Changeset 11978

Timestamp:

09/27/2009 05:33:56 AM (15 years ago)

Author:

markjaquith

Message:

esc_sql() for wp-includes

Location:

trunk/wp-includes

Files:

• comment.php (modified) (1 diff)
• formatting.php (modified) (2 diffs)
• functions.php (modified) (6 diffs)
• post.php (modified) (1 diff)
• query.php (modified) (1 diff)
• registration.php (modified) (1 diff)
• user.php (modified) (1 diff)

trunk/wp-includes/comment.php

@@ -1230 +1230 @@
 
     // Escape data pulled from DB.
-    $comment = $wpdb->escape($comment);
+    $comment = esc_sql($comment);
 
     $old_status = $comment['comment_approved'];

trunk/wp-includes/formatting.php

@@ -1111 +1111 @@
     }
 
-    return $wpdb->escape($gpc);
+    return esc_sql($gpc);
 }
 
@@ -1281 +1281 @@
     $text = stripslashes($text);
     $text = preg_replace_callback('|<a (.+?)>|i', 'wp_rel_nofollow_callback', $text);
-    $text = $wpdb->escape($text);
+    $text = esc_sql($text);
     return $text;
 }

trunk/wp-includes/functions.php

@@ -498 +498 @@
     wp_protect_special_option( $option_name );
 
-    $safe_option_name = $wpdb->escape( $option_name );
+    $safe_option_name = esc_sql( $option_name );
     $newvalue = sanitize_option( $option_name, $newvalue );
 
@@ -572 +572 @@
 
     wp_protect_special_option( $name );
-    $safe_name = $wpdb->escape( $name );
+    $safe_name = esc_sql( $name );
     $value = sanitize_option( $name, $value );
 
@@ -655 +655 @@
         return wp_cache_delete($transient, 'transient');
     } else {
-        $transient = '_transient_' . $wpdb->escape($transient);
+        $transient = '_transient_' . esc_sql($transient);
         return delete_option($transient);
     }
@@ -683 +683 @@
         $value = wp_cache_get($transient, 'transient');
     } else {
-        $transient_option = '_transient_' . $wpdb->escape($transient);
+        $transient_option = '_transient_' . esc_sql($transient);
         // If option is not in alloptions, it is not autoloaded and thus has a timeout
         $alloptions = wp_load_alloptions();
         if ( !isset( $alloptions[$transient_option] ) ) {
-            $transient_timeout = '_transient_timeout_' . $wpdb->escape($transient);
+            $transient_timeout = '_transient_timeout_' . esc_sql($transient);
             if ( get_option($transient_timeout) < time() ) {
                 delete_option($transient_option);
@@ -724 +724 @@
         $transient_timeout = '_transient_timeout_' . $transient;
         $transient = '_transient_' . $transient;
-        $safe_transient = $wpdb->escape($transient);
+        $safe_transient = esc_sql($transient);
         if ( false === get_option( $safe_transient ) ) {
             $autoload = 'yes';
@@ -1413 +1413 @@
             $array[$k] = add_magic_quotes( $v );
         } else {
-            $array[$k] = $wpdb->escape( $v );
+            $array[$k] = esc_sql( $v );
         }
     }

trunk/wp-includes/post.php

@@ -1753 +1753 @@
         // Page slugs must be unique within their own trees.  Pages are in a
         // separate namespace than posts so page slugs are allowed to overlap post slugs.
-        $check_sql = "SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_type IN ( '" . implode("', '", $wpdb->escape($hierarchical_post_types)) . "' ) AND ID != %d AND post_parent = %d LIMIT 1";
+        $check_sql = "SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_type IN ( '" . implode("', '", esc_sql($hierarchical_post_types)) . "' ) AND ID != %d AND post_parent = %d LIMIT 1";
         $post_name_check = $wpdb->get_var($wpdb->prepare($check_sql, $slug, $post_ID, $post_parent));
 

trunk/wp-includes/query.php

@@ -1757 +1757 @@
                 $searchand = ' AND ';
             }
-            $term = $wpdb->escape($q['s']);
+            $term = esc_sql($q['s']);
             if (empty($q['sentence']) && count($q['search_terms']) > 1 && $q['search_terms'][0] != $q['s'] )
                 $search .= " OR ($wpdb->posts.post_title LIKE '{$n}{$term}{$n}') OR ($wpdb->posts.post_content LIKE '{$n}{$term}{$n}')";

trunk/wp-includes/registration.php

@@ -294 +294 @@
     global $wpdb;
 
-    $user_login = $wpdb->escape($username);
-    $user_email = $wpdb->escape($email);
+    $user_login = esc_sql( $username );
+    $user_email = esc_sql( $email    );
     $user_pass = $password;
 

trunk/wp-includes/user.php

@@ -154 +154 @@
     global $wpdb;
     if ( !$user )
-        $user = $wpdb->escape($_COOKIE[USER_COOKIE]);
+        $user = esc_sql( $_COOKIE[USER_COOKIE] );
     return $wpdb->get_var( $wpdb->prepare("SELECT $field FROM $wpdb->users WHERE user_login = %s", $user) );
 }