Changeset 16999 for trunk/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

12/16/2010 02:22:41 PM (15 years ago)

Author:

ryan

Message:

Add like_escape() to some queries. fixes #15764

File:

• trunk/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)

trunk/wp-includes/class-wp-xmlrpc-server.php

@@ -3368 +3368 @@
                 // ...or a string #title, a little more complicated
                 $title = preg_replace('/[^a-z0-9]/i', '.', $urltest['fragment']);
-                $sql = $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", $title);
+                $sql = $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", like_escape( $title ) );
                 if (! ($post_ID = $wpdb->get_var($sql)) ) {
                     // returning unknown error '0' is better than die()ing