Changeset 5779

Timestamp:

07/05/2007 05:32:46 PM (19 years ago)

Author:

markjaquith

Message:

Automatically quote strings in $wpdb->prepare(). Use vsprintf(). see #4553

File:

• trunk/wp-includes/wp-db.php (modified) (1 diff)

trunk/wp-includes/wp-db.php

@@ -133 +133 @@
                 $args = func_get_args();
                 $query = array_shift($args);
+                $query = str_replace("'%s'", '%s', $query); // in case someone mistakenly already quoted it
+                $query = str_replace('%s', "'%s'", $query); // quote the strings
                 array_walk($args, array(&$this, 'escape_by_ref'));
-                return @call_user_func_array('sprintf', array_merge(array($query), $args));
+                return @vsprintf($query, $args);
         }