Index: /trunk/wp-admin/admin-functions.php =================================================================== --- /trunk/wp-admin/admin-functions.php (revision 1434) +++ /trunk/wp-admin/admin-functions.php (revision 1435) @@ -81,5 +81,5 @@ $result[$cat]['cat_ID'] = $cat; $result[$cat]['checked'] = in_array($cat, $checked_categories); - $result[$cat]['cat_name'] = stripslashes(get_the_category_by_ID($cat)); + $result[$cat]['cat_name'] = get_the_category_by_ID($cat); } Index: /trunk/wp-admin/link-categories.php =================================================================== --- /trunk/wp-admin/link-categories.php (revision 1434) +++ /trunk/wp-admin/link-categories.php (revision 1435) @@ -88,5 +88,4 @@ $cat_id = $_GET['cat_id']; $cat_name=get_linkcatname($cat_id); - $cat_name=addslashes($cat_name); if ($cat_id=="1") @@ -133,5 +132,5 @@ - + @@ -191,13 +190,13 @@ - + - + - + @@ -224,5 +223,5 @@ $cat_id=$_POST["cat_id"]; - $cat_name=addslashes(stripslashes($_POST["cat_name"])); + $cat_name= $_POST["cat_name"]; $auto_toggle = $_POST["auto_toggle"]; if ($auto_toggle != 'Y') { @@ -334,5 +333,5 @@ ?> style="border-bottom: 1px dotted #9C9A9C;"> - cat_name)?> + cat_name?> cat_id?> auto_toggle?> Index: /trunk/wp-admin/link-manager.php =================================================================== --- /trunk/wp-admin/link-manager.php (revision 1434) +++ /trunk/wp-admin/link-manager.php (revision 1435) @@ -313,14 +313,14 @@ if ($row) { - $link_url = stripslashes($row->link_url); - $link_name = stripslashes($row->link_name); + $link_url = $row->link_url; + $link_name = $row->link_name; $link_image = $row->link_image; $link_target = $row->link_target; $link_category = $row->link_category; - $link_description = stripslashes($row->link_description); + $link_description = $row->link_description; $link_visible = $row->link_visible; $link_rating = $row->link_rating; - $link_rel = stripslashes($row->link_rel); - $link_notes = stripslashes($row->link_notes); + $link_rel = $row->link_rel; + $link_notes = $row->link_notes; $link_rss_uri = $row->link_rss; } @@ -691,5 +691,5 @@ if ($links) { foreach ($links as $link) { - $short_url = str_replace('http://', '', stripslashes($link->link_url)); + $short_url = str_replace('http://', '', $link->link_url); $short_url = str_replace('www.', '', $short_url); if ('/' == substr($short_url, -1)) @@ -698,8 +698,4 @@ $short_url = substr($short_url, 0, 32).'...'; - $link->link_name = stripslashes($link->link_name); - $link->category = stripslashes($link->category); - $link->link_rel = stripslashes($link->link_rel); - $link->link_description = stripslashes($link->link_description); $image = ($link->link_image != null) ? __('Yes') : __('No'); $visible = ($link->link_visible == 'Y') ? __('Yes') : __('No'); Index: /trunk/wp-admin/menu.php =================================================================== --- /trunk/wp-admin/menu.php (revision 1434) +++ /trunk/wp-admin/menu.php (revision 1435) @@ -41,4 +41,4 @@
  • »
    • + ?>/wp-login.php?action=logout" title=""> Index: /trunk/wp-admin/options.php =================================================================== --- /trunk/wp-admin/options.php (revision 1434) +++ /trunk/wp-admin/options.php (revision 1435) @@ -76,5 +76,5 @@ // should we even bother checking? if ($user_level >= $option->option_admin_level) { - $old_val = stripslashes($option->option_value); + $old_val = $option->option_value; $new_val = $_POST[$option->option_name]; if (!