Changeset 24713 for trunk/wp-admin/includes/ajax-actions.php

Timestamp:

07/16/2013 02:19:03 PM (12 years ago)

Author:

nacin

Message:

Use wp_slash() in places where we improperly used the DB API instead. see #21767.

File:

• trunk/wp-admin/includes/ajax-actions.php (modified) (1 diff)

trunk/wp-admin/includes/ajax-actions.php

@@ -740 +740 @@
     if ( $user->exists() ) {
         $user_ID = $user->ID;
-        $comment_author       = $wpdb->escape($user->display_name);
-        $comment_author_email = $wpdb->escape($user->user_email);
-        $comment_author_url   = $wpdb->escape($user->user_url);
+        $comment_author       = wp_slash( $user->display_name );
+        $comment_author_email = wp_slash( $user->user_email );
+        $comment_author_url   = wp_slash( $user->user_url );
         $comment_content      = trim($_POST['content']);
         if ( current_user_can( 'unfiltered_html' ) ) {