Ticket #19861: 19861.4.patch

wp-includes/wp-db.php

@@ -850 +850 @@
          * @return void
          */
         function escape_by_ref( &$string ) {
-                $string = $this->_real_escape( $string );
+                if ( ! is_float( $string ) )
+                        $string = $this->_real_escape( $string );
         }
 
         /**
@@ -901 +902 @@
                         $args = $args[0];
                 $query = str_replace( "'%s'", '%s', $query ); // in case someone mistakenly already singlequoted it
                 $query = str_replace( '"%s"', '%s', $query ); // doublequote unquoting
+                $query = str_replace( '%f' , '%F', $query ); // Force floats to be locale unaware               
                 $query = preg_replace( '|(?<!%)%s|', "'%s'", $query ); // quote the strings, avoiding escaped strings like %%s
                 array_walk( $args, array( &$this, 'escape_by_ref' ) );
                 return @vsprintf( $query, $args );