Changeset 6715

Timestamp:

01/09/2013 04:24:19 PM (14 years ago)

Author:

boonebgorges

Message:

Escape post text before checking for existing replies in bp_forums_reply_exists()

Fixes #4758

Props wpdennis

File:

• branches/1.6/bp-forums/bp-forums-functions.php (modified) (2 diffs)

branches/1.6/bp-forums/bp-forums-functions.php

@@ -353 +353 @@
  */
 function bp_forums_reply_exists( $text = '', $topic_id = 0, $user_id = 0 ) {
+        global $wpdb;
+
         $reply_exists = false;
         
@@ -364 +366 @@
                 
                 // BB_Query's post_text parameter does a MATCH, while we need exact matches
-                add_filter( 'get_posts_where', create_function( '$q', 'return $q . " AND p.post_text = \'' . $text . '\'";' ) );
-                
+                add_filter( 'get_posts_where', create_function( '$q', 'return $q . " AND p.post_text = \'' . $wpdb->escape( $text ) . '\'";' ) );
+
                 $query = new BB_Query( 'post', $args );