Changeset 31367 for trunk/src/wp-includes/taxonomy.php

Timestamp:

02/08/2015 01:58:51 AM (10 years ago)

Author:

boonebgorges

Message:

Late escaping in get_terms() and WP_Tax_Query.

Props vortfu, dd32.

File:

• trunk/src/wp-includes/taxonomy.php (modified) (2 diffs)

trunk/src/wp-includes/taxonomy.php

@@ -1233 +1233 @@
                      * context is 'db'.
                      */
-                    $term = "'" . sanitize_term_field( $query['field'], $term, 0, $query['taxonomy'], 'db' ) . "'";
+                    $term = "'" . esc_sql( sanitize_term_field( $query['field'], $term, 0, $query['taxonomy'], 'db' ) ) . "'";
                 }
 
@@ -1843 +1843 @@
         if ( is_array( $args['name'] ) ) {
             $name = array_map( 'sanitize_text_field', $args['name'] );
-            $where .= " AND t.name IN ('" . implode( "', '", $name ) . "')";
+            $where .= " AND t.name IN ('" . implode( "', '", array_map( 'esc_sql', $name ) ) . "')";
         } else {
             $name = sanitize_text_field( $args['name'] );