Make WordPress Core

Changeset 39953


Ignore:
Timestamp:
01/26/2017 01:35:34 PM (8 years ago)
Author:
ocean90
Message:

Query: Ensure that queries work correctly with post type names with special characters.

Merge of [39952] to the 4.7 branch.

Location:
branches/4.7
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.7

  • branches/4.7/src/wp-includes/class-wp-query.php

    r39052 r39953  
    22562256                $where .= ' AND 1=0 ';
    22572257            } else {
    2258                 $where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", $in_search_post_types ) . "')";
     2258                $where .= " AND {$wpdb->posts}.post_type IN ('" . join( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')";
    22592259            }
    22602260        } elseif ( !empty( $post_type ) && is_array( $post_type ) ) {
    2261             $where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", $post_type) . "')";
     2261            $where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", esc_sql( $post_type ) ) . "')";
    22622262        } elseif ( ! empty( $post_type ) ) {
    2263             $where .= " AND {$wpdb->posts}.post_type = '$post_type'";
     2263            $where .= $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type );
    22642264            $post_type_object = get_post_type_object ( $post_type );
    22652265        } elseif ( $this->is_attachment ) {
Note: See TracChangeset for help on using the changeset viewer.