$new_val) { Index: /trunk/wp-admin/profile.php =================================================================== --- /trunk/wp-admin/profile.php (revision 1434) +++ /trunk/wp-admin/profile.php (revision 1435) @@ -84,17 +84,17 @@ } - $newuser_firstname=addslashes(stripslashes($_POST['newuser_firstname'])); - $newuser_lastname=addslashes(stripslashes($_POST['newuser_lastname'])); - $newuser_nickname=addslashes(stripslashes($_POST['newuser_nickname'])); + $newuser_firstname=$_POST['newuser_firstname']; + $newuser_lastname=$_POST['newuser_lastname']; + $newuser_nickname=$_POST['newuser_nickname']; $newuser_nicename=sanitize_title($newuser_nickname); - $newuser_icq=addslashes(stripslashes($_POST['newuser_icq'])); - $newuser_aim=addslashes(stripslashes($_POST['newuser_aim'])); - $newuser_msn=addslashes(stripslashes($_POST['newuser_msn'])); - $newuser_yim=addslashes(stripslashes($_POST['newuser_yim'])); - $newuser_email=addslashes(stripslashes($_POST['newuser_email'])); - $newuser_url=addslashes(stripslashes($_POST['newuser_url'])); + $newuser_icq=$_POST['newuser_icq']; + $newuser_aim=$_POST['newuser_aim']; + $newuser_msn=$_POST['newuser_msn']; + $newuser_yim=$_POST['newuser_yim']; + $newuser_email=$_POST['newuser_email']; + $newuser_url=$_POST['newuser_url']; $newuser_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $newuser_url) ? $newuser_url : 'http://' . $newuser_url; - $newuser_idmode=addslashes(stripslashes($_POST['newuser_idmode'])); - $user_description = addslashes(stripslashes($_POST['user_description'])); + $newuser_idmode=$_POST['newuser_idmode']; + $user_description = $_POST['user_description']; $query = "UPDATE $wpdb->users SET user_firstname='$newuser_firstname', $updatepassword user_lastname='$newuser_lastname', user_nickname='$newuser_nickname', user_icq='$newuser_icq', user_email='$newuser_email', user_url='$newuser_url', user_aim='$newuser_aim', user_msn='$newuser_msn', user_yim='$newuser_yim', user_idmode='$newuser_idmode', user_description = '$user_description', user_nicename = '$newuser_nicename' WHERE ID = $user_ID"; Index: /trunk/wp-admin/upgrade-functions.php =================================================================== --- /trunk/wp-admin/upgrade-functions.php (revision 1434) +++ /trunk/wp-admin/upgrade-functions.php (revision 1435) @@ -89,4 +89,21 @@ } return $all_options; +} + +function deslash($content) { + // Note: \\\ inside a regex denotes a single backslash. + + // Replace one or more backslashes followed by a single quote with + // a single quote. + $content = preg_replace("/\\\+'/", "'", $content); + + // Replace one or more backslashes followed by a double quote with + // a double quote. + $content = preg_replace('/\\\+"/', '"', $content); + + // Replace one or more backslashes with one backslash. + $content = preg_replace("/\\\+/", "\\", $content); + + return $content; } @@ -872,4 +889,25 @@ $wpdb->query("UPDATE $wpdb->options SET `autoload` = 'no' WHERE option_name = '$fatoption'"); endforeach; + + // Remove extraneous backslashes. + $posts = $wpdb->get_results("SELECT ID, post_title, post_content, post_excerpt FROM $wpdb->posts"); + if ($posts) { + foreach($posts as $post) { + $post_content = addslashes(deslash($post->post_content)); + $post_title = addslashes(deslash($post->post_title)); + $post_excerpt = addslashes(deslash($post->post_excerpt)); + $wpdb->query("UPDATE $wpdb->posts SET post_title = '$post_title', post_content = '$post_content', post_excerpt = '$post_excerpt' WHERE ID = '$post->ID'"); + } + } + + // Remove extraneous backslashes. + $comments = $wpdb->get_results("SELECT comment_ID, comment_author, comment_content FROM $wpdb->comments"); + if ($comments) { + foreach($comments