+        $passwrd = trim(stripslashes($_POST['pwd']));
+        $dbhost  = trim(stripslashes($_POST['dbhost']));
         $prefix  = trim($_POST['prefix']);
         if ( empty($prefix) )
                 $prefix = 'wp_';
@@ -215 +215 @@
         foreach ($configFile as $line_num => $line) {
                 switch (substr($line,0,16)) {
                         case "define('DB_NAME'":
-                                $configFile[$line_num] = str_replace("database_name_here", $dbname, $line);
+                                $configFile[$line_num] = str_replace("database_name_here", addslashes($dbname), $line);
                                 break;
                         case "define('DB_USER'":
-                                $configFile[$line_num] = str_replace("'username_here'", "'$uname'", $line);
+                                $configFile[$line_num] = str_replace("username_here", addslashes($uname), $line);
                                 break;
                         case "define('DB_PASSW":
-                                $configFile[$line_num] = str_replace("'password_here'", "'$passwrd'", $line);
+                                $configFile[$line_num] = str_replace("password_here", addslashes($passwrd), $line);
                                 break;
                         case "define('DB_HOST'":
-                                $configFile[$line_num] = str_replace("localhost", $dbhost, $line);
+                                $configFile[$line_num] = str_replace("localhost", addslashes($dbhost), $line);
                                 break;
                         case '$table_prefix  =':
                                 $configFile[$line_num] = str_replace('wp_', $prefix, $line);