Changeset 18350 for trunk/wp-admin/includes/deprecated.php

Timestamp:

06/27/2011 08:47:04 PM (14 years ago)

Author:

ryan

Message:

Sanitize sort_column and sort_order in get_pages(). Escape search_term in WP_User_Search. Cast blog_id to int in get_blog_prefix(). Props duck_

File:

• trunk/wp-admin/includes/deprecated.php (modified) (2 diffs)

trunk/wp-admin/includes/deprecated.php

@@ -455 +455 @@
         _deprecated_function( __FUNCTION__, '3.1', 'WP_User_Query' );
 
-        $this->search_term = $search_term;
+        $this->search_term = stripslashes( $search_term );
         $this->raw_page = ( '' == $page ) ? false : (int) $page;
         $this->page = (int) ( '' == $page ) ? 1 : $page;
@@ -486 +486 @@
             $search_sql = 'AND (';
             foreach ( array('user_login', 'user_nicename', 'user_email', 'user_url', 'display_name') as $col )
-                $searches[] = $col . " LIKE '%$this->search_term%'";
+                $searches[] = $wpdb->prepare( $col . ' LIKE %s', '%' . like_escape($this->search_term) . '%' );
             $search_sql .= implode(' OR ', $searches);
             $search_sql .= ')';