barely sanitized strings are put straight in the database in ms-site.php

[Denis-de-Bernardy]

there arguably are magic quotes, but it's freaky scary to read things such as:

$s = wp_specialchars( trim( $_GET[ 's' ] ) );
...
" AND ( {$wpdb->blogs}.domain LIKE '%{$s}%' OR {$wpdb->blogs}.path LIKE '%{$s}%' ) ";

[ninjaWR]

Should be fixed before 3.0 ships, IMO

[nacin]

#11644. Both fixed at some point.