Sanitization improvements to BP_Core_User methods

[johnjamesjacoby]

As part of a bigger audit related to #4985, I've found several methods that trust the values passed into them that should also be utilizing wp_parse_id_list().

• get_users()
• get_specific_users()
• get_user_extras()

It's worth noting that get_user_extras() seems to expect an array already, though wp_parse_id_list() is smart enough to figure out strings. Patch attached.

[johnjamesjacoby]

Includes other bp-core component IN () query usages

[DJPaul]

Attached path with my audit of the core component, too.

[boonebgorges]

Thanks, guys. I've reviewed the two patches. There were one or two places where each of you caught something that the other hadn't, so it's nice to have many eyes.

For the sake of standardization, I've gone with the following strategy and syntax for sanitizing integer lists for use in a query:

$include = implode( ',', wp_parse_id_list( $include ) );

• one line, easy to read
• No need to run through esc_sql(). All that does is addslashes() (wpdb::_weak_escape()). The return value of wp_parse_id_list() will always be an array of positive integers, so imploding them with commas will never result in anything that needs to be slashed (single quotes, double quotes, backslash, null character).

I'm also including, in the trunk commit, a number of tests for the more delicate of the database classes.

[boonebgorges]

In 7024:

Improved sanitization for Core component database methods

All constructed IN clauses for integer values are now run through
wp_parse_id_list().

Also adds tests for the relevant methods.

Fixes #4992

Props johnjamesjacoby, DJPaul

[boonebgorges]

In 7025:

Improved sanitization in the Core component database methods

All constructed IN clauses for integer values are now run through
wp_parse_id_list().

Fixes #4992 for the 1.7 branch

Props johnjamesjacoby, DJPaul