Ticket #4994: 4994.patch

bp-blogs-classes.php

@@ -122 +122 @@
                         $blog_ids[] = $blog->blog_id;
                 }
 
-                $blog_ids = $wpdb->escape( join( ',', (array) $blog_ids ) );
                 $paged_blogs = BP_Blogs_Blog::get_blog_extras( $paged_blogs, $blog_ids, $type );
 
                 return array( 'blogs' => $paged_blogs, 'total' => $total_blogs );
@@ -211 +210 @@
         function search_blogs( $filter, $limit = null, $page = null ) {
                 global $wpdb, $bp;
 
-                $filter = like_escape( $wpdb->escape( $filter ) );
+                $filter = esc_sql( like_escape( $filter ) );
 
                 if ( !bp_current_user_can( 'bp_moderate' ) )
                         $hidden_sql = "AND wb.public = 1";
@@ -241 +240 @@
         function get_by_letter( $letter, $limit = null, $page = null ) {
                 global $bp, $wpdb;
 
-                $letter = like_escape( $wpdb->escape( $letter ) );
+                $letter = esc_sql( like_escape( $letter ) );
 
                 if ( !bp_current_user_can( 'bp_moderate' ) )
                         $hidden_sql = "AND wb.public = 1";
@@ -294 +293 @@
                         }
                 }
 
+                $blog_ids = esc_sql( implode( ',', wp_parse_id_list( $blog_ids ) ) );
+
                 /* Fetch the blog description for each blog (as it may be empty we can't fetch it in the main query). */
                 $blog_descs = $wpdb->get_results( "SELECT blog_id, meta_value as description FROM {$bp->blogs->table_name_blogmeta} WHERE meta_key = 'description' AND blog_id IN ( {$blog_ids} )" );