Changeset 16999 for trunk/wp-includes/functions.php

Timestamp:

12/16/2010 02:22:41 PM (15 years ago)

Author:

ryan

Message:

Add like_escape() to some queries. fixes #15764

File:

• trunk/wp-includes/functions.php (modified) (2 diffs)

trunk/wp-includes/functions.php

@@ -1207 +1207 @@
     foreach ( $pung as $link_test ) {
         if ( !in_array( $link_test, $post_links_temp[0] ) ) { // link no longer in post
-            $mid = $wpdb->get_col( $wpdb->prepare("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = 'enclosure' AND meta_value LIKE (%s)", $post_ID, $link_test . '%') );
+            $mid = $wpdb->get_col( $wpdb->prepare("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = 'enclosure' AND meta_value LIKE (%s)", $post_ID, like_escape( $link_test ) . '%') );
             do_action( 'delete_postmeta', $mid );
             $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->postmeta WHERE meta_id IN(%s)", implode( ',', $mid ) ) );
@@ -1227 +1227 @@
 
     foreach ( (array) $post_links as $url ) {
-        if ( $url != '' && !$wpdb->get_var( $wpdb->prepare( "SELECT post_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = 'enclosure' AND meta_value LIKE (%s)", $post_ID, $url . '%' ) ) ) {
+        if ( $url != '' && !$wpdb->get_var( $wpdb->prepare( "SELECT post_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = 'enclosure' AND meta_value LIKE (%s)", $post_ID, like_escape( $url ) . '%' ) ) ) {
 
             if ( $headers = wp_get_http_headers( $url) ) {