Changeset 23564

Timestamp:

03/01/2013 05:01:01 PM (11 years ago)

Author:

ryan

Message:

Use prepare instead of escape.

see #21767

File:

• trunk/wp-admin/includes/schema.php (modified) (2 diffs)

trunk/wp-admin/includes/schema.php

@@ -506 +506 @@
             $autoload = 'yes';
 
-        $option = $wpdb->escape($option);
         if ( is_array($value) )
             $value = serialize($value);
-        $value = $wpdb->escape($value);
         if ( !empty($insert) )
             $insert .= ', ';
-        $insert .= "('$option', '$value', '$autoload')";
+        $insert .= $wpdb->prepare( "(%s, %s, %s)", $option, $value, $autoload );
     }
 
@@ -922 +920 @@
     $insert = '';
     foreach ( $sitemeta as $meta_key => $meta_value ) {
-        $meta_key = $wpdb->escape( $meta_key );
         if ( is_array( $meta_value ) )
             $meta_value = serialize( $meta_value );
-        $meta_value = $wpdb->escape( $meta_value );
         if ( !empty( $insert ) )
             $insert .= ', ';
-        $insert .= "( $network_id, '$meta_key', '$meta_value')";
+        $insert .= $wpdb->prepare( "( %d, %s, %s)", $network_id, $meta_key, $meta_value );
     }
     $wpdb->query( "INSERT INTO $wpdb->sitemeta ( site_id, meta_key, meta_value ) VALUES " . $insert );