WordPress.org

Make WordPress Core

Ticket #21767: slashesanity-20121003.diff

File slashesanity-20121003.diff, 51.7 KB (added by alexkingorg, 6 years ago)
  • wp-comments-post.php

     
    4747        do_action('pre_comment_on_post', $comment_post_ID);
    4848}
    4949
    50 $comment_author       = ( isset($_POST['author']) )  ? trim(strip_tags($_POST['author'])) : null;
    51 $comment_author_email = ( isset($_POST['email']) )   ? trim($_POST['email']) : null;
    52 $comment_author_url   = ( isset($_POST['url']) )     ? trim($_POST['url']) : null;
    53 $comment_content      = ( isset($_POST['comment']) ) ? trim($_POST['comment']) : null;
     50$comment_author       = ( isset($_POST['author']) )  ? trim(strip_tags(stripslashes($_POST['author']))) : null;
     51$comment_author_email = ( isset($_POST['email']) )   ? trim(stripslashes($_POST['email'])) : null;
     52$comment_author_url   = ( isset($_POST['url']) )     ? trim(stripslashes($_POST['url'])) : null;
     53$comment_content      = ( isset($_POST['comment']) ) ? trim(stripslashes($_POST['comment'])) : null;
    5454
    5555// If the user is logged in
    5656$user = wp_get_current_user();
  • wp-includes/default-filters.php

     
    1414
    1515// Strip, trim, kses, special chars for string saves
    1616foreach ( array( 'pre_term_name', 'pre_comment_author_name', 'pre_link_name', 'pre_link_target', 'pre_link_rel', 'pre_user_display_name', 'pre_user_first_name', 'pre_user_last_name', 'pre_user_nickname' ) as $filter ) {
    17         add_filter( $filter, 'sanitize_text_field'  );
    18         add_filter( $filter, 'wp_filter_kses'      );
     17        add_filter( $filter, 'sanitize_text_field' );
     18        add_filter( $filter, 'wp_kses_data' );
    1919        add_filter( $filter, '_wp_specialchars', 30 );
    2020}
    2121
     
    3131
    3232// Kses only for textarea saves
    3333foreach ( array( 'pre_term_description', 'pre_link_description', 'pre_link_notes', 'pre_user_description' ) as $filter ) {
    34         add_filter( $filter, 'wp_filter_kses' );
     34        add_filter( $filter, 'wp_kses_data' );
    3535}
    3636
    3737// Kses only for textarea admin displays
    3838if ( is_admin() ) {
    39         foreach ( array( 'term_description', 'link_description', 'link_notes', 'user_description' ) as $filter ) {
     39        foreach ( array( 'term_description', 'link_description', 'link_notes', 'user_description', 'comment_text' ) as $filter ) {
    4040                add_filter( $filter, 'wp_kses_data' );
    4141        }
    42         add_filter( 'comment_text', 'wp_kses_post' );
    4342}
    4443
    4544// Email saves
    4645foreach ( array( 'pre_comment_author_email', 'pre_user_email' ) as $filter ) {
    4746        add_filter( $filter, 'trim'           );
    4847        add_filter( $filter, 'sanitize_email' );
    49         add_filter( $filter, 'wp_filter_kses' );
     48        add_filter( $filter, 'wp_kses_data' );
    5049}
    5150
    5251// Email admin display
  • wp-includes/taxonomy.php

     
    20562056        $args = sanitize_term($args, $taxonomy, 'db');
    20572057        extract($args, EXTR_SKIP);
    20582058
    2059         // expected_slashed ($name)
    2060         $name = stripslashes($name);
    2061         $description = stripslashes($description);
    2062 
    20632059        if ( empty($slug) )
    20642060                $slug = sanitize_title($name);
    20652061
     
    23532349        if ( is_wp_error( $term ) )
    23542350                return $term;
    23552351
    2356         // Escape data pulled from DB.
    2357         $term = add_magic_quotes($term);
    2358 
    23592352        // Merge old and new args with new args overwriting old ones.
    23602353        $args = array_merge($term, $args);
    23612354
     
    23642357        $args = sanitize_term($args, $taxonomy, 'db');
    23652358        extract($args, EXTR_SKIP);
    23662359
    2367         // expected_slashed ($name)
    2368         $name = stripslashes($name);
    2369         $description = stripslashes($description);
    2370 
    23712360        if ( '' == trim($name) )
    23722361                return new WP_Error('empty_term_name', __('A name is required for this term'));
    23732362
  • wp-includes/post.php

     
    16101610 * @link http://codex.wordpress.org/Function_Reference/add_post_meta
    16111611 *
    16121612 * @param int $post_id Post ID.
    1613  * @param string $meta_key Metadata name.
    1614  * @param mixed $meta_value Metadata value.
     1613 * @param string $meta_key Metadata name (expected slashed).
     1614 * @param mixed $meta_value Metadata value (expected slashed).
    16151615 * @param bool $unique Optional, default is false. Whether the same key should not be added.
    16161616 * @return bool False for failure. True for success.
    16171617 */
    16181618function add_post_meta($post_id, $meta_key, $meta_value, $unique = false) {
     1619        _deprecated_function( __FUNCTION__, '3.5', 'wp_add_post_meta() (expects unslashed data)' );
     1620
     1621        // expected slashed
     1622        $meta_key = stripslashes( $meta_key );
     1623        $meta_value = stripslashes_deep( $meta_value );
     1624
     1625        return wp_add_post_meta($post_id, $meta_key, $meta_value, $unique);
     1626}
     1627
     1628/**
     1629 * Add meta data field to a post.
     1630 *
     1631 * Post meta data is called "Custom Fields" on the Administration Screen.
     1632 *
     1633 * @since 3.5.0
     1634 * @link http://codex.wordpress.org/Function_Reference/wp_add_post_meta
     1635 *
     1636 * @param int $post_id Post ID.
     1637 * @param string $meta_key Metadata name (clean, slashes already stripped).
     1638 * @param mixed $meta_value Metadata value (clean, slashes already stripped).
     1639 * @param bool $unique Optional, default is false. Whether the same key should not be added.
     1640 * @return bool False for failure. True for success.
     1641 */
     1642function wp_add_post_meta($post_id, $meta_key, $meta_value, $unique = false) {
    16191643        // make sure meta is added to the post, not a revision
    16201644        if ( $the_post = wp_is_post_revision($post_id) )
    16211645                $post_id = $the_post;
     
    16771701 * @link http://codex.wordpress.org/Function_Reference/update_post_meta
    16781702 *
    16791703 * @param int $post_id Post ID.
    1680  * @param string $meta_key Metadata key.
    1681  * @param mixed $meta_value Metadata value.
     1704 * @param string $meta_key Metadata key (expected slashed).
     1705 * @param mixed $meta_value Metadata value (expected slashed).
    16821706 * @param mixed $prev_value Optional. Previous value to check before removing.
    16831707 * @return bool False on failure, true if success.
    16841708 */
    16851709function update_post_meta($post_id, $meta_key, $meta_value, $prev_value = '') {
     1710        _deprecated_function( __FUNCTION__, '3.5', 'wp_update_post_meta() (expects unslashed data)' );
     1711
     1712        // expected slashed
     1713        $meta_key = stripslashes( $meta_key );
     1714        $meta_value = stripslashes_deep( $meta_value );
     1715
     1716        return wp_update_post_meta($post_id, $meta_key, $meta_value, $prev_value);
     1717}
     1718
     1719/**
     1720 * Update post meta field based on post ID.
     1721 *
     1722 * Use the $prev_value parameter to differentiate between meta fields with the
     1723 * same key and post ID.
     1724 *
     1725 * If the meta field for the post does not exist, it will be added.
     1726 *
     1727 * @since 3.5.0
     1728 * @uses $wpdb
     1729 * @link http://codex.wordpress.org/Function_Reference/wp_update_post_meta
     1730 *
     1731 * @param int $post_id Post ID.
     1732 * @param string $meta_key Metadata key (clean, slashes already stripped).
     1733 * @param mixed $meta_value Metadata value (clean, slashes already stripped).
     1734 * @param mixed $prev_value Optional. Previous value to check before removing.
     1735 * @return bool False on failure, true if success.
     1736 */
     1737function wp_update_post_meta($post_id, $meta_key, $meta_value, $prev_value = '') {
    16861738        // make sure meta is added to the post, not a revision
    16871739        if ( $the_post = wp_is_post_revision($post_id) )
    16881740                $post_id = $the_post;
     
