Changeset 24715

Timestamp:

07/16/2013 02:23:29 PM (13 years ago)

Author:

nacin

Message:

More clear and concise escaping in get_page_by_path(). see #21767.

File:

• trunk/wp-includes/post.php (modified) (1 diff)

trunk/wp-includes/post.php

@@ -3418 +3418 @@
         $page_path = str_replace('%20', ' ', $page_path);
         $parts = explode( '/', trim( $page_path, '/' ) );
-        $parts = array_map( 'esc_sql', $parts );
+        $parts = esc_sql( $parts );
         $parts = array_map( 'sanitize_title_for_query', $parts );
 
         $in_string = "'". implode( "','", $parts ) . "'";
-        $post_type_sql = $post_type;
-        $wpdb->escape_by_ref( $post_type_sql );
+        $post_type_sql = esc_sql( $post_type );
         $pages = $wpdb->get_results( "SELECT ID, post_name, post_parent, post_type FROM $wpdb->posts WHERE post_name IN ($in_string) AND (post_type = '$post_type_sql' OR post_type = 'attachment')", OBJECT_K );