Changeset 17256

Timestamp:

01/11/2011 08:15:25 PM (14 years ago)

Author:

ryan

Message:

Strip and prepare ajax tag search string. Avoids applying slashes toward the character count. Props brianlayman. see #13580

File:

• trunk/wp-admin/admin-ajax.php (modified) (2 diffs)

trunk/wp-admin/admin-ajax.php

@@ -87 +87 @@
     }
 
-    $s = $_GET['q']; // is this slashed already?
+    $s = stripslashes( $_GET['q'] );
 
     if ( false !== strpos( $s, ',' ) ) {
@@ -97 +97 @@
         die; // require 2 chars for matching
 
-    $results = $wpdb->get_col( "SELECT t.name FROM $wpdb->term_taxonomy AS tt INNER JOIN $wpdb->terms AS t ON tt.term_id = t.term_id WHERE tt.taxonomy = '$taxonomy' AND t.name LIKE ('%" . $s . "%')" );
+    $results = $wpdb->get_col( $wpdb->prepare( "SELECT t.name FROM $wpdb->term_taxonomy AS tt INNER JOIN $wpdb->terms AS t ON tt.term_id = t.term_id WHERE tt.taxonomy = %s AND t.name LIKE (%s)", $taxonomy, '%' . like_escape( $s ) . '%' ) );
 
     echo join( $results, "\n" );