    22572309
    22582310        do_action('wp_trash_post', $post_id);
    22592311
    2260         add_post_meta($post_id,'_wp_trash_meta_status', $post['post_status']);
    2261         add_post_meta($post_id,'_wp_trash_meta_time', time());
     2312        wp_add_post_meta($post_id,'_wp_trash_meta_status', $post['post_status']);
     2313        wp_add_post_meta($post_id,'_wp_trash_meta_time', time());
    22622314
    22632315        $post['post_status'] = 'trash';
    22642316        wp_insert_post($post);
     
    23342386        $statuses = array();
    23352387        foreach ( $comments as $comment )
    23362388                $statuses[$comment->comment_ID] = $comment->comment_approved;
    2337         add_post_meta($post_id, '_wp_trash_meta_comments_status', $statuses);
     2389        wp_add_post_meta($post_id, '_wp_trash_meta_comments_status', $statuses);
    23382390
    23392391        // Set status for all comments to post-trashed
    23402392        $result = $wpdb->update($wpdb->comments, array('comment_approved' => 'post-trashed'), array('comment_post_ID' => $post_id));
     
    27102762
    27112763        $post_name = wp_unique_post_slug($post_name, $post_ID, $post_status, $post_type, $post_parent);
    27122764
    2713         // expected_slashed (everything!)
    27142765        $data = compact( array( 'post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_content_filtered', 'post_title', 'post_excerpt', 'post_status', 'post_type', 'comment_status', 'ping_status', 'post_password', 'post_name', 'to_ping', 'pinged', 'post_modified', 'post_modified_gmt', 'post_parent', 'menu_order', 'guid' ) );
    27152766        $data = apply_filters('wp_insert_post_data', $data, $postarr);
    2716         $data = stripslashes_deep( $data );
    27172767        $where = array( 'ID' => $post_ID );
    27182768
    27192769        if ( $update ) {
     
    27872837                        else
    27882838                                return 0;
    27892839                }
    2790                 update_post_meta($post_ID, '_wp_page_template',  $page_template);
     2840                wp_update_post_meta($post_ID, '_wp_page_template',  $page_template);
    27912841        }
    27922842
    27932843        wp_transition_post_status($data['post_status'], $previous_status, $post);
     
    28202870        if ( is_object($postarr) ) {
    28212871                // non-escaped post was passed
    28222872                $postarr = get_object_vars($postarr);
    2823                 $postarr = add_magic_quotes($postarr);
    28242873        }
    28252874
    28262875        // First, get all of the original fields
    28272876        $post = get_post($postarr['ID'], ARRAY_A);
    28282877
    2829         // Escape data pulled from DB.
    2830         $post = add_magic_quotes($post);
    2831 
    28322878        // Passed post category list overwrites existing category list if not empty.
    28332879        if ( isset($postarr['post_category']) && is_array($postarr['post_category'])
    28342880                         && 0 != count($postarr['post_category']) )
     
    37963842        else
    37973843                $post_name = sanitize_title($post_name);
    37983844
    3799         // expected_slashed ($post_name)
    38003845        $post_name = wp_unique_post_slug($post_name, $post_ID, $post_status, $post_type, $post_parent);
    38013846
    38023847        if ( empty($post_date) )
     
    38393884        if ( ! isset($pinged) )
    38403885                $pinged = '';
    38413886
    3842         // expected_slashed (everything!)
    38433887        $data = compact( array( 'post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_content_filtered', 'post_title', 'post_excerpt', 'post_status', 'post_type', 'comment_status', 'ping_status', 'post_password', 'post_name', 'to_ping', 'pinged', 'post_modified', 'post_modified_gmt', 'post_parent', 'menu_order', 'post_mime_type', 'guid' ) );
    3844         $data = stripslashes_deep( $data );
    38453888
    38463889        if ( $update ) {
    38473890                $wpdb->update( $wpdb->posts, $data, array( 'ID' => $post_ID ) );
     
    38863929        clean_post_cache( $post_ID );
    38873930
    38883931        if ( ! empty( $context ) )
    3889                 add_post_meta( $post_ID, '_wp_attachment_context', $context, true );
     3932                wp_add_post_meta( $post_ID, '_wp_attachment_context', $context, true );
    38903933
    38913934        if ( $update) {
    38923935                do_action('edit_attachment', $post_ID);
     
    42734316
    42744317        // if we haven't added this old slug before, add it now
    42754318        if ( !empty( $post_before->post_name ) && !in_array($post_before->post_name, $old_slugs) )
    4276                 add_post_meta($post_id, '_wp_old_slug', $post_before->post_name);
     4319                wp_add_post_meta($post_id, '_wp_old_slug', $post_before->post_name);
    42774320
    42784321        // if the new slug was used previously, delete it from the list
    42794322        if ( in_array($post->post_name, $old_slugs) )
     
    46894732                return;
    46904733
    46914734        if ( get_option('default_pingback_flag') )
    4692                 add_post_meta( $post_id, '_pingme', '1' );
    4693         add_post_meta( $post_id, '_encloseme', '1' );
     4735                wp_add_post_meta( $post_id, '_pingme', '1' );
     4736        wp_add_post_meta( $post_id, '_encloseme', '1' );
    46944737
    46954738        wp_schedule_single_event(time(), 'do_pings');
    46964739}
     
    49134956                return new WP_Error( 'post_type', __( 'Cannot create a revision of a revision' ) );
    49144957
    49154958        $post = _wp_post_revision_fields( $post, $autosave );
    4916         $post = add_magic_quotes($post); //since data is from db
    49174959
    49184960        $revision_id = wp_insert_post( $post );
    49194961        if ( is_wp_error($revision_id) )
     
    49925034
    49935035        $update['ID'] = $revision['post_parent'];
    49945036
    4995         $update = add_magic_quotes( $update ); //since data is from db
    4996 
    49975037        $post_id = wp_update_post( $update );
    49985038        if ( is_wp_error( $post_id ) )
    49995039                return $post_id;
     
    52155255        $thumbnail_id = absint( $thumbnail_id );
    52165256        if ( $post && $thumbnail_id && get_post( $thumbnail_id ) ) {
    52175257                if ( $thumbnail_html = wp_get_attachment_image( $thumbnail_id, 'thumbnail' ) )
    5218                         return update_post_meta( $post->ID, '_thumbnail_id', $thumbnail_id );
     5258                        return wp_update_post_meta( $post->ID, '_thumbnail_id', $thumbnail_id );
    52195259                else
    52205260                        return delete_post_meta( $post->ID, '_thumbnail_id' );
    52215261        }
  • wp-includes/comment.php

