Changeset 9116

Timestamp:

10/10/2008 09:40:30 AM (16 years ago)

Author:

azaozz

Message:

Fix escaping of post meta, props DD32, fixes #7768

Location:

trunk

Files:

• wp-admin/includes/post.php (modified) (2 diffs)
• wp-includes/post.php (modified) (2 diffs)

trunk/wp-admin/includes/post.php

@@ -500 +500 @@
     $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
 
-    $metakeyselect = $wpdb->escape( stripslashes( trim( $_POST['metakeyselect'] ) ) );
-    $metakeyinput = $wpdb->escape( stripslashes( trim( $_POST['metakeyinput'] ) ) );
-    $metavalue = maybe_serialize( stripslashes( (trim( $_POST['metavalue'] ) ) ));
-    $metavalue = $wpdb->escape( $metavalue );
+    $metakeyselect = stripslashes( trim( $_POST['metakeyselect'] ) );
+    $metakeyinput = stripslashes( trim( $_POST['metakeyinput'] ) );
+    $metavalue = maybe_serialize( stripslashes( trim( $_POST['metavalue'] ) ) );
 
     if ( ('0' === $metavalue || !empty ( $metavalue ) ) && ((('#NONE#' != $metakeyselect) && !empty ( $metakeyselect) ) || !empty ( $metakeyinput) ) ) {
@@ -520 +519 @@
         wp_cache_delete($post_ID, 'post_meta');
 
-        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta
-            (post_id,meta_key,meta_value ) VALUES (%s, %s, %s)",
-            $post_ID, $metakey, $metavalue) );
+        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value ) VALUES (%s, %s, %s)", $post_ID, $metakey, $metavalue) );
         return $wpdb->insert_id;
     }

trunk/wp-includes/post.php

@@ -520 +520 @@
     // expected_slashed ($meta_key)
     $meta_key = stripslashes($meta_key);
+    $meta_value = stripslashes($meta_value);
 
     if ( $unique && $wpdb->get_var( $wpdb->prepare( "SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = %s AND post_id = %d", $meta_key, $post_id ) ) )
@@ -632 +633 @@
     // expected_slashed ($meta_key)
     $meta_key = stripslashes($meta_key);
+    $meta_value = stripslashes($meta_value);
 
     if ( ! $wpdb->get_var( $wpdb->prepare( "SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = %s AND post_id = %d", $meta_key, $post_id ) ) ) {