Make WordPress Core


Ignore:
Timestamp:
04/20/2015 12:31:43 PM (9 years ago)
Author:
pento
Message:

Clean up some edge cases in sanitize_sql_orderby(). Merge of [32164] to the 4.0 branch.

Props vortfu, dd32.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/4.0/src/wp-includes/formatting.php

    r30450 r32189  
    13061306
    13071307/**
    1308  * Ensures a string is a valid SQL order by clause.
    1309  *
    1310  * Accepts one or more columns, with or without ASC/DESC, and also accepts
    1311  * RAND().
     1308 * Ensures a string is a valid SQL 'order by' clause.
     1309 *
     1310 * Accepts one or more columns, with or without a sort order (ASC / DESC).
     1311 * e.g. 'column_1', 'column_1, column_2', 'column_1 ASC, column_2 DESC' etc.
     1312 *
     1313 * Also accepts 'RAND()'.
    13121314 *
    13131315 * @since 2.5.1
    13141316 *
    1315  * @param string $orderby Order by string to be checked.
    1316  * @return string|bool Returns the order by clause if it is a match, false otherwise.
    1317  */
    1318 function sanitize_sql_orderby( $orderby ){
    1319     preg_match('/^\s*([a-z0-9_]+(\s+(ASC|DESC))?(\s*,\s*|\s*$))+|^\s*RAND\(\s*\)\s*$/i', $orderby, $obmatches);
    1320     if ( !$obmatches )
    1321         return false;
    1322     return $orderby;
     1317 * @param string $orderby Order by clause to be validated.
     1318 * @return string|bool Returns $orderby if valid, false otherwise.
     1319 */
     1320function sanitize_sql_orderby( $orderby ) {
     1321    if ( preg_match( '/^\s*(([a-z0-9_]+|`[a-z0-9_]+`)(\s+(ASC|DESC))?\s*(,\s*(?=[a-z0-9_`])|$))+$/i', $orderby ) || preg_match( '/^\s*RAND\(\s*\)\s*$/i', $orderby ) ) {
     1322        return $orderby;
     1323    }
     1324    return false;
    13231325}
    13241326
Note: See TracChangeset for help on using the changeset viewer.