Changeset 16643

Timestamp:

12/01/2010 01:51:32 AM (16 years ago)

Author:

markjaquith

Message:

Use prepare() instead of addslashes(). props wpmuguru.

File:

• trunk/wp-includes/comment.php (modified) (1 diff)

trunk/wp-includes/comment.php

@@ -1866 +1866 @@
                 return;
 
-        $tb_url = addslashes( $trackback_url );
-        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET pinged = CONCAT(pinged, '\n', '$tb_url') WHERE ID = %d", $ID) );
-        return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_url', '')) WHERE ID = %d", $ID) );
+        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET pinged = CONCAT(pinged, '\n', %s) WHERE ID = %d", $trackback_url, $ID) );
+        return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, %s, '')) WHERE ID = %d", $trackback_url, $ID) );
 }