Ticket #8460: duplicate-posts-comments-import.diff

wp-admin/includes/post.php

@@ -403 +403 @@
  *
  * @param unknown_type $title
  * @param unknown_type $content
- * @param unknown_type $post_date
+ * @param unknown_type $date
  * @return unknown
  */
-function post_exists($title, $content = '', $post_date = '') {
+function post_exists($title, $content = '', $date = '') {
         global $wpdb;
 
-        $title = stripslashes($title);
-        $content = stripslashes($content);
-        $post_date = stripslashes($post_date);
+        $post_title = stripslashes( sanitize_post_field( 'post_title', $title, 0, 'db' ) );
+        $post_content = stripslashes( sanitize_post_field( 'post_content', $content, 0, 'db' ) );    
+        $post_date = stripslashes( sanitize_post_field( 'post_date', $date, 0, 'db' ) );
+    
+        if ( !empty ( $date ) )
+                $post_date = $wpdb->prepare( "AND post_date = %s", $post_date );
 
-        if (!empty ($post_date))
-                $post_date = $wpdb->prepare("AND post_date = %s", $post_date);
+        if ( !empty ( $title ) )
+                $post_title = $wpdb->prepare( "AND post_title = %s", $post_title );
+    
+        if ( !empty ( $content ) )
+        $post_content = $wpdb->prepare( "AND post_content = %s", $post_content );
+    
+    if ( !empty ( $date ) || !empty( $title ) || !empty( $content ) )
+        return $wpdb->get_var( "SELECT ID FROM $wpdb->posts WHERE 1 $post_title $post_content $post_date" );
 
-        if (!empty ($title))
-                return $wpdb->get_var( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title = %s $post_date", $title) );
-        else
-                if (!empty ($content))
-                        return $wpdb->get_var( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_content = %s $post_date", $content) );
-
         return 0;
 }
 

wp-admin/includes/comment.php

@@ -19 +19 @@
 function comment_exists($comment_author, $comment_date) {
         global $wpdb;
 
-        return $wpdb->get_var( $wpdb->prepare("SELECT comment_post_ID FROM $wpdb->comments
-                        WHERE comment_author = %s AND comment_date = %s", $comment_author, $comment_date) );
+    /*
+     * in the current use cases (all in wp-admin/import) the comment_author
+     * variable is already escaped. running this through the prepare statement leads to
+     * double escaped values.
+     * so we are just preparing comment_date here
+     */
+    $comment_date = $wpdb->prepare( $comment_date );
+
+        return $wpdb->get_var( sprintf( "SELECT comment_post_ID FROM $wpdb->comments
+                        WHERE comment_author = '%s' AND comment_date = '%s'", $comment_author, $comment_date) );
 }
 
 /**