Changeset 7338 for trunk/bp-activity/bp-activity-classes.php

Timestamp:

08/05/2013 02:42:16 PM (13 years ago)

Author:

boonebgorges

Message:

Use esc_sql() instead of $wpdb->escape() throughout

WordPress 3.6 deprecated the use of $wpdb->escape() for sanitizing SQL
query fragments, in favor of the rewritten esc_sql(). This changeset
makes the appropriate changes throughout BuddyPress.

In a few places, this changeset also removes redundant sanitization, in
particular when using wp_parse_id_list().

Also adds a unit test for a touched method (BP_User_Query, when using
the 'exclude' parameter).

Fixes #5100

Props needle

File:

• trunk/bp-activity/bp-activity-classes.php (modified) (1 diff)

trunk/bp-activity/bp-activity-classes.php

@@ -173 +173 @@
                 // Searching
                 if ( $search_terms ) {
-                        $search_terms = $wpdb->escape( $search_terms );
+                        $search_terms = esc_sql( $search_terms );
                         $where_conditions['search_sql'] = "a.content LIKE '%%" . esc_sql( like_escape( $search_terms ) ) . "%%'";
                 }