Ticket #35795: 35795.2.diff

src/wp-includes/meta.php

@@ -161 +161 @@
         $id_column = 'user' == $meta_type ? 'umeta_id' : 'meta_id';
 
         // expected_slashed ($meta_key)
+        $raw_meta_key = $meta_key;
         $meta_key = wp_unslash($meta_key);
         $passed_value = $meta_value;
         $meta_value = wp_unslash($meta_value);
@@ -198 +199 @@
 
         $meta_ids = $wpdb->get_col( $wpdb->prepare( "SELECT $id_column FROM $table WHERE meta_key = %s AND $column = %d", $meta_key, $object_id ) );
         if ( empty( $meta_ids ) ) {
-                return add_metadata($meta_type, $object_id, $meta_key, $passed_value);
+                return add_metadata($meta_type, $object_id, $raw_meta_key, $passed_value);
         }
 
         $_meta_value = $meta_value;

new file tests/phpunit/tests/meta/updateMetadata.php

@@ +1 @@
+<?php
+
+/**
+ * @group meta
+ * @covers ::update_metadata
+ */
+class Tests_Meta_UpdateMetadata extends WP_UnitTestCase {
+        /**
+         * @ticket 35795
+         */
+        public function test_slashed_key_for_new_metadata() {
+                update_metadata( 'post', 123, wp_slash( 'foo\foo' ), 'bar' );
+
+                $found = get_metadata( 'post', 123, 'foo\foo', true );
+                $this->assertSame( 'bar', $found );
+        }
+
+        /**
+         * @ticket 35795
+         */
+        public function test_slashed_key_for_existing_metadata() {
+                global $wpdb;
+
+                add_metadata( 'post', 123, wp_slash( 'foo\foo' ), 'bar' );
+                update_metadata( 'post', 123, wp_slash( 'foo\foo' ), 'baz' );
+
+                $found = get_metadata( 'post', 123, 'foo\foo', true );
+                $this->assertSame( 'baz', $found );
+        }
+}