Changeset 23554 for trunk/wp-trackback.php

Timestamp:

03/01/2013 04:28:40 PM (12 years ago)

Author:

ryan

Message:

Revert 23416, 23419, 23445 except for wp_reset_vars() changes. We are going a different direction with the slashing cleanup, so resetting to a clean slate. see #21767

File:

• trunk/wp-trackback.php (modified) (2 diffs)

trunk/wp-trackback.php

@@ -46 +46 @@
 
 // These three are stripslashed here so that they can be properly escaped after mb_convert_encoding()
-$title     = isset($_POST['title'])     ? wp_unslash( $_POST['title'] )      : '';
-$excerpt   = isset($_POST['excerpt'])   ? wp_unslash( $_POST['excerpt'] )    : '';
-$blog_name = isset($_POST['blog_name']) ? wp_unslash( $_POST['blog_name'] )  : '';
+$title     = isset($_POST['title'])     ? stripslashes($_POST['title'])      : '';
+$excerpt   = isset($_POST['excerpt'])   ? stripslashes($_POST['excerpt'])    : '';
+$blog_name = isset($_POST['blog_name']) ? stripslashes($_POST['blog_name'])  : '';
 
 if ($charset)
@@ -64 +64 @@
     $blog_name = mb_convert_encoding($blog_name, get_option('blog_charset'), $charset);
 }
+
+// Now that mb_convert_encoding() has been given a swing, we need to escape these three
+$title     = $wpdb->escape($title);
+$excerpt   = $wpdb->escape($excerpt);
+$blog_name = $wpdb->escape($blog_name);
 
 if ( is_single() || is_page() )