Changeset 4676

Timestamp:

01/05/2007 05:45:46 AM (18 years ago)

Author:

markjaquith

Message:

Delay Trackback data escaping until after mb_convert_encoding(). Props to Stefan Esser.

File:

• trunk/wp-trackback.php (modified) (2 diffs)

trunk/wp-trackback.php

@@ -31 +31 @@
 }
 
-$tb_url    = $_POST['url'];
-$title     = $_POST['title'];
-$excerpt   = $_POST['excerpt'];
-$blog_name = $_POST['blog_name'];
-$charset   = $_POST['charset'];
+$tb_url  = $_POST['url'];
+$charset = $_POST['charset'];
+
+// These three are stripslashed here so that they can be properly escaped after mb_convert_encoding()
+$title     = stripslashes($_POST['title']);
+$excerpt   = stripslashes($_POST['excerpt']);
+$blog_name = stripslashes($_POST['blog_name']);
 
 if ($charset)
@@ -47 +49 @@
     $blog_name = mb_convert_encoding($blog_name, get_option('blog_charset'), $charset);
 }
+
+// Now that mb_convert_encoding() has been given a swing, we need to escape these three
+$title     = $wpdb->escape($title);
+$excerpt   = $wpdb->escape($excerpt);
+$blog_name = $wpdb->escape($blog_name);
 
 if ( is_single() || is_page() )