<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><style type="text/css"><!--
#msg dl { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre, #msg p { overflow: auto; background: #ffc; border: 1px #fc0 solid; padding: 6px; }
#msg ul { overflow: auto; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<title>[11978] trunk/wp-includes: esc_sql() for wp-includes</title>
</head>
<body>
<div id="msg">
<dl>
<dt>Revision</dt> <dd><a href="http://trac.wordpress.org/changeset/11978">11978</a></dd>
<dt>Author</dt> <dd>markjaquith</dd>
<dt>Date</dt> <dd>2009-09-27 05:33:56 +0000 (Sun, 27 Sep 2009)</dd>
</dl>
<h3>Log Message</h3>
<pre>esc_sql() for wp-includes</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkwpincludescommentphp">trunk/wp-includes/comment.php</a></li>
<li><a href="#trunkwpincludesformattingphp">trunk/wp-includes/formatting.php</a></li>
<li><a href="#trunkwpincludesfunctionsphp">trunk/wp-includes/functions.php</a></li>
<li><a href="#trunkwpincludespostphp">trunk/wp-includes/post.php</a></li>
<li><a href="#trunkwpincludesqueryphp">trunk/wp-includes/query.php</a></li>
<li><a href="#trunkwpincludesregistrationphp">trunk/wp-includes/registration.php</a></li>
<li><a href="#trunkwpincludesuserphp">trunk/wp-includes/user.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkwpincludescommentphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-includes/comment.php (11977 => 11978)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-includes/comment.php 2009-09-26 22:52:42 UTC (rev 11977)
+++ trunk/wp-includes/comment.php 2009-09-27 05:33:56 UTC (rev 11978)
</span><span class="lines">@@ -1229,7 +1229,7 @@
</span><span class="cx"> $comment = get_comment($commentarr['comment_ID'], ARRAY_A);
</span><span class="cx">
</span><span class="cx"> // Escape data pulled from DB.
</span><del>- $comment = $wpdb->escape($comment);
</del><ins>+ $comment = esc_sql($comment);
</ins><span class="cx">
</span><span class="cx"> $old_status = $comment['comment_approved'];
</span><span class="cx">
</span></span></pre></div>
<a id="trunkwpincludesformattingphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-includes/formatting.php (11977 => 11978)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-includes/formatting.php 2009-09-26 22:52:42 UTC (rev 11977)
+++ trunk/wp-includes/formatting.php 2009-09-27 05:33:56 UTC (rev 11978)
</span><span class="lines">@@ -1110,7 +1110,7 @@
</span><span class="cx"> $gpc = stripslashes($gpc);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- return $wpdb->escape($gpc);
</del><ins>+ return esc_sql($gpc);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> /**
</span><span class="lines">@@ -1280,7 +1280,7 @@
</span><span class="cx"> // This is a pre save filter, so text is already escaped.
</span><span class="cx"> $text = stripslashes($text);
</span><span class="cx"> $text = preg_replace_callback('|<a (.+?)>|i', 'wp_rel_nofollow_callback', $text);
</span><del>- $text = $wpdb->escape($text);
</del><ins>+ $text = esc_sql($text);
</ins><span class="cx"> return $text;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkwpincludesfunctionsphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-includes/functions.php (11977 => 11978)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-includes/functions.php 2009-09-26 22:52:42 UTC (rev 11977)
+++ trunk/wp-includes/functions.php 2009-09-27 05:33:56 UTC (rev 11978)
</span><span class="lines">@@ -497,7 +497,7 @@
</span><span class="cx">
</span><span class="cx"> wp_protect_special_option( $option_name );
</span><span class="cx">
</span><del>- $safe_option_name = $wpdb->escape( $option_name );
</del><ins>+ $safe_option_name = esc_sql( $option_name );
</ins><span class="cx"> $newvalue = sanitize_option( $option_name, $newvalue );
</span><span class="cx">
</span><span class="cx"> $oldvalue = get_option( $safe_option_name );
</span><span class="lines">@@ -571,7 +571,7 @@
</span><span class="cx"> global $wpdb;
</span><span class="cx">
</span><span class="cx"> wp_protect_special_option( $name );
</span><del>- $safe_name = $wpdb->escape( $name );
</del><ins>+ $safe_name = esc_sql( $name );
</ins><span class="cx"> $value = sanitize_option( $name, $value );
</span><span class="cx">
</span><span class="cx"> // Make sure the option doesn't already exist. We can check the 'notoptions' cache before we ask for a db query
</span><span class="lines">@@ -654,7 +654,7 @@
</span><span class="cx"> if ( $_wp_using_ext_object_cache ) {
</span><span class="cx"> return wp_cache_delete($transient, 'transient');
</span><span class="cx"> } else {
</span><del>- $transient = '_transient_' . $wpdb->escape($transient);
</del><ins>+ $transient = '_transient_' . esc_sql($transient);
</ins><span class="cx"> return delete_option($transient);
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -682,11 +682,11 @@
</span><span class="cx"> if ( $_wp_using_ext_object_cache ) {
</span><span class="cx"> $value = wp_cache_get($transient, 'transient');
</span><span class="cx"> } else {
</span><del>- $transient_option = '_transient_' . $wpdb->escape($transient);
</del><ins>+ $transient_option = '_transient_' . esc_sql($transient);
</ins><span class="cx"> // If option is not in alloptions, it is not autoloaded and thus has a timeout
