Make WordPress Core


Ignore:
Timestamp:
09/19/2017 02:47:46 PM (7 years ago)
Author:
aaroncampbell
Message:

Database: Hardening for wpdb::prepare()

Previously if you passed an array of values for placeholders, additional values could be passed as well. Now additional values will be ignored.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/wp-db.php

    r41241 r41470  
    12371237        $args = func_get_args();
    12381238        array_shift( $args );
     1239
    12391240        // If args were passed as an array (as in vsprintf), move them up
    1240         if ( isset( $args[0] ) && is_array($args[0]) )
     1241        if ( is_array( $args[0] ) && count( $args ) == 1 ) {
    12411242            $args = $args[0];
     1243        }
     1244
     1245        foreach ( $args as $arg ) {
     1246            if ( ! is_scalar( $arg ) ) {
     1247                _doing_it_wrong( 'wpdb::prepare', sprintf( __( 'Unsupported value type (%s).' ), gettype( $arg ) ), '4.8.2' );
     1248            }
     1249        }
     1250
    12421251        $query = str_replace( "'%s'", '%s', $query ); // in case someone mistakenly already singlequoted it
    12431252        $query = str_replace( '"%s"', '%s', $query ); // doublequote unquoting
Note: See TracChangeset for help on using the changeset viewer.