as $comment) { + $comment_content = addslashes(deslash($comment->comment_content)); + $comment_author = addslashes(deslash($comment->comment_author)); + $wpdb->query("UPDATE $wpdb->comments SET comment_content = '$comment_content', comment_author = '$comment_author' WHERE comment_ID = '$comment->comment_ID'"); + } + } } Index: /trunk/wp-admin/users.php =================================================================== --- /trunk/wp-admin/users.php (revision 1434) +++ /trunk/wp-admin/users.php (revision 1435) @@ -71,11 +71,5 @@ } - $user_login = addslashes(stripslashes($user_login)); - $pass1 = addslashes(stripslashes($pass1)); - $user_nickname = addslashes(stripslashes($user_nickname)); $user_nicename = sanitize_title($user_nickname); - $user_firstname = addslashes(stripslashes($user_firstname)); - $user_lastname = addslashes(stripslashes($user_lastname)); - $user_uri = addslashes(stripslashes($user_uri)); $user_uri = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $user_uri) ? $user_uri : 'http://' . $user_uri; $now = gmdate('Y-m-d H:i:s'); @@ -96,4 +90,5 @@ } + $user_login = stripslashes($user_login); $message = 'New user registration on your blog ' . get_settings('blogname') . ":\r\n\r\n"; $message .= "Login: $user_login\r\n\r\nE-mail: $user_email"; @@ -205,5 +200,5 @@ $email = $user_data->user_email; $url = $user_data->user_url; - $short_url = str_replace('http://', '', stripslashes($url)); + $short_url = str_replace('http://', '', $url); $short_url = str_replace('www.', '', $short_url); if ('/' == substr($short_url, -1)) @@ -256,5 +251,5 @@ $email = $user_data->user_email; $url = $user_data->user_url; - $short_url = str_replace('http://', '', stripslashes($url)); + $short_url = str_replace('http://', '', $url); $short_url = str_replace('www.', '', $short_url); if ('/' == substr($short_url, -1)) Index: /trunk/wp-includes/functions-formatting.php =================================================================== --- /trunk/wp-includes/functions-formatting.php (revision 1434) +++ /trunk/wp-includes/functions-formatting.php (revision 1435) @@ -51,5 +51,4 @@ function clean_pre($text) { - $text = stripslashes($text); $text = str_replace('
    ', '', $text); return $text; Index: /trunk/wp-includes/functions.php =================================================================== --- /trunk/wp-includes/functions.php (revision 1434) +++ /trunk/wp-includes/functions.php (revision 1435) @@ -167,14 +167,9 @@ global $wpdb, $cache_userdata; if ( empty($cache_userdata[$userid]) ) { - $user = $wpdb->get_row("SELECT * FROM $wpdb->users WHERE ID = '$userid'"); - $user->user_nickname = stripslashes($user->user_nickname); - $user->user_firstname = stripslashes($user->user_firstname); - $user->user_lastname = stripslashes($user->user_lastname); - $user->user_description = stripslashes($user->user_description); - $cache_userdata[$userid] = $user; - } else { - $user = $cache_userdata[$userid]; - } - return $user; + $cache_userdata[$userid] = + $wpdb->get_row("SELECT * FROM $wpdb->users WHERE ID = '$userid'"); + } + + return $cache_userdata[$userid]; } @@ -316,5 +311,5 @@ if ('home' == $option->option_name) $option->option_value = preg_replace('|/+$|', '', $option->option_value); if ('category_base' == $option->option_name) $option->option_value = preg_replace('|/+$|', '', $option->option_value); - $all_options->{$option->option_name} = stripslashes($option->option_value); + $all_options->{$option->option_name} = $option->option_value; } } @@ -324,5 +319,5 @@ function update_option($option_name, $newvalue) { global $wpdb, $cache_settings; - $newvalue = stripslashes($newvalue); + $newvalue = $newvalue; $newvalue = trim($newvalue); // I can't think of any situation we wouldn't want to trim $newvalue = $wpdb->escape($newvalue); @@ -517,7 +512,7 @@ function trackback($trackback_url, $title, $excerpt, $ID) { global $wpdb; - $title = urlencode(stripslashes($title)); - $excerpt = urlencode(stripslashes($excerpt)); - $blog_name = urlencode(stripslashes(get_settings('blogname'))); + $title = urlencode($title); + $excerpt = urlencode($excerpt); + $blog_name = urlencode(get_settings('blogname')); $tb_url = $trackback_url; $url = urlencode(get_permalink($ID)); @@ -933,29 +928,29 @@ $comment_author_domain = gethostbyaddr($comment->comment_author_IP); - $blogname = stripslashes(get_settings('blogname')); + $blogname = get_settings('blogname'); if ('comment' == $comment_type) { - $notify_message = "New comment on your post #$comment->comment_post_ID \"".stripslashes($post->post_title)."\"\r\n\r\n"; + $notify_message = "New comment on your post #$comment->comment_post_ID \"".$post->post_title."\"\r\n\r\n"; $notify_message .= "Author : $comment->comment_author (IP: $comment->comment_author_IP , $comment_author_domain)\r\n"; $notify_message .= "E-mail : $comment->comment_author_email\r\n"; $notify_message .= "URI : $comment->comment_author_url\r\n"; $notify_message .= "Whois : http://ws.arin.net/cgi-bin/whois.pl?queryinput=$comment->comment_author_IP\r\n"; - $notify_message .= "Comment:\r\n".stripslashes($comment->comment_content)."\r\n\r\n"; + $notify_message .= "Comment:\r\n".$comment->comment_content."\r\n\r\n"; $notify_message .= "You can see all comments on this post here: \r\n"; - $subject = '[' . $blogname . '] Comment: "' .stripslashes($post->post_title).'"'; + $subject = '[' . $blogname . '] Comment: "' .$post->post_title.'"'; } elseif ('trackback' == $comment_type) { - $notify_message = "New trackback on your post #$comment_post_ID \"".stripslashes($post->post_title)."\"\r\n\r\n"; + $notify_message = "New trackback on your post #$comment_post_ID \"".$post->post_title."\"\r\n\r\n"; $notify_message .= "Website: $comment->comment_author (IP: $comment->comment_author_IP , $comment_author_domain)\r\n"; $notify_message .= "URI : $comment->comment_author_url\r\n"; - $notify_message .= "Excerpt: \n".stripslashes($comment->comment_content)."\r\n\r\n"; + $notify_message .= "Excerpt: \n".$comment->comment_content."\r\n\r\n"; $notify_message .= "You can see all trackbacks on this post here: \r\n"; - $subject = '[' . $blogname . '] Trackback: "' .stripslashes($post->post_title).'"'; + $subject = '[' . $blogname . '] Trackback: "' .$post->post_title.'"'; } elseif ('pingback' == $comment_type) { - $notify_message = "New pingback on your post #$comment_post_ID \"".stripslashes($post->post_title)."\"\r\n\r\n"; + $notify_message = "New pingback on your post #$comment_post_ID \"".$post->post_title."\"\r\n\r\n"; $notify_message .= "Website: $comment->comment_author\r\n"; $notify_message .= "URI : $comment->comment_author_url\r\n"; $notify_message .= "Excerpt: \n[...] $original_context [...]\r\n\r\n"; $notify_message .= "You can see all pingbacks on this post here: \r\n"; - $subject = '[' . $blogname . '] Pingback: "' .stripslashes($post->post_title).'"'; + $subject = '[' . $blogname . '] Pingback: "' .$post->post_title.'"'; } $notify_message .