Skip to:
Content

BuddyPress.org

Changeset 6716


Ignore:
Timestamp:
01/09/2013 04:27:09 PM (9 years ago)
Author:
boonebgorges
Message:

Escape post text before checking for existing replies in bp_forums_reply_exists()

Fixes #4758

Props wpdennis

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/bp-forums/bp-forums-functions.php

    r6574 r6716  
    353353 */
    354354function bp_forums_reply_exists( $text = '', $topic_id = 0, $user_id = 0 ) {
     355    global $wpdb;
     356
    355357    $reply_exists = false;
    356358
     
    364366
    365367        // BB_Query's post_text parameter does a MATCH, while we need exact matches
    366         add_filter( 'get_posts_where', create_function( '$q', 'return $q . " AND p.post_text = \'' . $text . '\'";' ) );
     368        add_filter( 'get_posts_where', create_function( '$q', 'return $q . " AND p.post_text = \'' . $wpdb->escape( $text ) . '\'";' ) );
    367369
    368370        $query = new BB_Query( 'post', $args );
Note: See TracChangeset for help on using the changeset viewer.