Skip to:
Content

BuddyPress.org


Ignore:
Timestamp:
08/05/2013 02:42:16 PM (11 years ago)
Author:
boonebgorges
Message:

Use esc_sql() instead of $wpdb->escape() throughout

WordPress 3.6 deprecated the use of $wpdb->escape() for sanitizing SQL
query fragments, in favor of the rewritten esc_sql(). This changeset
makes the appropriate changes throughout BuddyPress.

In a few places, this changeset also removes redundant sanitization, in
particular when using wp_parse_id_list().

Also adds a unit test for a touched method (BP_User_Query, when using
the 'exclude' parameter).

Fixes #5100

Props needle

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/bp-activity/bp-activity-functions.php

    r7222 r7338  
    686686    // Sanitize value
    687687    if ( is_string( $meta_value ) )
    688         $meta_value = stripslashes( $wpdb->escape( $meta_value ) );
     688        $meta_value = stripslashes( esc_sql( $meta_value ) );
    689689
    690690    // Maybe, just maybe... serialize
Note: See TracChangeset for help on using the changeset viewer.