     
    631631 */
    632632function sanitize_comment_cookies() {
    633633        if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) ) {
    634                 $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]);
    635                 $comment_author = stripslashes($comment_author);
     634                $comment_author = stripslashes($_COOKIE['comment_author_'.COOKIEHASH]);
     635                $comment_author = apply_filters('pre_comment_author_name', $comment_author);
    636636                $comment_author = esc_attr($comment_author);
    637637                $_COOKIE['comment_author_'.COOKIEHASH] = $comment_author;
    638638        }
    639639
    640640        if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) ) {
    641                 $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]);
    642                 $comment_author_email = stripslashes($comment_author_email);
     641                $comment_author_email = stripslashes($_COOKIE['comment_author_email_'.COOKIEHASH]);
     642                $comment_author_email = apply_filters('pre_comment_author_email', $comment_author_email);
    643643                $comment_author_email = esc_attr($comment_author_email);
    644644                $_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email;
    645645        }
    646646
    647647        if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) ) {
    648                 $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
    649                 $comment_author_url = stripslashes($comment_author_url);
     648                $comment_author_url = stripslashes($_COOKIE['comment_author_url_'.COOKIEHASH]);
     649                $comment_author_url = apply_filters('pre_comment_author_url', $comment_author_url);
    650650                $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
    651651        }
    652652}
     
    668668        extract($commentdata, EXTR_SKIP);
    669669
    670670        // Simple duplicate check
    671         // expected_slashed ($comment_post_ID, $comment_author, $comment_author_email, $comment_content)
    672         $dupe = "SELECT comment_ID FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND comment_approved != 'trash' AND ( comment_author = '$comment_author' ";
     671        $dupe = "SELECT comment_ID FROM $wpdb->comments WHERE comment_post_ID = '" . $wpdb->escape( $comment_post_ID ) . "' AND comment_approved != 'trash' AND ( comment_author = '" . $wpdb->escape( $comment_author ) . "' ";
    673672        if ( $comment_author_email )
    674                 $dupe .= "OR comment_author_email = '$comment_author_email' ";
    675         $dupe .= ") AND comment_content = '$comment_content' LIMIT 1";
     673                $dupe .= "OR comment_author_email = '" . $wpdb->escape( $comment_author_email ) . "' ";
     674        $dupe .= ") AND comment_content = '" . $wpdb->escape( $comment_content ) . "' LIMIT 1";
    676675        if ( $wpdb->get_var($dupe) ) {
    677676                do_action( 'comment_duplicate_trigger', $commentdata );
    678677                if ( defined('DOING_AJAX') )
     
    12601259 */
    12611260function wp_insert_comment($commentdata) {
    12621261        global $wpdb;
    1263         extract(stripslashes_deep($commentdata), EXTR_SKIP);
     1262        extract($commentdata, EXTR_SKIP);
    12641263
    12651264        if ( ! isset($comment_author_IP) )
    12661265                $comment_author_IP = '';
     
    15001499        $commentarr = wp_filter_comment( $commentarr );
    15011500
    15021501        // Now extract the merged array.
    1503         extract(stripslashes_deep($commentarr), EXTR_SKIP);
     1502        extract($commentarr, EXTR_SKIP);
    15041503
    15051504        $comment_content = apply_filters('comment_save_pre', $comment_content);
    15061505
  • wp-includes/functions.php

     
    468468                                }
    469469
    470470                                if ( in_array( substr( $type, 0, strpos( $type, "/" ) ), $allowed_types ) ) {
    471                                         add_post_meta( $post_ID, 'enclosure', "$url\n$len\n$mime\n" );
     471                                        wp_add_post_meta( $post_ID, 'enclosure', "$url\n$len\n$mime\n" );
    472472                                }
    473473                        }
    474474                }
  • wp-includes/user.php

     
    13851385        }
    13861386
    13871387        $data = compact( 'user_pass', 'user_email', 'user_url', 'user_nicename', 'display_name', 'user_registered' );
    1388         $data = stripslashes_deep( $data );
    13891388
    13901389        if ( $update ) {
    13911390                $wpdb->update( $wpdb->users, $data, compact( 'ID' ) );
     
    14551454                $user[ $key ] = get_user_meta( $ID, $key, true );
    14561455        }
    14571456
    1458         // Escape data pulled from DB.
    1459         $user = add_magic_quotes( $user );
    1460 
    14611457        // If password is changing, hash it now.
    14621458        if ( ! empty($userdata['user_pass']) ) {
    14631459                $plaintext_pass = $userdata['user_pass'];
  • wp-includes/class-wp-xmlrpc-server.php

     
    280280                $post_id = (int) $post_id;
    281281
    282282                foreach ( (array) $fields as $meta ) {
     283                        $meta['key'] = stripslashes( $meta['key'] );
     284                        $meta['value'] = stripslashes_deep( $meta['value'] );
    283285                        if ( isset($meta['id']) ) {
    284286                                $meta['id'] = (int) $meta['id'];
    285287                                $pmeta = get_metadata_by_mid( 'post', $meta['id'] );
    286288                                if ( isset($meta['key']) ) {
    287                                         $meta['key'] = stripslashes( $meta['key'] );
    288289                                        if ( $meta['key'] != $pmeta->meta_key )
    289290                                                continue;
    290                                         $meta['value'] = stripslashes_deep( $meta['value'] );
    291291                                        if ( current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) )
    292292                                                update_metadata_by_mid( 'post', $meta['id'], $meta['value'] );
    293293                                } elseif ( current_user_can( 'delete_post_meta', $post_id, $pmeta->meta_key ) ) {
    294294                                        delete_metadata_by_mid( 'post', $meta['id'] );
    295295                                }
    296296                        } elseif ( current_user_can( 'add_post_meta', $post_id, stripslashes( $meta['key'] ) ) ) {
    297                                 add_post_meta( $post_id, $meta['key'], $meta['value'] );
     297                                wp_add_post_meta( $post_id, $meta['key'], $meta['value'] );
    298298                        }
    299299                }
    300300        }
     
    43754375                                }
    43764376                        }
    43774377                        if (!$found)
    4378                                 add_post_meta( $post_ID, 'enclosure', $encstring );
     4378                                wp_add_post_meta( $post_ID, 'enclosure', $encstring );
    43794379                }
    43804380        }
    43814381
     
    53325332                // retain old cats
    53335333                $cats = wp_get_post_categories($post_ID);
    53345334                $postdata['post_category'] = $cats;
    5335                 $this->escape($postdata);
    53365335
    53375336                $result = wp_update_post($postdata);
    53385337
  • wp-includes/formatting.php

     
    16891689 * @return string Converted content.
    16901690 */
    16911691function wp_rel_nofollow( $text ) {
    1692         // This is a pre save filter, so text is already escaped.
    1693         $text = stripslashes($text);
    16941692        $text = preg_replace_callback('|<a (.+?)>|i', 'wp_rel_nofollow_callback', $text);
    1695         $text = esc_sql($text);
    16961693        return $text;
    16971694}
    16981695
  • wp-includes/kses.php

     
    13261326 */
    13271327function kses_init_filters() {
    13281328        // Normal filtering
    1329         add_filter('title_save_pre', 'wp_filter_kses');
     1329        add_filter('title_save_pre', 'wp_kses_data');
    13301330
    13311331        // Comment filtering
    13321332        if ( current_user_can( 'unfiltered_html' ) )
    1333                 add_filter( 'pre_comment_content', 'wp_filter_post_kses' );
     1333                add_filter( 'pre_comment_content', 'wp_kses_post' );
    13341334        else
    1335                 add_filter( 'pre_comment_content', 'wp_filter_kses' );
     1335                add_filter( 'pre_comment_content', 'wp_kses_data' );
    13361336
    13371337        // Post filtering
    1338         add_filter('content_save_pre', 'wp_filter_post_kses');
    1339         add_filter('excerpt_save_pre', 'wp_filter_post_kses');
    1340         add_filter('content_filtered_save_pre', 'wp_filter_post_kses');
     1338        add_filter('content_save_pre', 'wp_kses_post');
     1339        add_filter('excerpt_save_pre', 'wp_kses_post');
     1340        add_filter('content_filtered_save_pre', 'wp_kses_post');
    13411341}
    13421342
    13431343/**
     