</span><span class="cx"> $alloptions = wp_load_alloptions();
</span><span class="cx"> if ( !isset( $alloptions[$transient_option] ) ) {
</span><del>- $transient_timeout = '_transient_timeout_' . $wpdb->escape($transient);
</del><ins>+ $transient_timeout = '_transient_timeout_' . esc_sql($transient);
</ins><span class="cx"> if ( get_option($transient_timeout) < time() ) {
</span><span class="cx"> delete_option($transient_option);
</span><span class="cx"> delete_option($transient_timeout);
</span><span class="lines">@@ -723,7 +723,7 @@
</span><span class="cx"> } else {
</span><span class="cx"> $transient_timeout = '_transient_timeout_' . $transient;
</span><span class="cx"> $transient = '_transient_' . $transient;
</span><del>- $safe_transient = $wpdb->escape($transient);
</del><ins>+ $safe_transient = esc_sql($transient);
</ins><span class="cx"> if ( false === get_option( $safe_transient ) ) {
</span><span class="cx"> $autoload = 'yes';
</span><span class="cx"> if ( 0 != $expiration ) {
</span><span class="lines">@@ -1412,7 +1412,7 @@
</span><span class="cx"> if ( is_array( $v ) ) {
</span><span class="cx"> $array[$k] = add_magic_quotes( $v );
</span><span class="cx"> } else {
</span><del>- $array[$k] = $wpdb->escape( $v );
</del><ins>+ $array[$k] = esc_sql( $v );
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> return $array;
</span></span></pre></div>
<a id="trunkwpincludespostphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-includes/post.php (11977 => 11978)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-includes/post.php 2009-09-26 22:52:42 UTC (rev 11977)
+++ trunk/wp-includes/post.php 2009-09-27 05:33:56 UTC (rev 11978)
</span><span class="lines">@@ -1752,7 +1752,7 @@
</span><span class="cx"> } elseif ( in_array($post_type, $hierarchical_post_types) ) {
</span><span class="cx"> // Page slugs must be unique within their own trees. Pages are in a
</span><span class="cx"> // separate namespace than posts so page slugs are allowed to overlap post slugs.
</span><del>- $check_sql = "SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_type IN ( '" . implode("', '", $wpdb->escape($hierarchical_post_types)) . "' ) AND ID != %d AND post_parent = %d LIMIT 1";
</del><ins>+ $check_sql = "SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_type IN ( '" . implode("', '", esc_sql($hierarchical_post_types)) . "' ) AND ID != %d AND post_parent = %d LIMIT 1";
</ins><span class="cx"> $post_name_check = $wpdb->get_var($wpdb->prepare($check_sql, $slug, $post_ID, $post_parent));
</span><span class="cx">
</span><span class="cx"> if ( $post_name_check || in_array($slug, $wp_rewrite->feeds) ) {
</span></span></pre></div>
<a id="trunkwpincludesqueryphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-includes/query.php (11977 => 11978)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-includes/query.php 2009-09-26 22:52:42 UTC (rev 11977)
+++ trunk/wp-includes/query.php 2009-09-27 05:33:56 UTC (rev 11978)
</span><span class="lines">@@ -1756,7 +1756,7 @@
</span><span class="cx"> $search .= "{$searchand}(($wpdb->posts.post_title LIKE '{$n}{$term}{$n}') OR ($wpdb->posts.post_content LIKE '{$n}{$term}{$n}'))";
</span><span class="cx"> $searchand = ' AND ';
</span><span class="cx"> }
</span><del>- $term = $wpdb->escape($q['s']);
</del><ins>+ $term = esc_sql($q['s']);
</ins><span class="cx"> if (empty($q['sentence']) && count($q['search_terms']) > 1 && $q['search_terms'][0] != $q['s'] )
</span><span class="cx"> $search .= " OR ($wpdb->posts.post_title LIKE '{$n}{$term}{$n}') OR ($wpdb->posts.post_content LIKE '{$n}{$term}{$n}')";
</span><span class="cx">
</span></span></pre></div>
<a id="trunkwpincludesregistrationphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-includes/registration.php (11977 => 11978)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-includes/registration.php 2009-09-26 22:52:42 UTC (rev 11977)
+++ trunk/wp-includes/registration.php 2009-09-27 05:33:56 UTC (rev 11978)
</span><span class="lines">@@ -293,8 +293,8 @@
</span><span class="cx"> function wp_create_user($username, $password, $email = '') {
</span><span class="cx"> global $wpdb;
</span><span class="cx">
</span><del>- $user_login = $wpdb->escape($username);
- $user_email = $wpdb->escape($email);
</del><ins>+ $user_login = esc_sql( $username );
+ $user_email = esc_sql( $email );
</ins><span class="cx"> $user_pass = $password;
</span><span class="cx">
</span><span class="cx"> $userdata = compact('user_login', 'user_email', 'user_pass');
</span></span></pre></div>
<a id="trunkwpincludesuserphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-includes/user.php (11977 => 11978)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-includes/user.php 2009-09-26 22:52:42 UTC (rev 11977)
+++ trunk/wp-includes/user.php 2009-09-27 05:33:56 UTC (rev 11978)
</span><span class="lines">@@ -153,7 +153,7 @@
</span><span class="cx"> function get_profile($field, $user = false) {
</span><span class="cx"> global $wpdb;
</span><span class="cx"> if ( !$user )
</span><del>- $user = $wpdb->escape($_COOKIE[USER_COOKIE]);
</del><ins>+ $user = esc_sql( $_COOKIE[USER_COOKIE] );
</ins><span class="cx"> return $wpdb->get_var( $wpdb->prepare("SELECT $field FROM $wpdb->users WHERE user_login = %s", $user) );
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>