Changeset 24716

Timestamp:

07/16/2013 02:38:54 PM (11 years ago)

Author:

nacin

Message:

Use wp_slash() instead of the DB layer in XML-RPC. see #21767.

File:

• trunk/wp-includes/class-wp-xmlrpc-server.php (modified) (4 diffs)

trunk/wp-includes/class-wp-xmlrpc-server.php

@@ -212 +212 @@
 
     /**
-     * Sanitize string or array of strings for database.
+     * Escape string or array of strings for database.
      *
      * @since 1.5.2
      *
-     * @param string|array $array Sanitize single string or array of strings.
-     * @return string|array Type matches $array and sanitized for the database.
-     */
-    function escape(&$array) {
-        global $wpdb;
-
-        if (!is_array($array)) {
-            return($wpdb->escape($array));
-        } else {
-            foreach ( (array) $array as $k => $v ) {
-                if ( is_array($v) ) {
-                    $this->escape($array[$k]);
-                } else if ( is_object($v) ) {
-                    //skip
-                } else {
-                    $array[$k] = $wpdb->escape($v);
-                }
-            }
+     * @param string|array $data Escape single string or array of strings.
+     * @return string|array Type matches $data and sanitized for the database.
+     */
+    function escape( &$data ) {
+        if ( ! is_array( $data ) )
+            return wp_slash( $data );
+
+        foreach ( $data as &$v ) {
+            if ( ! is_object( $v ) )
+                $v = wp_slash( $v );
         }
     }
@@ -2986 +2978 @@
 
         if ( $logged_in ) {
-            $comment['comment_author'] = $wpdb->escape( $user->display_name );
-            $comment['comment_author_email'] = $wpdb->escape( $user->user_email );
-            $comment['comment_author_url'] = $wpdb->escape( $user->user_url );
+            $comment['comment_author'] = $this->escape( $user->display_name );
+            $comment['comment_author_email'] = $this->escape( $user->user_email );
+            $comment['comment_author_url'] = $this->escape( $user->user_url );
             $comment['user_ID'] = $user->ID;
         } else {
@@ -4924 +4916 @@
 
         $blog_ID     = (int) $args[0];
-        $username  = $wpdb->escape($args[1]);
-        $password   = $wpdb->escape($args[2]);
+        $username  = $this->escape($args[1]);
+        $password   = $this->escape($args[2]);
         $data        = $args[3];
 
@@ -5452 +5444 @@
 
         $context = '[…] ' . esc_html( $excerpt ) . ' […]';
-        $pagelinkedfrom = $wpdb->escape( $pagelinkedfrom );
+        $pagelinkedfrom = $this->escape( $pagelinkedfrom );
 
         $comment_post_ID = (int) $post_ID;