Changeset 24714 for trunk/wp-includes/user.php

Timestamp:

07/16/2013 02:21:05 PM (12 years ago)

Author:

nacin

Message:

Use sanitize_key() instead of esc_sql() when 'escaping' variable DB field names. see #21767.

File:

• trunk/wp-includes/user.php (modified) (1 diff)

trunk/wp-includes/user.php

@@ -394 +394 @@
             $this->query_fields = array();
             foreach ( $qv['fields'] as $field )
-                $this->query_fields[] = $wpdb->users . '.' . esc_sql( $field );
+                $this->query_fields[] = $wpdb->users . '.' . sanitize_key( $field );
             $this->query_fields = implode( ',', $this->query_fields );
         } elseif ( 'all' == $qv['fields'] ) {