error in function gallery_shortcode (wp-includes/media.php)

[mhubi]

I found a wrong (escaped) parameter in the variable orderby on line 355 of the file wp-includes/media.php:

$attachments = get_children("post_parent=$id&post_type=attachment&post_mime_type=image&orderby=\"{$orderby}\"");

The parameter will be escaped f.e. so:

post_parent=3&post_type=attachment&post_mime_type=image&orderby=\"menu_order ASC, ID ASC\"

---

My database returns an error on executing this query which is generated and queried in wp-includes/post.php in line 475:

SELECT DISTINCT *
FROM wp_posts
WHERE 1=1 AND post_type = 'attachment' AND wp_posts.post_parent = 3 AND (post_mime_type LIKE 'image/%')
GROUP BY wp_posts.ID ORDER BY \"menu_order ASC, ID ASC\" DESC

The database error is

#1064 - You have an error in your SQL syntax;
check the manual that corresponds to your MySQL server version for the
right syntax to use near '\"menu_order ASC, ID ASC\" DESC' at line 1 

I think the character \ is the problem.

---

I also found a workaround. Replace the line 475 in wp-includes/post.php

	$query .= " GROUP BY $wpdb->posts.ID ORDER BY " . $orderby . ' ' . $order;

with this line

	$query .= " GROUP BY $wpdb->posts.ID ORDER BY " . stripslahes($orderby) . ' ' . $order;

But I think this is a security risk.

Sorry for my bad english ;-)

[mhubi]

Sorry I forgot to write that I am using PHP Version 5.2.0-8+etch10 with MySQL 5.0.45-Debian_1ubuntu3.3

[noledge]

Replying to mhubi:

i have the exact same problem on the same platform (debian 4.0, php 5.2)
i had PHP4 first when i upgraded to WP2.5, which worked fine. after upgrading to PHP5, no gallerys were shown in posts, and the same mysql error was drawn into the logs. the above workaround fixed this for me, though i have no idea why this worked in PHP4.

[ryan]

Duplicate of #6476