Changeset 22304

Timestamp:

10/25/2012 08:52:50 PM (12 years ago)

Author:

nacin

Message:

When replacing floats in wpdb::prepare(), avoid escaped placeholders (%%f). props SergeyBiryukov. fixes #19861.

File:

• trunk/wp-includes/wp-db.php (modified) (1 diff)

trunk/wp-includes/wp-db.php

@@ -999 +999 @@
         $query = str_replace( "'%s'", '%s', $query ); // in case someone mistakenly already singlequoted it
         $query = str_replace( '"%s"', '%s', $query ); // doublequote unquoting
-        $query = str_replace( '%f' , '%F', $query ); // Force floats to be locale unaware
+        $query = preg_replace( '|(?<!%)%f|' , '%F', $query ); // Force floats to be locale unaware
         $query = preg_replace( '|(?<!%)%s|', "'%s'", $query ); // quote the strings, avoiding escaped strings like %%s
         array_walk( $args, array( $this, 'escape_by_ref' ) );