Make WordPress Core

Opened 14 years ago

Closed 14 years ago

#14672 closed defect (bug) (fixed)

DB: ::constructor() sets charset, ::db_connect() does not

Reported by: hakre's profile hakre Owned by:
Milestone: 3.1 Priority: normal
Severity: normal Version:
Component: Database Keywords: has-patch
Focuses: Cc:


I just ran over duplicated code in wpdb regarding making use of the mysql_connect function while looking into #14654. That smell lead me to the reconnigtion of an inconsistency between the default contructor of the class and the (undocumented) db_connect() function:

the constructor does make use of the blogs charset setting while connecting to the database, while db_connect() does not contain anything like that. This leaves db_connect() open to charset based sql injections. Basically [10597] as a fix for #5455 is missing for db access that is relying on db_connect() (Multisite?).

Attachments (2)

14672.diff (8.6 KB) - added by ryan 14 years ago.
14672.2.diff (8.2 KB) - added by ryan 14 years ago.

Download all attachments as: .zip

Change History (9)

14 years ago

#1 @ryan
14 years ago

Patch cleans things up a bit and merges init_charset() and set_charset() from hyperdb. I'd prefer to remove WP_USE_MULTIPLE_DB and encourage using hyperdb for such setups.

#2 @ryan
14 years ago

  • Milestone changed from Awaiting Review to 3.1

14 years ago


#3 @hakre
14 years ago

+1 for removing multiple server support from the base class because professional DB setups do hide that away from the httpnodes these days - that's where PHP gets executed. It's not done inside PHP any longer.

For those who who are hyperlovers of hyperdb can just use a replacement hyperclass provided by a single file or plugin. I think it is already a plugin, isn't it?

#5 @peaceablewhale
14 years ago

  • Keywords has-patch added

#6 @wpmuguru
14 years ago

I had WP_USE_MULTIPLE_DB on my list. +1

#7 @ryan
14 years ago

  • Resolution set to fixed
  • Status changed from new to closed

(In [15537]) Remove WP_USE_MULTIPLE_DB. Introduce init_charset() and set_charset(). fixes #14672

Note: See TracTickets for help on using tickets.