Changeset 16999 for trunk/wp-includes/canonical.php

Timestamp:

12/16/2010 02:22:41 PM (15 years ago)

Author:

ryan

Message:

Add like_escape() to some queries. fixes #15764

File:

• trunk/wp-includes/canonical.php (modified) (1 diff)

trunk/wp-includes/canonical.php

@@ -386 +386 @@
         return false;
 
-    $where = $wpdb->prepare("post_name LIKE %s", get_query_var('name') . '%');
+    $where = $wpdb->prepare("post_name LIKE %s", like_escape( get_query_var('name') ) . '%');
 
     // if any of post_type, year, monthnum, or day are set, use them to refine the query