Ticket #19861: 19861.3.patch

wp-includes/wp-db.php

@@ -850 +850 @@
          * @return void
          */
         function escape_by_ref( &$string ) {
-                $string = $this->_real_escape( $string );
+                if ( !is_float( $string ) )
+                        $string = $this->_real_escape( $string );
         }
 
         /**
@@ -901 +902 @@
                         $args = $args[0];
                 $query = str_replace( "'%s'", '%s', $query ); // in case someone mistakenly already singlequoted it
                 $query = str_replace( '"%s"', '%s', $query ); // doublequote unquoting
+                $query = str_replace( '%f' , '%F', $query ); // Force floats to be locale unaware               
                 $query = preg_replace( '|(?<!%)%s|', "'%s'", $query ); // quote the strings, avoiding escaped strings like %%s
                 array_walk( $args, array( &$this, 'escape_by_ref' ) );
                 return @vsprintf( $query, $args );
@@ -1214 +1216 @@
                                 $form = $this->field_types[$field];
                         else
                                 $form = '%s';
+
+                        if ( in_array( $form, array( '%f', '%F' ) ) )
+                                $data[ $field ] = str_replace( ',', '.', $data[ $field ] );
+
                         $formatted_fields[] = $form;
                 }
                 $sql = "{$type} INTO `$table` (`" . implode( '`,`', $fields ) . "`) VALUES (" . implode( ",", $formatted_fields ) . ")";
@@ -1254 +1260 @@
                                 $form = $this->field_types[$field];
                         else
                                 $form = '%s';
+
+                        if ( in_array( $form, array( '%f', '%F' ) ) )
+                                $data[ $field ] = str_replace( ',', '.', $data[ $field ] );
+
                         $bits[] = "`$field` = {$form}";
                 }
 
@@ -1265 +1275 @@
                                 $form = $this->field_types[$field];
                         else
                                 $form = '%s';
+
+                        if ( in_array( $form, array( '%f', '%F' ) ) )
+                                $where[ $field ] = str_replace( ',', '.', $where[ $field ] );
+
                         $wheres[] = "`$field` = {$form}";
                 }