    13541354 */
    13551355function kses_remove_filters() {
    13561356        // Normal filtering
    1357         remove_filter('title_save_pre', 'wp_filter_kses');
     1357        remove_filter('title_save_pre', 'wp_kses_data');
    13581358
    13591359        // Comment filtering
    1360         remove_filter( 'pre_comment_content', 'wp_filter_post_kses' );
    1361         remove_filter( 'pre_comment_content', 'wp_filter_kses' );
     1360        remove_filter( 'pre_comment_content', 'wp_kses_post' );
     1361        remove_filter( 'pre_comment_content', 'wp_kses_data' );
    13621362
    13631363        // Post filtering
    1364         remove_filter('content_save_pre', 'wp_filter_post_kses');
    1365         remove_filter('excerpt_save_pre', 'wp_filter_post_kses');
    1366         remove_filter('content_filtered_save_pre', 'wp_filter_post_kses');
     1364        remove_filter('content_save_pre', 'wp_kses_post');
     1365        remove_filter('excerpt_save_pre', 'wp_kses_post');
     1366        remove_filter('content_filtered_save_pre', 'wp_kses_post');
    13671367}
    13681368
    13691369/**
  • wp-includes/meta.php

     
    4242
    4343        $column = esc_sql($meta_type . '_id');
    4444
    45         // expected_slashed ($meta_key)
    46         $meta_key = stripslashes($meta_key);
    47         $meta_value = stripslashes_deep($meta_value);
    4845        $meta_value = sanitize_meta( $meta_key, $meta_value, $meta_type );
    4946
    5047        $check = apply_filters( "add_{$meta_type}_metadata", null, $object_id, $meta_key, $meta_value, $unique );
     
    113110        $column = esc_sql($meta_type . '_id');
    114111        $id_column = 'user' == $meta_type ? 'umeta_id' : 'meta_id';
    115112
    116         // expected_slashed ($meta_key)
    117         $meta_key = stripslashes($meta_key);
    118113        $passed_value = $meta_value;
    119         $meta_value = stripslashes_deep($meta_value);
    120114        $meta_value = sanitize_meta( $meta_key, $meta_value, $meta_type );
    121115
    122116        $check = apply_filters( "update_{$meta_type}_metadata", null, $object_id, $meta_key, $meta_value, $prev_value );
  • wp-includes/nav-menu.php

     
    376376
    377377        $menu_item_db_id = (int) $menu_item_db_id;
    378378
    379         update_post_meta( $menu_item_db_id, '_menu_item_type', sanitize_key($args['menu-item-type']) );
    380         update_post_meta( $menu_item_db_id, '_menu_item_menu_item_parent', (int) $args['menu-item-parent-id'] );
    381         update_post_meta( $menu_item_db_id, '_menu_item_object_id', (int) $args['menu-item-object-id'] );
    382         update_post_meta( $menu_item_db_id, '_menu_item_object', sanitize_key($args['menu-item-object']) );
    383         update_post_meta( $menu_item_db_id, '_menu_item_target', sanitize_key($args['menu-item-target']) );
     379        wp_update_post_meta( $menu_item_db_id, '_menu_item_type', sanitize_key($args['menu-item-type']) );
     380        wp_update_post_meta( $menu_item_db_id, '_menu_item_menu_item_parent', (int) $args['menu-item-parent-id'] );
     381        wp_update_post_meta( $menu_item_db_id, '_menu_item_object_id', (int) $args['menu-item-object-id'] );
     382        wp_update_post_meta( $menu_item_db_id, '_menu_item_object', sanitize_key($args['menu-item-object']) );
     383        wp_update_post_meta( $menu_item_db_id, '_menu_item_target', sanitize_key($args['menu-item-target']) );
    384384
    385385        $args['menu-item-classes'] = array_map( 'sanitize_html_class', explode( ' ', $args['menu-item-classes'] ) );
    386386        $args['menu-item-xfn'] = implode( ' ', array_map( 'sanitize_html_class', explode( ' ', $args['menu-item-xfn'] ) ) );
    387         update_post_meta( $menu_item_db_id, '_menu_item_classes', $args['menu-item-classes'] );
    388         update_post_meta( $menu_item_db_id, '_menu_item_xfn', $args['menu-item-xfn'] );
    389         update_post_meta( $menu_item_db_id, '_menu_item_url', esc_url_raw($args['menu-item-url']) );
     387        wp_update_post_meta( $menu_item_db_id, '_menu_item_classes', $args['menu-item-classes'] );
     388        wp_update_post_meta( $menu_item_db_id, '_menu_item_xfn', $args['menu-item-xfn'] );
     389        wp_update_post_meta( $menu_item_db_id, '_menu_item_url', esc_url_raw($args['menu-item-url']) );
    390390
    391391        if ( 0 == $menu_id )
    392                 update_post_meta( $menu_item_db_id, '_menu_item_orphaned', time() );
     392                wp_update_post_meta( $menu_item_db_id, '_menu_item_orphaned', time() );
    393393        else
    394394                delete_post_meta( $menu_item_db_id, '_menu_item_orphaned' );
    395395
  • wp-mail.php

     
    202202        $post_category = array(get_option('default_email_category'));
    203203
    204204        $post_data = compact('post_content','post_title','post_date','post_date_gmt','post_author','post_category', 'post_status');
    205         $post_data = add_magic_quotes($post_data);
    206205
    207206        $post_ID = wp_insert_post($post_data);
    208207        if ( is_wp_error( $post_ID ) )
  • wp-admin/includes/bookmark.php

     
    3939
    4040        if ( !empty( $link_id ) ) {
    4141                $_POST['link_id'] = $link_id;
    42                 return wp_update_link( $_POST );
     42                return wp_update_link( stripslashes_deep( $_POST ) );
    4343        } else {
    44                 return wp_insert_link( $_POST );
     44                return wp_insert_link( stripslashes_deep( $_POST ) );
    4545        }
    4646}
    4747
     
    137137        $linkdata = wp_parse_args( $linkdata, $defaults );
    138138        $linkdata = sanitize_bookmark( $linkdata, 'db' );
    139139
    140         extract( stripslashes_deep( $linkdata ), EXTR_SKIP );
     140        extract( $linkdata, EXTR_SKIP );
    141141
    142142        $update = false;
    143143
     
    250250
    251251        $link = get_bookmark( $link_id, ARRAY_A );
    252252
    253         // Escape data pulled from DB.
    254         $link = add_magic_quotes( $link );
    255 
    256253        // Passed link category list overwrites existing category list if not empty.
    257254        if ( isset( $linkdata['link_category'] ) && is_array( $linkdata['link_category'] )
    258255                         && 0 != count( $linkdata['link_category'] ) )
  • wp-admin/includes/taxonomy.php

     
    157157        // First, get all of the original fields
    158158        $category = get_category($cat_ID, ARRAY_A);
    159159
    160         // Escape data pulled from DB.
    161         $category = add_magic_quotes($category);
    162 
    163160        // Merge old and new fields with new fields overwriting old ones.
    164161        $catarr = array_merge($category, $catarr);
    165162
  • wp-admin/includes/ajax-actions.php

