Changeset 7337 for branches/1.8/bp-blogs/bp-blogs-functions.php

Timestamp:

08/05/2013 02:41:51 PM (11 years ago)

Author:

boonebgorges

Message:

Use esc_sql() instead of $wpdb->escape() throughout

WordPress 3.6 deprecated the use of $wpdb->escape() for sanitizing SQL
query fragments, in favor of the rewritten esc_sql(). This changeset
makes the appropriate changes throughout BuddyPress.

In a few places, this changeset also removes redundant sanitization, in
particular when using wp_parse_id_list().

Also adds a unit test for a touched method (BP_User_Query, when using
the 'exclude' parameter).

Fixes #5100

Props needle

File:

• branches/1.8/bp-blogs/bp-blogs-functions.php (modified) (1 diff)

branches/1.8/bp-blogs/bp-blogs-functions.php

@@ -709 +709 @@
 
     if ( is_string($meta_value) )
-        $meta_value = stripslashes($wpdb->escape($meta_value));
+        $meta_value = stripslashes( esc_sql( $meta_value ) );
 
     $meta_value = maybe_serialize($meta_value);