From 2d6144106729bfb539ca8c36487e634646df1000 Mon Sep 17 00:00:00 2001 From: ryan Date: Mon, 20 Oct 2008 21:55:37 +0000 Subject: [PATCH] Use prepare() in wp_insert_attachment(). Props dwc. fixes #7933 git-svn-id: http://svn.automattic.com/wordpress/trunk@9259 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/post.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/wp-includes/post.php b/wp-includes/post.php index 5c61c6d713..b7457217e7 100644 --- a/wp-includes/post.php +++ b/wp-includes/post.php @@ -2281,14 +2281,14 @@ function wp_insert_attachment($object, $file = false, $parent = 0) { $post_name = sanitize_title($post_name); // expected_slashed ($post_name) - $post_name_check = $wpdb->get_var( $wpdb->prepare( "SELECT post_name FROM $wpdb->posts WHERE post_name = '$post_name' AND post_status = 'inherit' AND ID != %d LIMIT 1", $post_ID)); + $post_name_check = $wpdb->get_var( $wpdb->prepare( "SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_status = 'inherit' AND ID != %d LIMIT 1", $post_name, $post_ID)); if ($post_name_check) { $suffix = 2; while ($post_name_check) { $alt_post_name = $post_name . "-$suffix"; // expected_slashed ($alt_post_name, $post_name) - $post_name_check = $wpdb->get_var( $wpdb->prepare( "SELECT post_name FROM $wpdb->posts WHERE post_name = '$alt_post_name' AND post_status = 'inherit' AND ID != %d AND post_parent = %d LIMIT 1", $post_ID, $post_parent)); + $post_name_check = $wpdb->get_var( $wpdb->prepare( "SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_status = 'inherit' AND ID != %d AND post_parent = %d LIMIT 1", $alt_post_name, $post_ID, $post_parent)); $suffix++; } $post_name = $alt_post_name;