Changeset 2699 for trunk/wp-admin/import-greymatter.php

Timestamp:

07/05/2005 08:47:22 PM (21 years ago)

Author:

ryan

Message:

Use wpdb->escape instead of addslashes to prepare DB bound data.

File:

• trunk/wp-admin/import-greymatter.php (modified) (7 diffs)

trunk/wp-admin/import-greymatter.php

@@ -91 +91 @@
                 $user_joindate=substr($s,6,4)."-".substr($s,0,2)."-".substr($s,3,2)." 00:00:00";
 
-                $user_login=addslashes($userdata[0]);
-                $pass1=addslashes($userdata[1]);
-                $user_nickname=addslashes($userdata[0]);
-                $user_email=addslashes($userdata[2]);
-                $user_url=addslashes($userdata[3]);
-                $user_joindate=addslashes($user_joindate);
+                $user_login=$wpdb->escape($userdata[0]);
+                $pass1=$wpdb->escape($userdata[1]);
+                $user_nickname=$wpdb->escape($userdata[0]);
+                $user_email=$wpdb->escape($userdata[2]);
+                $user_url=$wpdb->escape($userdata[3]);
+                $user_joindate=$wpdb->escape($user_joindate);
 
                 $loginthere = $wpdb->get_var("SELECT user_login FROM $wpdb->users WHERE user_login = '$user_login'");
@@ -148 +148 @@
                         $postmorecontent=gm2autobr($entry[3]);
 
-                        $post_author=trim(addslashes($postinfo[1]));
+                        $post_author=trim($wpdb->escape($postinfo[1]));
                         // we'll check the author is registered, or if it's a deleted author
                         $sql = "SELECT * FROM $wpdb->users WHERE user_login = '$post_author'";
@@ -154 +154 @@
                         if (! $result) { // if deleted from GM, we register the author as a level 0 user in wp
                                 $user_joindate="1979-06-06 00:41:00";
-                                $user_login=addslashes($post_author);
-                                $pass1=addslashes("password");
-                                $user_nickname=addslashes($post_author);
-                                $user_email=addslashes("user@deleted.com");
-                                $user_url=addslashes("");
-                                $user_joindate=addslashes($user_joindate);
+                                $user_login=$wpdb->escape($post_author);
+                                $pass1=$wpdb->escape("password");
+                                $user_nickname=$wpdb->escape($post_author);
+                                $user_email=$wpdb->escape("user@deleted.com");
+                                $user_url=$wpdb->escape("");
+                                $user_joindate=$wpdb->escape($user_joindate);
                                 $query = "INSERT INTO $wpdb->users (user_login,user_pass,user_email,user_url,user_registered,user_level) VALUES ('$user_login','$pass1','$user_email','$user_url','$user_joindate','0')";
                                 $result = $wpdb->query($query);
@@ -172 +172 @@
 
                         $post_title=gm2autobr($postinfo[2]);
-                        $post_title=addslashes($post_title);
+                        $post_title=$wpdb->escape($post_title);
 
                         $postyear=$postinfo[6];
@@ -189 +189 @@
                         if (strlen($postmorecontent)>3)
                                 $post_content .= "<!--more--><br /><br />".$postmorecontent;
-                        $post_content=addslashes($post_content);
+                        $post_content=$wpdb->escape($post_content);
 
                         $post_karma=$postinfo[12];
@@ -223 +223 @@
                                         $commentinfo=explode("|",$entry[$j]);
                                         $comment_post_ID=$post_ID;
-                                        $comment_author=addslashes($commentinfo[0]);
-                                        $comment_author_email=addslashes($commentinfo[2]);
-                                        $comment_author_url=addslashes($commentinfo[3]);
-                                        $comment_author_IP=addslashes($commentinfo[1]);
+                                        $comment_author=$wpdb->escape($commentinfo[0]);
+                                        $comment_author_email=$wpdb->escape($commentinfo[2]);
+                                        $comment_author_url=$wpdb->escape($commentinfo[3]);
+                                        $comment_author_IP=$wpdb->escape($commentinfo[1]);
 
                                         $commentyear=$commentinfo[7];
@@ -238 +238 @@
                                         $comment_date="$commentyear-$commentmonth-$commentday $commenthour:$commentminute:$commentsecond";
 
-                                        $comment_content=addslashes($commentinfo[12]);
+                                        $comment_content=$wpdb->escape($commentinfo[12]);
 
                                         $sql3 = "INSERT INTO $wpdb->comments (comment_post_ID,comment_author,comment_author_email,comment_author_url,comment_author_IP,comment_date,comment_content) VALUES ('$comment_post_ID','$comment_author','$comment_author_email','$comment_author_url','$comment_author_IP','$comment_date','$comment_content')";