Changeset 7054 for trunk/bp-core/bp-core-functions.php

Timestamp:

05/11/2013 11:42:45 AM (12 years ago)

Author:

boonebgorges

Message:

Introduces bp_esc_sql_order() function for sanitizing 'order' params for SQL

Several BP database methods accept an 'order' parameter. This function should
be used to sanitize this parameter into a query-safe string 'ASC' or 'DESC'.

File:

• trunk/bp-core/bp-core-functions.php (modified) (1 diff)

trunk/bp-core/bp-core-functions.php

@@ -1080 +1080 @@
 
     return $new_args;
+}
+
+/**
+ * Sanitize an 'order' parameter for use in building SQL queries
+ *
+ * Strings like 'DESC', 'desc', ' desc' will be interpreted into 'DESC'.
+ * Everything else becomes 'ASC'.
+ *
+ * @since BuddyPress (1.8)
+ * @param string $order The 'order' string, as passed to the SQL constructor
+ * @return string The sanitized value 'DESC' or 'ASC'
+ */
+function bp_esc_sql_order( $order = '' ) {
+    $order = strtoupper( trim( $order ) );
+    return 'DESC' === $order ? 'DESC' : 'ASC';
 }