Changeset 9116

Timestamp:

10/10/2008 09:40:30 AM (18 years ago)

Author:

azaozz

Message:

Fix escaping of post meta, props DD32, fixes #7768

Location:

trunk

Files:

• wp-admin/includes/post.php (modified) (2 diffs)
• wp-includes/post.php (modified) (2 diffs)

trunk/wp-admin/includes/post.php

@@ -500 +500 @@
         $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
 
-        $metakeyselect = $wpdb->escape( stripslashes( trim( $_POST['metakeyselect'] ) ) );
-        $metakeyinput = $wpdb->escape( stripslashes( trim( $_POST['metakeyinput'] ) ) );
-        $metavalue = maybe_serialize( stripslashes( (trim( $_POST['metavalue'] ) ) ));
-        $metavalue = $wpdb->escape( $metavalue );
+        $metakeyselect = stripslashes( trim( $_POST['metakeyselect'] ) );
+        $metakeyinput = stripslashes( trim( $_POST['metakeyinput'] ) );
+        $metavalue = maybe_serialize( stripslashes( trim( $_POST['metavalue'] ) ) );
 
         if ( ('0' === $metavalue || !empty ( $metavalue ) ) && ((('#NONE#' != $metakeyselect) && !empty ( $metakeyselect) ) || !empty ( $metakeyinput) ) ) {
@@ -520 +519 @@
                 wp_cache_delete($post_ID, 'post_meta');
 
-                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta
-                        (post_id,meta_key,meta_value ) VALUES (%s, %s, %s)",
-                        $post_ID, $metakey, $metavalue) );
+                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value ) VALUES (%s, %s, %s)", $post_ID, $metakey, $metavalue) );
                 return $wpdb->insert_id;
         }

trunk/wp-includes/post.php

@@ -520 +520 @@
         // expected_slashed ($meta_key)
         $meta_key = stripslashes($meta_key);
+        $meta_value = stripslashes($meta_value);
 
         if ( $unique && $wpdb->get_var( $wpdb->prepare( "SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = %s AND post_id = %d", $meta_key, $post_id ) ) )
@@ -632 +633 @@
         // expected_slashed ($meta_key)
         $meta_key = stripslashes($meta_key);
+        $meta_value = stripslashes($meta_value);
 
         if ( ! $wpdb->get_var( $wpdb->prepare( "SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = %s AND post_id = %d", $meta_key, $post_id ) ) ) {