WordPress.org
Get WordPress

Make WordPress Core

Changes between Initial Version and Version 1 of Ticket #12416


Ignore:
Timestamp:
02/27/2010 10:05:47 PM (15 years ago)
Author:
Denis-de-Bernardy
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #12416

    • Property Summary changed from *_option() should all expect unslashed data. to *_option(), *_transient() and *_meta() functions should all expect unslashed data.

  • Ticket #12416 – Description

    initial v1  
    55It's totally irresponsible to expect plugin authors to escape whatever they send into get_option(). As things stand:
    66
    7  - get_option(), delete_option(), get_site_option() both assume it's slashed
     7 - get_option(), delete_option(), get_site_option() assume it's slashed
    88 - add_option(), update_option(), add_site_option() seem to assume it's unslashed, as does __get_option()
    99 - *_transient() seem to expect unslashed input.
    … …  
    1111 - update_site_option() is equallty special: it needs slashed input if the option is not loaded already, and unslashed input if it is
    1212
    13 the list goes on, and on... these inconsistencies, which come on top of the *_meta() functions, are totally nuts and insecure.
     13the list goes on, and on... these inconsistencies, which come on top of the *_meta() functions, which expect slashed data.
    1414
    15 especially considering calls in WP such as:
     15it's totally nuts, insecure, and irresponsible. especially considering calls in WP such as:
    1616
    1717 - get_option("{$size}_crop");
    … …  
    3131        // ...
    3232}}}
     33
     34we're asking for trouble here...