[wp-trac] [WordPress Trac] #65055: _pad_term_counts() uses string-concatenated SQL without prepared statement

[WordPress Trac]

#65055: _pad_term_counts() uses string-concatenated SQL without prepared statement
--------------------------+-------------------------------------
 Reporter:  rajeshcp      |      Owner:  rajeshcp
     Type:  defect (bug)  |     Status:  assigned
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Database      |    Version:  trunk
 Severity:  major         |   Keywords:  has-patch needs-testing
  Focuses:                |
--------------------------+-------------------------------------
 $object_types values are not individually escaped via $wpdb->prepare().
 They use esc_sql() only at the
   get_taxonomy() call, but imploded directly into the query string. The
 array keys are integer IDs but are not cast.
   This should use prepare() with placeholders.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/65055>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform