WordPress.org

Make WordPress Core


Ignore:
Timestamp:
10/31/2017 12:33:25 PM (23 months ago)
Author:
pento
Message:

Database: Restore numbered placeholders in wpdb::prepare().

[41496] removed support for numbered placeholders in queries send through wpdb::prepare(), which, despite being undocumented, were quite commonly used.

This change restores support for numbered placeholders (as well as a subset of placeholder formatting), while also adding extra checks to ensure the correct number of arguments are being passed to wpdb::prepare(), given the number of placeholders.

Merges [41662], [42056] to the 4.7 branch.
See #41925.

Location:
branches/4.7
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.7

  • branches/4.7/src/wp-includes/post.php

    r39629 r42058  
    42424242    $page_path = str_replace('%20', ' ', $page_path);
    42434243    $parts = explode( '/', trim( $page_path, '/' ) );
    4244     $parts = esc_sql( $parts );
    42454244    $parts = array_map( 'sanitize_title_for_query', $parts );
    4246 
    4247     $in_string = "'" . implode( "','", $parts ) . "'";
     4245    $escaped_parts = esc_sql( $parts );
     4246
     4247    $in_string = "'" . implode( "','", $escaped_parts ) . "'";
    42484248
    42494249    if ( is_array( $post_type ) ) {
Note: See TracChangeset for help on using the changeset viewer.