Changeset 7993 for trunk/bp-core/bp-core-classes.php

Timestamp:

02/26/2014 01:39:13 PM (11 years ago)

Author:

boonebgorges

Message:

Don't use mysql_real_escape_string() in BP_User_Query

Fixes #5432

Props imath

File:

• trunk/bp-core/bp-core-classes.php (modified) (1 diff)

trunk/bp-core/bp-core-classes.php

@@ -366 +366 @@
         // @todo remove need for bp_is_active() check
         if ( false !== $search_terms && bp_is_active( 'xprofile' ) ) {
-            $search_terms_clean = mysql_real_escape_string( mysql_real_escape_string( $search_terms ) );
+            $search_terms_clean = esc_sql( esc_sql( $search_terms ) );
             $search_terms_clean = like_escape( $search_terms_clean );
             $found_user_ids_query = "SELECT user_id FROM {$bp->profile->table_name_data} WHERE value LIKE '%" . $search_terms_clean . "%'";