Ticket #6836: 6836.diff

wp-admin/includes/post.php

@@ -360 +360 @@
 
         $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
 
-        $metakeyselect = $wpdb->escape( stripslashes( trim( $_POST['metakeyselect'] ) ) );
-        $metakeyinput = $wpdb->escape( stripslashes( trim( $_POST['metakeyinput'] ) ) );
-        $metavalue = maybe_serialize( stripslashes( (trim( $_POST['metavalue'] ) ) ));
-        $metavalue = $wpdb->escape( $metavalue );
+        $metakeyselect = stripslashes( trim( $_POST['metakeyselect'] ) );
+        $metakeyinput = stripslashes( trim( $_POST['metakeyinput'] ) );
+        $meta_value = maybe_serialize( stripslashes( trim( $_POST['metavalue'] ) ) );
 
-        if ( ('0' === $metavalue || !empty ( $metavalue ) ) && ((('#NONE#' != $metakeyselect) && !empty ( $metakeyselect) ) || !empty ( $metakeyinput) ) ) {
+        if ( ('0' === $meta_value || !empty ( $meta_value ) ) && ((('#NONE#' != $metakeyselect) && !empty ( $metakeyselect) ) || !empty ( $metakeyinput) ) ) {
                 // We have a key/value pair. If both the select and the
                 // input for the key have data, the input takes precedence:
 
                 if ('#NONE#' != $metakeyselect)
-                        $metakey = $metakeyselect;
+                        $meta_key = $metakeyselect;
 
                 if ( $metakeyinput)
-                        $metakey = $metakeyinput; // default
+                        $meta_key = $metakeyinput; // default
 
-                if ( in_array($metakey, $protected) )
+                if ( in_array($meta_key, $protected) )
                         return false;
 
                 wp_cache_delete($post_ID, 'post_meta');
 
-                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta 
-                        (post_id,meta_key,meta_value ) VALUES (%s, %s, %s)",
-                        $post_ID, $metakey, $metavalue) );
+                $wpdb->insert( $wpdb->postmeta, compact('post_ID', 'meta_key', 'meta_value'));
+
                 return $wpdb->insert_id;
         }
         return false;
@@ -431 +429 @@
 
 }
 
-function update_meta( $mid, $mkey, $mvalue ) {
+function update_meta( $meta_id, $meta_key, $meta_value ) {
         global $wpdb;
 
         $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
 
-        if ( in_array($mkey, $protected) )
+        if ( in_array($meta_key, $protected) )
                 return false;
 
-        $post_id = $wpdb->get_var( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
+        $post_id = $wpdb->get_var( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = %d", $meta_id) );
         wp_cache_delete($post_id, 'post_meta');
 
-        $mvalue = maybe_serialize( stripslashes( $mvalue ));
-        $mvalue = $wpdb->escape( $mvalue );
-        $mid = (int) $mid;
-        return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->postmeta SET meta_key = %s, meta_value = %s WHERE meta_id = %d", $mkey, $mvalue, $mid) );
+        $meta_value = maybe_serialize( stripslashes( $meta_value ));
+        $meta_id = (int) $meta_id;
+
+        return $wpdb->update( $wpdb->postmeta, compact('meta_key', 'meta_value'), compact('meta_id') );
 }
 
 //
@@ -498 +496 @@
         global $wpdb;
         $old_ID = (int) $old_ID;
         $new_ID = (int) $new_ID;
-        return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_parent = %d WHERE post_parent = %d", $new_ID, $old_ID) );
+        return $wpdb->update($wpdb->posts, array('post_parent' => $new_ID), array('post_parent' => $old_ID) );
 }
 
 function get_available_post_statuses($type = 'post') {