Changeset 9259 for trunk/wp-includes/post.php

Timestamp:

10/20/2008 09:55:37 PM (16 years ago)

Author:

ryan

Message:

Use prepare() in wp_insert_attachment(). Props dwc. fixes #7933

File:

• trunk/wp-includes/post.php (modified) (2 diffs)

trunk/wp-includes/post.php

@@ -2282 +2282 @@
 
     // expected_slashed ($post_name)
-    $post_name_check = $wpdb->get_var( $wpdb->prepare( "SELECT post_name FROM $wpdb->posts WHERE post_name = '$post_name' AND post_status = 'inherit' AND ID != %d LIMIT 1", $post_ID));
+    $post_name_check = $wpdb->get_var( $wpdb->prepare( "SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_status = 'inherit' AND ID != %d LIMIT 1", $post_name, $post_ID));
 
     if ($post_name_check) {
@@ -2289 +2289 @@
             $alt_post_name = $post_name . "-$suffix";
             // expected_slashed ($alt_post_name, $post_name)
-            $post_name_check = $wpdb->get_var( $wpdb->prepare( "SELECT post_name FROM $wpdb->posts WHERE post_name = '$alt_post_name' AND post_status = 'inherit' AND ID != %d AND post_parent = %d LIMIT 1", $post_ID, $post_parent));
+            $post_name_check = $wpdb->get_var( $wpdb->prepare( "SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_status = 'inherit' AND ID != %d AND post_parent = %d LIMIT 1", $alt_post_name, $post_ID, $post_parent));
             $suffix++;
         }