Changeset 23563 for trunk/wp-admin/edit-comments.php

Timestamp:

03/01/2013 05:00:25 PM (12 years ago)

Author:

ryan

Message:

Use wp_unslash() instead of stripslashes() and stripslashes_deep(). Use wp_slash() instead of add_magic_quotes().

see #21767

File:

• trunk/wp-admin/edit-comments.php (modified) (3 diffs)

trunk/wp-admin/edit-comments.php

@@ -21 +21 @@
 
     if ( 'delete_all' == $doaction && !empty( $_REQUEST['pagegen_timestamp'] ) ) {
-        $comment_status = $wpdb->escape( $_REQUEST['comment_status'] );
-        $delete_time = $wpdb->escape( $_REQUEST['pagegen_timestamp'] );
-        $comment_ids = $wpdb->get_col( "SELECT comment_ID FROM $wpdb->comments WHERE comment_approved = '$comment_status' AND '$delete_time' > comment_date_gmt" );
+        $comment_status = $_REQUEST['comment_status'];
+        $delete_time = $_REQUEST['pagegen_timestamp'];
+        $comment_ids = $wpdb->get_col( $wpdb->prepare( "SELECT comment_ID FROM $wpdb->comments WHERE comment_approved = %s AND %s > comment_date_gmt", $comment_status, $delete_time ) );
         $doaction = 'delete';
     } elseif ( isset( $_REQUEST['delete_comments'] ) ) {
@@ -96 +96 @@
     exit;
 } elseif ( ! empty( $_GET['_wp_http_referer'] ) ) {
-     wp_redirect( remove_query_arg( array( '_wp_http_referer', '_wpnonce' ), stripslashes( $_SERVER['REQUEST_URI'] ) ) );
+     wp_redirect( remove_query_arg( array( '_wp_http_referer', '_wpnonce' ), wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
      exit;
 }
@@ -154 +154 @@
 
 if ( isset($_REQUEST['s']) && $_REQUEST['s'] )
-    printf( '<span class="subtitle">' . sprintf( __( 'Search results for &#8220;%s&#8221;' ), wp_html_excerpt( esc_html( stripslashes( $_REQUEST['s'] ) ), 50 ) ) . '</span>' ); ?>
+    printf( '<span class="subtitle">' . sprintf( __( 'Search results for &#8220;%s&#8221;' ), wp_html_excerpt( esc_html( wp_unslash( $_REQUEST['s'] ) ), 50 ) ) . '</span>' ); ?>
 </h2>