     
    279279 */
    280280
    281281function _wp_ajax_add_hierarchical_term() {
    282         $action = $_POST['action'];
     282        $post_data = stripslashes_deep( $_POST );
     283        $action = $post_data['action'];
    283284        $taxonomy = get_taxonomy(substr($action, 4));
    284285        check_ajax_referer( $action, '_ajax_nonce-add-' . $taxonomy->name );
    285286        if ( !current_user_can( $taxonomy->cap->edit_terms ) )
    286287                wp_die( -1 );
    287         $names = explode(',', $_POST['new'.$taxonomy->name]);
    288         $parent = isset($_POST['new'.$taxonomy->name.'_parent']) ? (int) $_POST['new'.$taxonomy->name.'_parent'] : 0;
     288        $names = explode(',', $post_data['new'.$taxonomy->name]);
     289        $parent = isset($post_data['new'.$taxonomy->name.'_parent']) ? (int) $post_data['new'.$taxonomy->name.'_parent'] : 0;
    289290        if ( 0 > $parent )
    290291                $parent = 0;
    291292        if ( $taxonomy->name == 'category' )
    292                 $post_category = isset($_POST['post_category']) ? (array) $_POST['post_category'] : array();
     293                $post_category = isset( $post_data['post_category'] ) ? (array) $post_data['post_category'] : array();
    293294        else
    294                 $post_category = ( isset($_POST['tax_input']) && isset($_POST['tax_input'][$taxonomy->name]) ) ? (array) $_POST['tax_input'][$taxonomy->name] : array();
     295                $post_category = ( isset( $post_data['tax_input'] ) && isset( $post_data['tax_input'][$taxonomy->name] ) ) ? (array) $post_data['tax_input'][$taxonomy->name] : array();
    295296        $checked_categories = array_map( 'absint', (array) $post_category );
    296297        $popular_ids = wp_popular_terms_checklist($taxonomy->name, 0, 10, false);
    297298
     
    559560        check_ajax_referer( $action );
    560561        if ( !current_user_can( 'manage_categories' ) )
    561562                wp_die( -1 );
    562         $names = explode(',', $_POST['newcat']);
     563        $names = explode( ',', stripslashes( $_POST['newcat'] ) );
    563564        $x = new WP_Ajax_Response();
    564565        foreach ( $names as $cat_name ) {
    565566                $cat_name = trim($cat_name);
     
    586587function wp_ajax_add_tag() {
    587588        global $wp_list_table;
    588589
     590        $post_data = stripslashes_deep( $_POST );
     591
    589592        check_ajax_referer( 'add-tag', '_wpnonce_add-tag' );
    590         $post_type = !empty($_POST['post_type']) ? $_POST['post_type'] : 'post';
    591         $taxonomy = !empty($_POST['taxonomy']) ? $_POST['taxonomy'] : 'post_tag';
     593        $post_type = !empty($post_data['post_type']) ? $post_data['post_type'] : 'post';
     594        $taxonomy = !empty($post_data['taxonomy']) ? $post_data['taxonomy'] : 'post_tag';
    592595        $tax = get_taxonomy($taxonomy);
    593596
    594597        if ( !current_user_can( $tax->cap->edit_terms ) )
     
    596599
    597600        $x = new WP_Ajax_Response();
    598601
    599         $tag = wp_insert_term($_POST['tag-name'], $taxonomy, $_POST );
     602        $tag = wp_insert_term( $post_data['tag-name'], $taxonomy, $post_data );
    600603
    601604        if ( !$tag || is_wp_error($tag) || (!$tag = get_term( $tag['term_id'], $taxonomy )) ) {
    602605                $message = __('An error has occurred. Please reload the page and try again.');
     
    610613                $x->send();
    611614        }
    612615
    613         $wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => $_POST['screen'] ) );
     616        $wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => stripslashes( $_POST['screen'] ) ) );
    614617
    615618        $level = 0;
    616619        if ( is_taxonomy_hierarchical($taxonomy) ) {
     
    731734                $comment_author       = $wpdb->escape($user->display_name);
    732735                $comment_author_email = $wpdb->escape($user->user_email);
    733736                $comment_author_url   = $wpdb->escape($user->user_url);
    734                 $comment_content      = trim($_POST['content']);
     737                $comment_content      = trim( stripslashes( $_POST['content'] ) );
    735738                if ( current_user_can( 'unfiltered_html' ) ) {
    736739                        if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {
    737740                                kses_remove_filters(); // start with a clean slate
     
    13271330        $data = &$_POST;
    13281331
    13291332        $post = get_post( $post_ID, ARRAY_A );
    1330         $post = add_magic_quotes($post); //since it is from db
    13311333
    13321334        $data['content'] = $post['post_content'];
    13331335        $data['excerpt'] = $post['post_excerpt'];
     
    13751377        global $wp_list_table;
    13761378
    13771379        check_ajax_referer( 'taxinlineeditnonce', '_inline_edit' );
     1380       
     1381        $post_data = stripslashes_deep( $_POST );
    13781382
    1379         $taxonomy = sanitize_key( $_POST['taxonomy'] );
     1383        $taxonomy = sanitize_key( $post_data['taxonomy'] );
    13801384        $tax = get_taxonomy( $taxonomy );
    13811385        if ( ! $tax )
    13821386                wp_die( 0 );
     
    13861390
    13871391        $wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => 'edit-' . $taxonomy ) );
    13881392
    1389         if ( ! isset($_POST['tax_ID']) || ! ( $id = (int) $_POST['tax_ID'] ) )
     1393        if ( ! isset($post_data['tax_ID']) || ! ( $id = (int) $post_data['tax_ID'] ) )
    13901394                wp_die( -1 );
    13911395
    13921396        $tag = get_term( $id, $taxonomy );
    1393         $_POST['description'] = $tag->description;
     1397        $post_data['description'] = $tag->description;
    13941398
    1395         $updated = wp_update_term($id, $taxonomy, $_POST);
     1399        $updated = wp_update_term($id, $taxonomy, $post_data );
    13961400        if ( $updated && !is_wp_error($updated) ) {
    13971401                $tag = get_term( $updated['term_id'], $taxonomy );
    13981402                if ( !$tag || is_wp_error( $tag ) ) {
     
    16061610                $post_id = null;
    16071611        }
    16081612
    1609         $post_data = isset( $_REQUEST['post_data'] ) ? $_REQUEST['post_data'] : array();
     1613        $post_data = isset( $_REQUEST['post_data'] ) ? stripslashes_deep( $_REQUEST['post_data'] ) : array();
    16101614
    16111615        $attachment_id = media_handle_upload( 'async-upload', $post_id, $post_data );
    16121616
     
    16191623
    16201624        if ( isset( $post_data['context'] ) && isset( $post_data['theme'] ) ) {
    16211625                if ( 'custom-background' === $post_data['context'] )
    1622                         update_post_meta( $attachment_id, '_wp_attachment_is_custom_background', $post_data['theme'] );
     1626                        wp_update_post_meta( $attachment_id, '_wp_attachment_is_custom_background', $post_data['theme'] );
    16231627
    16241628                if ( 'custom-header' === $post_data['context'] )
    1625                         update_post_meta( $attachment_id, '_wp_attachment_is_custom_header', $post_data['theme'] );
     1629                        wp_update_post_meta( $attachment_id, '_wp_attachment_is_custom_header', $post_data['theme'] );
    16261630        }
    16271631
    16281632        if ( ! $attachment = wp_prepare_attachment_for_js( $attachment_id ) )
     
    17511755                wp_die( 0 );
    17521756
    17531757        $new_lock = ( time() - apply_filters( 'wp_check_post_lock_window', AUTOSAVE_INTERVAL * 2 ) + 5 ) . ':' . $active_lock[1];
    1754         update_post_meta( $post_id, '_edit_lock', $new_lock, implode( ':', $active_lock ) );
     1758        wp_update_post_meta( $post_id, '_edit_lock', $new_lock, implode( ':', $active_lock ) );
    17551759        wp_die( 1 );
    17561760}
    17571761
  • wp-admin/includes/post.php

     
    143143 */
    144144function edit_post( $post_data = null ) {
    145145
    146         if ( empty($post_data) )
    147                 $post_data = &$_POST;
     146        if ( empty($post_data) ) {
     147                $post_data = stripslashes_deep( $_POST );
     148        }
    148149
    149150        // Clear out any data in internal vars.
    150151        unset( $post_data['filter'] );
     
