Changeset 24716

Timestamp:

07/16/2013 02:38:54 PM (13 years ago)

Author:

nacin

Message:

Use wp_slash() instead of the DB layer in XML-RPC. see #21767.

File:

• trunk/wp-includes/class-wp-xmlrpc-server.php (modified) (4 diffs)

trunk/wp-includes/class-wp-xmlrpc-server.php

@@ -212 +212 @@
 
         /**
-         * Sanitize string or array of strings for database.
+         * Escape string or array of strings for database.
          *
          * @since 1.5.2
          *
-         * @param string|array $array Sanitize single string or array of strings.
-         * @return string|array Type matches $array and sanitized for the database.
-         */
-        function escape(&$array) {
-                global $wpdb;
-
-                if (!is_array($array)) {
-                        return($wpdb->escape($array));
-                } else {
-                        foreach ( (array) $array as $k => $v ) {
-                                if ( is_array($v) ) {
-                                        $this->escape($array[$k]);
-                                } else if ( is_object($v) ) {
-                                        //skip
-                                } else {
-                                        $array[$k] = $wpdb->escape($v);
-                                }
-                        }
+         * @param string|array $data Escape single string or array of strings.
+         * @return string|array Type matches $data and sanitized for the database.
+         */
+        function escape( &$data ) {
+                if ( ! is_array( $data ) )
+                        return wp_slash( $data );
+
+                foreach ( $data as &$v ) {
+                        if ( ! is_object( $v ) )
+                                $v = wp_slash( $v );
                 }
         }
@@ -2986 +2978 @@
 
                 if ( $logged_in ) {
-                        $comment['comment_author'] = $wpdb->escape( $user->display_name );
-                        $comment['comment_author_email'] = $wpdb->escape( $user->user_email );
-                        $comment['comment_author_url'] = $wpdb->escape( $user->user_url );
+                        $comment['comment_author'] = $this->escape( $user->display_name );
+                        $comment['comment_author_email'] = $this->escape( $user->user_email );
+                        $comment['comment_author_url'] = $this->escape( $user->user_url );
                         $comment['user_ID'] = $user->ID;
                 } else {
@@ -4924 +4916 @@
 
                 $blog_ID     = (int) $args[0];
-                $username  = $wpdb->escape($args[1]);
-                $password   = $wpdb->escape($args[2]);
+                $username  = $this->escape($args[1]);
+                $password   = $this->escape($args[2]);
                 $data        = $args[3];
 
@@ -5452 +5444 @@
 
                 $context = '[…] ' . esc_html( $excerpt ) . ' […]';
-                $pagelinkedfrom = $wpdb->escape( $pagelinkedfrom );
+                $pagelinkedfrom = $this->escape( $pagelinkedfrom );
 
                 $comment_post_ID = (int) $post_ID;