[wp-trac] [WordPress Trac] #12402: make addslashes_gpc() use addslashes() fix to use real_escape, rather than addslashes

[WordPress Trac]

#12402: make addslashes_gpc() use addslashes() fix to use real_escape, rather than
addslashes
-------------------------------+--------------------------------------------
 Reporter:  Denis-de-Bernardy  |       Owner:  ryan                   
     Type:  defect (bug)       |      Status:  new                    
 Priority:  normal             |   Milestone:  3.0                    
Component:  Security           |     Version:  3.0                    
 Severity:  normal             |    Keywords:  has-patch needs-testing
-------------------------------+--------------------------------------------

Comment(by Denis-de-Bernardy):

 err... I might be reading this wrong, but, in trunk at the time of writing
 this:

 {{{
 function add_magic_quotes( $array ) {
         foreach ( (array) $array as $k => $v ) {
                 if ( is_array( $v ) ) {
                         $array[$k] = add_magic_quotes( $v );
                 } else {
                         $array[$k] = addslashes( $v );
                 }
         }
         return $array;
 }


         function escape( $data ) {
                 if ( is_array( $data ) ) {
                         foreach ( (array) $data as $k => $v ) {
                                 if ( is_array( $v ) )
                                         $data[$k] = $this->escape( $v );
                                 else
                                         $data[$k] = $this->_weak_escape(
 $v );
                         }
                 } else {
                         $data = $this->_weak_escape( $data );
                 }

                 return $data;
         }
 }}}

 both are poorly written versions of the same thing, i.e.:

 {{{
 function addslashes_deep($data) {
     return is_array($data) ? array_map('addslashes_deep', $data) :
 addslashes($data);
 }
 }}}

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/12402#comment:5>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software