    237238
    238239        add_meta( $post_ID );
    239240
    240         update_post_meta( $post_ID, '_edit_last', $GLOBALS['current_user']->ID );
     241        wp_update_post_meta( $post_ID, '_edit_last', $GLOBALS['current_user']->ID );
    241242
    242243        wp_update_post( $post_data );
    243244
     
    555556        }
    556557
    557558        // Create the post.
    558         $post_ID = wp_insert_post( $_POST );
     559        $post_ID = wp_insert_post( stripslashes_deep( $_POST ) );
    559560        if ( is_wp_error( $post_ID ) )
    560561                return $post_ID;
    561562
     
    564565
    565566        add_meta( $post_ID );
    566567
    567         add_post_meta( $post_ID, '_edit_last', $GLOBALS['current_user']->ID );
     568        wp_add_post_meta( $post_ID, '_edit_last', $GLOBALS['current_user']->ID );
    568569
    569570        // Now that we have an ID we can fix any attachment anchor hrefs
    570571        _fix_attachment_links( $post_ID );
     
    610611
    611612        $metakeyselect = isset($_POST['metakeyselect']) ? stripslashes( trim( $_POST['metakeyselect'] ) ) : '';
    612613        $metakeyinput = isset($_POST['metakeyinput']) ? stripslashes( trim( $_POST['metakeyinput'] ) ) : '';
    613         $metavalue = isset($_POST['metavalue']) ? $_POST['metavalue'] : '';
     614        $metavalue = isset($_POST['metavalue']) ? stripslashes( trim( $_POST['metavalue'] ) ) : '';
    614615        if ( is_string( $metavalue ) )
    615616                $metavalue = trim( $metavalue );
    616617
     
    629630
    630631                $metakey = esc_sql( $metakey );
    631632
    632                 return add_post_meta( $post_ID, $metakey, $metavalue );
     633                return wp_add_post_meta( $post_ID, $metakey, $metavalue );
    633634        }
    634635
    635636        return false;
     
    702703 * @since 1.2.0
    703704 *
    704705 * @param unknown_type $meta_id
    705  * @param unknown_type $meta_key Expect Slashed
    706  * @param unknown_type $meta_value Expect Slashed
     706 * @param unknown_type $meta_key
     707 * @param unknown_type $meta_value
    707708 * @return unknown
    708709 */
    709710function update_meta( $meta_id, $meta_key, $meta_value ) {
    710         $meta_key = stripslashes( $meta_key );
    711         $meta_value = stripslashes_deep( $meta_value );
    712 
    713711        return update_metadata_by_mid( 'post', $meta_id, $meta_value, $meta_key );
    714712}
    715713
     
    763761
    764762        if ( $replace ) {
    765763                $post['post_content'] = $content;
    766                 // Escape data pulled from DB.
    767                 $post = add_magic_quotes($post);
    768764
    769765                return wp_update_post($post);
    770766        }
     
    11941190        $now = time();
    11951191        $lock = "$now:$user_id";
    11961192
    1197         update_post_meta( $post->ID, '_edit_lock', $lock );
     1193        wp_update_post_meta( $post->ID, '_edit_lock', $lock );
    11981194        return array( $now, $user_id );
    11991195}
    12001196
  • wp-admin/includes/misc.php

     
    322322
    323323                if ( !$user = wp_get_current_user() )
    324324                        return;
    325                 $option = $_POST['wp_screen_options']['option'];
    326                 $value = $_POST['wp_screen_options']['value'];
     325                $option = stripslashes( $_POST['wp_screen_options']['option'] );
     326                $value = stripslashes_deep( $_POST['wp_screen_options']['value'] );
    327327
    328328                if ( !preg_match( '/^[a-z_-]+$/', $option ) )
    329329                        return;
  • wp-admin/includes/comment.php

     
    1919function comment_exists($comment_author, $comment_date) {
    2020        global $wpdb;
    2121
    22         $comment_author = stripslashes($comment_author);
    23         $comment_date = stripslashes($comment_date);
    24 
    2522        return $wpdb->get_var( $wpdb->prepare("SELECT comment_post_ID FROM $wpdb->comments
    2623                        WHERE comment_author = %s AND comment_date = %s", $comment_author, $comment_date) );
    2724}
     
    3330 */
    3431function edit_comment() {
    3532
    36         if ( ! current_user_can( 'edit_comment', (int) $_POST['comment_ID'] ) )
     33        $post_data = stripslashes_deep( $_POST );
     34
     35        if ( ! current_user_can( 'edit_comment', (int) $post_data['comment_ID'] ) )
    3736                wp_die ( __( 'You are not allowed to edit comments on this post.' ) );
    3837
    39         $_POST['comment_author'] = $_POST['newcomment_author'];
    40         $_POST['comment_author_email'] = $_POST['newcomment_author_email'];
    41         $_POST['comment_author_url'] = $_POST['newcomment_author_url'];
    42         $_POST['comment_approved'] = $_POST['comment_status'];
    43         $_POST['comment_content'] = $_POST['content'];
    44         $_POST['comment_ID'] = (int) $_POST['comment_ID'];
     38        $post_data['comment_author'] = $post_data['newcomment_author'];
     39        $post_data['comment_author_email'] = $post_data['newcomment_author_email'];
     40        $post_data['comment_author_url'] = $post_data['newcomment_author_url'];
     41        $post_data['comment_approved'] = $post_data['comment_status'];
     42        $post_data['comment_content'] = $post_data['content'];
     43        $post_data['comment_ID'] = (int) $post_data['comment_ID'];
    4544
    4645        foreach ( array ('aa', 'mm', 'jj', 'hh', 'mn') as $timeunit ) {
    47                 if ( !empty( $_POST['hidden_' . $timeunit] ) && $_POST['hidden_' . $timeunit] != $_POST[$timeunit] ) {
     46                if ( !empty( $post_data['hidden_' . $timeunit] ) && $post_data['hidden_' . $timeunit] != $post_data[$timeunit] ) {
    4847                        $_POST['edit_date'] = '1';
    4948                        break;
    5049                }
    5150        }
    5251
    53         if ( !empty ( $_POST['edit_date'] ) ) {
    54                 $aa = $_POST['aa'];
    55                 $mm = $_POST['mm'];
    56                 $jj = $_POST['jj'];
    57                 $hh = $_POST['hh'];
    58                 $mn = $_POST['mn'];
    59                 $ss = $_POST['ss'];
     52        if ( !empty ( $post_data['edit_date'] ) ) {
     53                $aa = $post_data['aa'];
     54                $mm = $post_data['mm'];
     55                $jj = $post_data['jj'];
     56                $hh = $post_data['hh'];
     57                $mn = $post_data['mn'];
     58                $ss = $post_data['ss'];
    6059                $jj = ($jj > 31 ) ? 31 : $jj;
    6160                $hh = ($hh > 23 ) ? $hh -24 : $hh;
    6261                $mn = ($mn > 59 ) ? $mn -60 : $mn;
    6362                $ss = ($ss > 59 ) ? $ss -60 : $ss;
    64                 $_POST['comment_date'] = "$aa-$mm-$jj $hh:$mn:$ss";
     63                $post_data['comment_date'] = "$aa-$mm-$jj $hh:$mn:$ss";
    6564        }
    6665
    67         wp_update_comment( $_POST );
     66        wp_update_comment( $post_data );
    6867}
    6968
    7069/**
  • wp-admin/includes/image-edit.php

     
    542542                }
    543543        }
    544544
    545         if ( !wp_update_attachment_metadata($post_id, $meta) || !update_post_meta( $post_id, '_wp_attachment_backup_sizes', $backup_sizes) ) {
     545        if ( !wp_update_attachment_metadata($post_id, $meta) || !wp_update_post_meta( $post_id, '_wp_attachment_backup_sizes', $backup_sizes) ) {
    546546                $msg->error = __('Cannot save image metadata.');
    547547                return $msg;
    548548        }
     
    708708
    709709        if ( $success ) {
    710710                wp_update_attachment_metadata( $post_id, $meta );
    711                 update_post_meta( $post_id, '_wp_attachment_backup_sizes', $backup_sizes);
     711                wp_update_post_meta( $post_id, '_wp_attachment_backup_sizes', $backup_sizes);
    712712
    713713                if ( $target == 'thumbnail' || $target == 'all' || $target == 'full' ) {
    714714                        $file_url = wp_get_attachment_url($post_id);
  • wp-admin/includes/user.php

     
    3838        } else {
    3939                $update = false;
    4040        }
     41       
     42        // get clean data before we get started.
     43        $post_data = stripslashes_deep( $_POST );
    4144
    42         if ( !$update && isset( $_POST['user_login'] ) )
    43                 $user->user_login = sanitize_user($_POST['user_login'], true);
     45        if ( !$update && isset( $post_data['user_login'] ) )
     46                $user->user_login = sanitize_user($post_data['user_login'], true);
    4447
    4548        $pass1 = $pass2 = '';
    46         if ( isset( $_POST['pass1'] ))
    47                 $pass1 = $_POST['pass1'];
    48         if ( isset( $_POST['pass2'] ))
    49                 $pass2 = $_POST['pass2'];
     49        if ( isset( $post_data['pass1'] ))
     50                $pass1 = $post_data['pass1'];
     51        if ( isset( $post_data['pass2'] ))
     52                $pass2 = $post_data['pass2'];
    5053
    51         if ( isset( $_POST['role'] ) && current_user_can( 'edit_users' ) ) {
    52                 $new_role = sanitize_text_field( $_POST['role'] );
     54        if ( isset( $post_data['role'] ) && current_user_can( 'edit_users' ) ) {
     55                $new_role = sanitize_text_field( $post_data['role'] );
    5356                $potential_role = isset($wp_roles->role_objects[$new_role]) ? $wp_roles->role_objects[$new_role] : false;
    5457                // Don't let anyone with 'edit_users' (admins) edit their own role to something without it.
    5558                // Multisite super admins can freely edit their blog roles -- they possess all caps.
     
    6265                        wp_die(__('You can&#8217;t give users that role.'));
    6366        }
    6467
    65         if ( isset( $_POST['email'] ))
    66                 $user->user_email = sanitize_text_field( $_POST['email'] );
    67         if ( isset( $_POST['url'] ) ) {
    68                 if ( empty ( $_POST['url'] ) || $_POST['url'] == 'http://' ) {
     68        if ( isset( $post_data['email'] ))
     69                $user->user_email = sanitize_text_field( $post_data['email'] );
     70        if ( isset( $post_data['url'] ) ) {
     71                if ( empty ( $post_data['url'] ) || $post_data['url'] == 'http://' ) {
    6972                        $user->user_url = '';
    7073                } else {
    71                         $user->user_url = esc_url_raw( $_POST['url'] );
     74                        $user->user_url = esc_url_raw( $post_data['url'] );
    7275                        $protocols = implode( '|', array_map( 'preg_quote', wp_allowed_protocols() ) );
    7376                        $user->user_url = preg_match('/^(' . $protocols . '):/is', $user->user_url) ? $user->user_url : 'http://'.$user->user_url;
    7477                }
    7578        }
    76         if ( isset( $_POST['first_name'] ) )
    77                 $user->first_name = sanitize_text_field( $_POST['first_name'] );
    78         if ( isset( $_POST['last_name'] ) )
    79                 $user->last_name = sanitize_text_field( $_POST['last_name'] );
    80         if ( isset( $_POST['nickname'] ) )
    81                 $user->nickname = sanitize_text_field( $_POST['nickname'] );
    82         if ( isset( $_POST['display_name'] ) )
    83                 $user->display_name = sanitize_text_field( $_POST['display_name'] );
     79        if ( isset( $post_data['first_name'] ) )
     80                $user->first_name = sanitize_text_field( $post_data['first_name'] );
     81        if ( isset( $post_data['last_name'] ) )
     82                $user->last_name = sanitize_text_field( $post_data['last_name'] );
     83        if ( isset( $post_data['nickname'] ) )
     84                $user->nickname = sanitize_text_field( $post_data['nickname'] );
     85        if ( isset( $post_data['display_name'] ) )
     86                $user->display_name = sanitize_text_field( $post_data['display_name'] );
    8487
    85         if ( isset( $_POST['description'] ) )
    86                 $user->description = trim( $_POST['description'] );
     88        if ( isset( $post_data['description'] ) )
     89                $user->description = trim( $post_data['description'] );
    8790
    8891        foreach ( _wp_get_user_contactmethods( $user ) as $method => $name ) {
    89                 if ( isset( $_POST[$method] ))
    90                         $user->$method = sanitize_text_field( $_POST[$method] );
     92                if ( isset( $post_data[$method] ))
     93                        $user->$method = sanitize_text_field( $post_data[$method] );
    9194        }
    9295
    9396        if ( $update ) {
    94                 $user->rich_editing = isset( $_POST['rich_editing'] ) && 'false' == $_POST['rich_editing'] ? 'false' : 'true';
    95                 $user->admin_color = isset( $_POST['admin_color'] ) ? sanitize_text_field( $_POST['admin_color'] ) : 'fresh';
    96                 $user->show_admin_bar_front = isset( $_POST['admin_bar_front'] ) ? 'true' : 'false';
     97                $user->rich_editing = isset( $post_data['rich_editing'] ) && 'false' == $post_data['rich_editing'] ? 'false' : 'true';
     98                $user->admin_color = isset( $post_data['admin_color'] ) ? sanitize_text_field( $post_data['admin_color'] ) : 'fresh';
     99                $user->show_admin_bar_front = isset( $post_data['admin_bar_front'] ) ? 'true' : 'false';
    97100        }
    98101
    99         $user->comment_shortcuts = isset( $_POST['comment_shortcuts'] ) && 'true' == $_POST['comment_shortcuts'] ? 'true' : '';
     102        $user->comment_shortcuts = isset( $post_data['comment_shortcuts'] ) && 'true' == $post_data['comment_shortcuts'] ? 'true' : '';
    100103
    101104        $user->use_ssl = 0;
    102         if ( !empty($_POST['use_ssl']) )
     105        if ( !empty($post_data['use_ssl']) )
    103106                $user->use_ssl = 1;
    104107
    105108        $errors = new WP_Error();
     
    134137        if ( !empty( $pass1 ) )
    135138                $user->user_pass = $pass1;
    136139
    137         if ( !$update && isset( $_POST['user_login'] ) && !validate_username( $_POST['user_login'] ) )
     140        if ( !$update && isset( $post_data['user_login'] ) && !validate_username( $post_data['user_login'] ) )
    138141                $errors->add( 'user_login', __( '<strong>ERROR</strong>: This username is invalid because it uses illegal characters. Please enter a valid username.' ));
    139142
    140143        if ( !$update && username_exists( $user->user_login ) )
     
    159162                $user_id = wp_update_user( $user );
    160163        } else {
    161164                $user_id = wp_insert_user( $user );
    162                 wp_new_user_notification( $user_id, isset($_POST['send_password']) ? $pass1 : '' );
     165                wp_new_user_notification( $user_id, isset($post_data['send_password']) ? $pass1 : '' );
    163166        }
    164167        return $user_id;
    165168}
  • wp-admin/includes/media.php

     
    435435        }
    436436
    437437        if ( !empty($_POST['attachments']) ) foreach ( $_POST['attachments'] as $attachment_id => $attachment ) {
     438                $attachment = stripslashes_deep( $attachment );
     439       
    438440                $post = $_post = get_post($attachment_id, ARRAY_A);
    439441                $post_type_object = get_post_type_object( $post[ 'post_type' ] );
    440442
     
