No check to validate supplied author in export_wp()

[theMikeD]

One of the options for export_wp() is to filter by author, but that filter option is not validated, it's used verbatum in the wpdb call. This should be validated first no?

[Mte90]

We used this ticket for the Italian core-help meeting for a live coding.
After an analysis we saw that ​https://codex.wordpress.org/Class_Reference/wpdb#Protect_Queries_Against_SQL_Injection_Attacks prepare already sanitize the data.
Also there was other parameters that wasn't sanitized, in any case we wasn't sure if this ticket is still valid but was an easy interesting example about how to do it a patch.
So if the patch is still valid, we done, in other case we got fun and learned more about the process (and this ticket can be closed) :-)

[pento]

The issue isn't that esc_sql() needs to be run on these arguments, it's that wp_export() doesn't check if the author exists before adding it to the query.

I don't think it's really necessary, if they attempt to export an author that doesn't exist (or doesn't have any posts), it'll just return an empty export.