Changeset 9116 for trunk/wp-admin/includes/post.php

Timestamp:

10/10/2008 09:40:30 AM (18 years ago)

Author:

azaozz

Message:

Fix escaping of post meta, props DD32, fixes #7768

File:

• trunk/wp-admin/includes/post.php (modified) (2 diffs)

trunk/wp-admin/includes/post.php

@@ -500 +500 @@
         $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
 
-        $metakeyselect = $wpdb->escape( stripslashes( trim( $_POST['metakeyselect'] ) ) );
-        $metakeyinput = $wpdb->escape( stripslashes( trim( $_POST['metakeyinput'] ) ) );
-        $metavalue = maybe_serialize( stripslashes( (trim( $_POST['metavalue'] ) ) ));
-        $metavalue = $wpdb->escape( $metavalue );
+        $metakeyselect = stripslashes( trim( $_POST['metakeyselect'] ) );
+        $metakeyinput = stripslashes( trim( $_POST['metakeyinput'] ) );
+        $metavalue = maybe_serialize( stripslashes( trim( $_POST['metavalue'] ) ) );
 
         if ( ('0' === $metavalue || !empty ( $metavalue ) ) && ((('#NONE#' != $metakeyselect) && !empty ( $metakeyselect) ) || !empty ( $metakeyinput) ) ) {
@@ -520 +519 @@
                 wp_cache_delete($post_ID, 'post_meta');
 
-                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta
-                        (post_id,meta_key,meta_value ) VALUES (%s, %s, %s)",
-                        $post_ID, $metakey, $metavalue) );
+                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value ) VALUES (%s, %s, %s)", $post_ID, $metakey, $metavalue) );
                 return $wpdb->insert_id;
         }