    459461
    460462                if ( isset($attachment['image_alt']) ) {
    461463                        $image_alt = get_post_meta($attachment_id, '_wp_attachment_image_alt', true);
    462                         if ( $image_alt != stripslashes($attachment['image_alt']) ) {
    463                                 $image_alt = wp_strip_all_tags( stripslashes($attachment['image_alt']), true );
    464                                 // update_meta expects slashed
    465                                 update_post_meta( $attachment_id, '_wp_attachment_image_alt', addslashes($image_alt) );
     464                        if ( $image_alt != $attachment['image_alt'] ) {
     465                                $image_alt = wp_strip_all_tags( $attachment['image_alt'], true );
     466                                wp_update_post_meta( $attachment_id, '_wp_attachment_image_alt', $image_alt );
    466467                        }
    467468                }
    468469
  • wp-admin/edit-tags.php

     
    4747        if ( !current_user_can( $tax->cap->edit_terms ) )
    4848                wp_die( __( 'Cheatin&#8217; uh?' ) );
    4949
    50         $ret = wp_insert_term( $_POST['tag-name'], $taxonomy, $_POST );
     50        $post_data = stripslashes_deep( $_POST );
     51
     52        $ret = wp_insert_term( $post_data['tag-name'], $taxonomy, $post_data );
    5153        $location = 'edit-tags.php?taxonomy=' . $taxonomy;
    5254        if ( 'post' != $post_type )
    5355                $location .= '&post_type=' . $post_type;
     
    132134break;
    133135
    134136case 'editedtag':
    135         $tag_ID = (int) $_POST['tag_ID'];
     137
     138        $post_data = stripslashes_deep( $_POST );
     139
     140        $tag_ID = (int) $post_data['tag_ID'];
    136141        check_admin_referer( 'update-tag_' . $tag_ID );
    137142
    138143        if ( !current_user_can( $tax->cap->edit_terms ) )
     
    142147        if ( ! $tag )
    143148                wp_die( __( 'You attempted to edit an item that doesn&#8217;t exist. Perhaps it was deleted?' ) );
    144149
    145         $ret = wp_update_term( $tag_ID, $taxonomy, $_POST );
     150        $ret = wp_update_term( $tag_ID, $taxonomy, $post_data );
    146151
    147152        $location = 'edit-tags.php?taxonomy=' . $taxonomy;
    148153        if ( 'post' != $post_type )
  • wp-admin/custom-header.php

     
    965965                                'width'         => $choice['width'],
    966966                        );
    967967
    968                         update_post_meta( $choice['attachment_id'], '_wp_attachment_is_custom_header', get_stylesheet() );
     968                        wp_update_post_meta( $choice['attachment_id'], '_wp_attachment_is_custom_header', get_stylesheet() );
    969969                        set_theme_mod( 'header_image', $choice['url'] );
    970970                        set_theme_mod( 'header_image_data', $header_image_data );
    971971                        return;
  • wp-admin/media.php

     
    3232                }
    3333                if ( false !== strpos($location, 'upload.php') ) {
    3434                        $location = remove_query_arg('message', $location);
    35                         $location = add_query_arg('posted',     $attachment_id, $location);
     35                        $location = add_query_arg('posted', $attachment_id, $location);
    3636                } elseif ( false !== strpos($location, 'media.php') ) {
    3737                        $location = add_query_arg('message', 'updated', $location);
    3838                }
  • wp-admin/nav-menus.php

     
    9393                                                if ( ! is_wp_error( $parent_object ) ) {
    9494                                                        $parent_data = (array) $parent_object;
    9595                                                        $menu_item_data['menu_item_parent'] = $parent_data['menu_item_parent'];
    96                                                         update_post_meta( $menu_item_data['ID'], '_menu_item_menu_item_parent', (int) $menu_item_data['menu_item_parent'] );
     96                                                        wp_update_post_meta( $menu_item_data['ID'], '_menu_item_menu_item_parent', (int) $menu_item_data['menu_item_parent'] );
    9797
    9898                                                }
    9999
     
    103103                                                $menu_item_data['menu_order'] = $menu_item_data['menu_order'] + 1;
    104104
    105105                                                $menu_item_data['menu_item_parent'] = $next_item_data['ID'];
    106                                                 update_post_meta( $menu_item_data['ID'], '_menu_item_menu_item_parent', (int) $menu_item_data['menu_item_parent'] );
     106                                                wp_update_post_meta( $menu_item_data['ID'], '_menu_item_menu_item_parent', (int) $menu_item_data['menu_item_parent'] );
    107107
    108108                                                wp_update_post($menu_item_data);
    109109                                                wp_update_post($next_item_data);
     
    115115                                        in_array( $menu_item_data['menu_item_parent'], $orders_to_dbids )
    116116                                ) {
    117117                                        $menu_item_data['menu_item_parent'] = (int) get_post_meta( $menu_item_data['menu_item_parent'], '_menu_item_menu_item_parent', true);
    118                                         update_post_meta( $menu_item_data['ID'], '_menu_item_menu_item_parent', (int) $menu_item_data['menu_item_parent'] );
     118                                        wp_update_post_meta( $menu_item_data['ID'], '_menu_item_menu_item_parent', (int) $menu_item_data['menu_item_parent'] );
    119119                                }
    120120                        }
    121121                }
     
    190190                                                        $menu_item_data['menu_order'] = $menu_item_data['menu_order'] - 1;
    191191
    192192                                                        // save changes
    193                                                         update_post_meta( $menu_item_data['ID'], '_menu_item_menu_item_parent', (int) $menu_item_data['menu_item_parent'] );
     193                                                        wp_update_post_meta( $menu_item_data['ID'], '_menu_item_menu_item_parent', (int) $menu_item_data['menu_item_parent'] );
    194194                                                        wp_update_post($menu_item_data);
    195195                                                        wp_update_post($parent_data);
    196196                                                }
     
    205205                                        ) {
    206206                                                // just make it a child of the previous; keep the order
    207207                                                $menu_item_data['menu_item_parent'] = (int) $orders_to_dbids[$dbids_to_orders[$menu_item_id] - 1];
    208                                                 update_post_meta( $menu_item_data['ID'], '_menu_item_menu_item_parent', (int) $menu_item_data['menu_item_parent'] );
     208                                                wp_update_post_meta( $menu_item_data['ID'], '_menu_item_menu_item_parent', (int) $menu_item_data['menu_item_parent'] );
    209209                                                wp_update_post($menu_item_data);
    210210                                        }
    211211                                }
  • wp-admin/custom-background.php

     
    382382
    383383                // Add the meta-data
    384384                wp_update_attachment_metadata( $id, wp_generate_attachment_metadata( $id, $file ) );
    385                 update_post_meta( $id, '_wp_attachment_is_custom_background', get_option('stylesheet' ) );
     385                wp_update_post_meta( $id, '_wp_attachment_is_custom_background', get_option('stylesheet' ) );
    386386
    387387                set_theme_mod('background_image', esc_url_raw($url));
    388388
     
    423423                if ( in_array( $_POST['size'], $sizes ) )
    424424                        $size = esc_attr( $_POST['size'] );
    425425
    426                 update_post_meta( $attachment_id, '_wp_attachment_is_custom_background', get_option('stylesheet' ) );
     426                wp_update_post_meta( $attachment_id, '_wp_attachment_is_custom_background', get_option('stylesheet' ) );
    427427                $url = wp_get_attachment_image_src( $attachment_id, $size );
    428428                $thumbnail = wp_get_attachment_image_src( $attachment_id, 'thumbnail' );
    429429                set_theme_mod( 'background_image', esc_url_raw( $url[0] ) );