Metavalues not properly escaped before being inserted into the database

[joaocosta]

Certain plugins use meta fields for specific purposes. When a post containing these meta fields is saved, their content is not being escaped and if the field contains special SQL characters, the result is a MySQL error.

The place where this error occurs is in wp-includes/functions.php, line 433.

I patched mine by adding a call to $wpdb->escape before the metavalue is inserted in the database.

[johnbillion]

Worksforme. This was fixed somewhere between 2.0.4 and 2.1, and now the values are escaped before being inserted into the database (add_post_meta in wp-includes/functions.php).