Wrong mysql_set_charset() params order in wp-db.php

[gubnota]

Potential SQL injection vulnerability found in wp-includes/wp-db.php where mysql_set_charset() execution in class wpdb->set_charset() has wrong param order.
Whereas it should be:

mysql_set_charset( $dbh, $charset );

It is:

mysql_set_charset( $charset, $dbh );

In some cases it causes MySQL to use default latin1 encoding.

[dd32]

as per the ​PHP Docs, the order is correct:

bool mysql_set_charset ( string $charset [, resource $link_identifier = NULL ] )

[SergeyBiryukov]

Also, you might have seen this when creating the ticket:

Do not report potential security vulnerabilities here. Read the ​Security FAQ and email us at security@….