wrong search string escaping/slashes

[nbachiyski]

Search for ' and
\' will appear in the input field.
" ->
\
& -> &

[nbachiyski]

In classes.php $qs? is added slashes again, despite the fact that is has passed through add_magic_quotes function before.

For database use the search string needs slashes, but when writing it to the templates is does not. I have added striptags calls in the template pages.

[ryan]

Even if we get rid of the extra addslashes, searches will still show a single set of slashes. \' instead of
\'. We can either add stripslashes to Kubrick's templates, or not addslashes by default when processing GPC in the blog header. Not adding slashes by default and instead relying on those functions that query the DB to addslashes as appropriate seems to be the cleanest way to do this, but that should wait until after 1.5.1.

[nbachiyski]

I also prefer not adding slashes by default and escape strings only for DB operations.

Now, as I understand, the choice is between leaving the bug in 1.5.1 or applying the dirty "stripslashes in Kubrick" hack before reorganizing all that code. My choice was the second.

Which is the less evil of the two?

[mdawaffe]

give it an template tag

[mdawaffe]

914.diff

1. create wp_search_query() template tag which echos the query.

[ryan]

Whatcha think, wp_search_query() or the_search_query()? Or maybe just the_search()? These are important questions. :-)

[markjaquith]

the_search_query() or search_query()

the wp_blah() ones usually accept a query string with a bunch of parameters.

[mdawaffe]

I like the_search_query(), but search_query() is a much better band name.

[ryan]

(In [4171]) the_search_query() from mdawaffe. fixes #914

[thenlich]

Found the same problem in 2.0.7
' (single quote) becomes


\' with magic_quotes_gpc on (7 backslashes, then single quote),
or
\' (magic_quotes_gpc=off) (3 backslashes, quote)

[ryan]

With one of the default themes? If you're having problems with a third party theme, that theme needs to be changed.

[thenlich]

Yes, with theme: WordPress Default 1.6

[markjaquith]

thenlich, please upgrade to the most recent version of the theme (the one in 2.0.7). Re-open with a URL demonstrating the issue, if it persists.

[foolswisdom]

Changing back to previous fixed state.