DB: ::constructor() sets charset, ::db_connect() does not

[hakre]

I just ran over duplicated code in wpdb regarding making use of the mysql_connect function while looking into #14654. That smell lead me to the reconnigtion of an inconsistency between the default contructor of the class and the (undocumented) db_connect() function:

the constructor does make use of the blogs charset setting while connecting to the database, while db_connect() does not contain anything like that. This leaves db_connect() open to charset based sql injections. Basically [10597] as a fix for #5455 is missing for db access that is relying on db_connect() (Multisite?).

[ryan]

Patch cleans things up a bit and merges init_charset() and set_charset() from hyperdb. I'd prefer to remove WP_USE_MULTIPLE_DB and encourage using hyperdb for such setups.

[ryan]

Drop WP_USE_MULTIPLE_DB

[hakre]

+1 for removing multiple server support from the base class because professional DB setups do hide that away from the httpnodes these days - that's where PHP gets executed. It's not done inside PHP any longer.

For those who who are hyperlovers of hyperdb can just use a replacement hyperclass provided by a single file or plugin. I think it is already a plugin, isn't it?

[ryan]

​http://hakre.wordpress.com/2010/08/24/fun-to-play-wordpress-3-0-multisite-sql-injection-vulnerability-regression/

[wpmuguru]

I had WP_USE_MULTIPLE_DB on my list. +1

[ryan]

(In [15537]) Remove WP_USE_MULTIPLE_DB. Introduce init_charset() and set_charset(). fixes #14672