= get_permalink($comment->comment_post_ID) . '#comments'; @@ -964,5 +959,5 @@ $from = "From: \"$blogname\" '; } else { - $from = 'From: "' . stripslashes($comment->comment_author) . "\" <$comment->comment_author_email>"; + $from = 'From: "' . $comment->comment_author . "\" <$comment->comment_author_email>"; } @@ -992,10 +987,10 @@ $comments_waiting = $wpdb->get_var("SELECT count(comment_ID) FROM $wpdb->comments WHERE comment_approved = '0'"); - $notify_message = "A new comment on the post #$comment->comment_post_ID \"".stripslashes($post->post_title)."\" is waiting for your approval\r\n\r\n"; + $notify_message = "A new comment on the post #$comment->comment_post_ID \"".$post->post_title."\" is waiting for your approval\r\n\r\n"; $notify_message .= "Author : $comment->comment_author (IP: $comment->comment_author_IP , $comment_author_domain)\r\n"; $notify_message .= "E-mail : $comment->comment_author_email\r\n"; $notify_message .= "URL : $comment->comment_author_url\r\n"; $notify_message .= "Whois : http://ws.arin.net/cgi-bin/whois.pl?queryinput=$comment->comment_author_IP\r\n"; - $notify_message .= "Comment:\r\n".stripslashes($comment->comment_content)."\r\n\r\n"; + $notify_message .= "Comment:\r\n".$comment->comment_content."\r\n\r\n"; $notify_message .= "To approve this comment, visit: " . get_settings('siteurl') . "/wp-admin/post.php?action=mailapprovecomment&p=".$comment->comment_post_ID."&comment=$comment_id\r\n"; $notify_message .= "To delete this comment, visit: " . get_settings('siteurl') . "/wp-admin/post.php?action=confirmdeletecomment&p=".$comment->comment_post_ID."&comment=$comment_id\r\n"; @@ -1003,5 +998,5 @@ $notify_message .= get_settings('siteurl') . "/wp-admin/moderation.php\r\n"; - $subject = '[' . stripslashes(get_settings('blogname')) . '] Please approve: "' .stripslashes($post->post_title).'"'; + $subject = '[' . get_settings('blogname') . '] Please approve: "' .$post->post_title.'"'; $admin_email = get_settings("admin_email"); $from = "From: $admin_email"; Index: /trunk/wp-includes/links.php =================================================================== --- /trunk/wp-includes/links.php (revision 1434) +++ /trunk/wp-includes/links.php (revision 1435) @@ -177,12 +177,12 @@ $the_link = '#'; if (($row->link_url != null) && ($row->link_url != '')) { - $the_link = htmlspecialchars(stripslashes($row->link_url)); - } - $rel = stripslashes($row->link_rel); + $the_link = htmlspecialchars($row->link_url); + } + $rel = $row->link_rel; if ($rel != '') { $rel = " rel='$rel'"; } - $desc = htmlspecialchars(stripslashes($row->link_description), ENT_QUOTES); - $name = htmlspecialchars(stripslashes($row->link_name), ENT_QUOTES); + $desc = htmlspecialchars($row->link_description, ENT_QUOTES); + $name = htmlspecialchars($row->link_name, ENT_QUOTES); $title = $desc; @@ -274,5 +274,5 @@ ** $links = get_linkobjectsbyname('fred'); ** foreach ($links as $link) { - ** echo '
  • '.stripslashes($link->link_name).'
    • '; + ** echo '
  • '.$link->link_name.'
    • '; ** } **/ @@ -351,8 +351,8 @@ if ($results) { foreach ($results as $result) { - $result->link_url = stripslashes($result->link_url); - $result->link_name = stripslashes($result->link_name); - $result->link_description = stripslashes($result->link_description); - $result->link_notes = stripslashes($result->link_notes); + $result->link_url = $result->link_url; + $result->link_name = $result->link_name; + $result->link_description = $result->link_description; + $result->link_notes = $result->link_notes; $newresults[] = $result; } @@ -465,5 +465,5 @@ $cat_name = $wpdb->get_var("SELECT cat_name FROM $wpdb->linkcategories WHERE cat_id=$id"); } - return stripslashes($cat_name); + return $cat_name; } @@ -560,5 +560,5 @@ // Display the category name - echo '
  • ' . stripslashes($cat['cat_name']) . "\n\t