$wpdb->escape() deprecated in WordPress 3.6.

[johnjamesjacoby]

See: ​#WP24774 - ​[WP24718]

We currently use $wpdb->escape() in 25 locations. We'll want to switch to using esc_sql() or properly $wpdb->prepare()'ing instead.

[needle]

I've created a patch for testing purposes, largely replacing $wpdb->escape() with esc_sql() except in 'bp-forums/bp-forums-functions.php' where a $wpdb->prepare() construction seemed more appropriate. Hope it helps - I'm finding having WP_DEBUG = true impossible now that the deprecated function warning is in place.

[boonebgorges]

Thanks, needle. Some of your $wpdb->prepare() changes in bp-forums won't work because of the syntax necessary for sql statements and the way that prepare() adds quotes. But the rest is good. I'll be committing a bunch of stuff in a few moments.

[boonebgorges]

Actually, I've decided not to commit anything until WP 3.6 is officially out, so that they don't change stuff again at the last minute. Patch attached (5100.patch) which implements most of needle's patch. I've also eliminated a couple of pointless calls to esc_sql(), namely where we're already run wp_parse_id_list() and so already have a guaranteed list of ints. Also adds a testcase for a touched method.

[boonebgorges]

In 7337:

Use esc_sql() instead of $wpdb->escape() throughout

WordPress 3.6 deprecated the use of $wpdb->escape() for sanitizing SQL
query fragments, in favor of the rewritten esc_sql(). This changeset
makes the appropriate changes throughout BuddyPress.

In a few places, this changeset also removes redundant sanitization, in
particular when using wp_parse_id_list().

Also adds a unit test for a touched method (BP_User_Query, when using
the 'exclude' parameter).

Fixes #5100

Props needle

[boonebgorges]

In 7338:

Use esc_sql() instead of $wpdb->escape() throughout

WordPress 3.6 deprecated the use of $wpdb->escape() for sanitizing SQL
query fragments, in favor of the rewritten esc_sql(). This changeset
makes the appropriate changes throughout BuddyPress.

In a few places, this changeset also removes redundant sanitization, in
particular when using wp_parse_id_list().

Also adds a unit test for a touched method (BP_User_Query, when using
the 'exclude' parameter).

Fixes #5100

Props needle