Changeset 24714 for trunk/wp-includes/taxonomy.php

Timestamp:

07/16/2013 02:21:05 PM (12 years ago)

Author:

nacin

Message:

Use sanitize_key() instead of esc_sql() when 'escaping' variable DB field names. see #21767.

File:

• trunk/wp-includes/taxonomy.php (modified) (1 diff)

trunk/wp-includes/taxonomy.php

@@ -792 +792 @@
             return;
 
-        $resulting_field = esc_sql( $resulting_field );
+        $resulting_field = sanitize_key( $resulting_field );
 
         switch ( $query['field'] ) {