Changeset 12640 for trunk/wp-admin/ms-sites.php

Timestamp:

01/07/2010 08:02:52 AM (17 years ago)

Author:

westi

Message:

Use like_escape to make safe search string for like queries.

File:

• trunk/wp-admin/ms-sites.php (modified) (2 diffs)

trunk/wp-admin/ms-sites.php

@@ -312 +312 @@
                 $num = ( isset($_GET['num'] ) && intval( $_GET['num'] ) ) ? absint( $_GET['num'] ) : 15; 
                 $s = wp_specialchars( trim( $_GET[ 's' ] ) );
-
+                $like_s = like_escape($s);
+                
                 $query = "SELECT * FROM {$wpdb->blogs} WHERE site_id = '{$wpdb->siteid}' ";
 
                 if( isset($_GET['blog_name']) ) {
-                        $query .= " AND ( {$wpdb->blogs}.domain LIKE '%{$s}%' OR {$wpdb->blogs}.path LIKE '%{$s}%' ) ";
+                        $query .= " AND ( {$wpdb->blogs}.domain LIKE '%{$like_s}%' OR {$wpdb->blogs}.path LIKE '%{$like_s}%' ) ";
                 } elseif( isset($_GET['blog_id']) ) {
                         $query .= " AND   blog_id = '". absint( $_GET['blog_id'] )."' ";
@@ -324 +325 @@
                                 WHERE site_id = '{$wpdb->siteid}'
                                 AND {$wpdb->blogs}.blog_id = {$wpdb->registration_log}.blog_id
-                                AND {$wpdb->registration_log}.IP LIKE ('%{$s}%')";
+                                AND {$wpdb->registration_log}.IP LIKE ('%{$like_s}%')";
                 }