Skip to:
Content

BuddyPress.org


Ignore:
Timestamp:
08/05/2013 02:41:51 PM (12 years ago)
Author:
boonebgorges
Message:

Use esc_sql() instead of $wpdb->escape() throughout

WordPress 3.6 deprecated the use of $wpdb->escape() for sanitizing SQL
query fragments, in favor of the rewritten esc_sql(). This changeset
makes the appropriate changes throughout BuddyPress.

In a few places, this changeset also removes redundant sanitization, in
particular when using wp_parse_id_list().

Also adds a unit test for a touched method (BP_User_Query, when using
the 'exclude' parameter).

Fixes #5100

Props needle

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/1.8/bp-core/bp-core-classes.php

    r7239 r7337  
    325325        // 'exclude' - User ids to exclude from the results
    326326        if ( false !== $exclude ) {
    327             $exclude        = wp_parse_id_list( $exclude );
    328             $exclude_ids    = $wpdb->escape( implode( ',', (array) $exclude ) );
     327            $exclude_ids    = implode( ',', wp_parse_id_list( $exclude ) );
    329328            $sql['where'][] = "u.{$this->uid_name} NOT IN ({$exclude_ids})";
    330329        }
Note: See TracChangeset for help on using the changeset viewer.