Changeset 18652

Timestamp:

09/08/2011 05:17:17 PM (13 years ago)

Author:

ryan

Message:

Don't send page slugs through prepare() to avoid breaking octets in i18n page slugs. Props SergeyBiryukov. see #10249 #166687

File:

• trunk/wp-includes/post.php (modified) (1 diff)

trunk/wp-includes/post.php

@@ -3157 +3157 @@
 
     $in_string = "'". implode( "','", $parts ) . "'";
-    $pages = $wpdb->get_results( $wpdb->prepare( "SELECT ID, post_name, post_parent FROM $wpdb->posts WHERE post_name IN ({$in_string}) AND (post_type = %s OR post_type = 'attachment')", $post_type ), OBJECT_K );
+    $post_type_sql = $post_type;
+    $wpdb->escape_by_ref( $post_type_sql );
+    $pages = $wpdb->get_results( "SELECT ID, post_name, post_parent FROM $wpdb->posts WHERE post_name IN ($in_string) AND (post_type = '$post_type_sql' OR post_type = 'attachment')", OBJECT_K );
 
     $revparts = array_reverse( $parts );