add_slashes() does not escape all database input correctly

[auroraeosrose]

wp-db.php - the database class - the escape function uses add_slashes to try to escape data for sql use/insertion

This will fail under several methods

1. Mysql in ansi mode
2. NULL, \x00, \n, \r, \, " and \x1a characters not escaped
3. Mysql 4.1 with a different character set or earlier versions when mysql is run in a different character set

mysql_escape_string() has been around since 4.0.3
since wordpress requires 4.1 it shouldn't be a problem

[matt]

(In [2684]) Better escaping from class, fixes #1394

[hakre]

The changes have been removed which means a downgrade to addslahes for many installations again. See #11819.

[hakre]

Changes were removed in [2737].

[Denis-de-Bernardy]

a check was added that prompts for mysql_real_escape()

[hakre]

Related: #9189