From 5fc3bbbfd255190a0740e85065d2bcc3a987631c Mon Sep 17 00:00:00 2001
From: Boone Gorges <boonebgorges@gmail.com>
Date: Mon, 2 Jan 2017 19:40:19 +0000
Subject: [PATCH] Don't double-escape `terms` payload in
 `WP_Tax_Query::transform_query()`.

`terms` values are passed through `sanitize_term_field()` with the 'db'
flag, which add slashes. Because `terms` are subsequently run through
`esc_sql()`, these slashes must be removed. See [36348], which added
a similar step to sanitization in `get_terms()`.

Props bcworkz.
Fixes #39315.
Built from https://develop.svn.wordpress.org/trunk@39662


git-svn-id: http://core.svn.wordpress.org/trunk@39602 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/class-wp-tax-query.php | 7 ++++++-
 wp-includes/version.php            | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/wp-includes/class-wp-tax-query.php b/wp-includes/class-wp-tax-query.php
index 9bff196f28..b46aede70a 100644
--- a/wp-includes/class-wp-tax-query.php
+++ b/wp-includes/class-wp-tax-query.php
@@ -623,7 +623,12 @@ class WP_Tax_Query {
 					 * matter because `sanitize_term_field()` ignores the $term_id param when the
 					 * context is 'db'.
 					 */
-					$term = "'" . esc_sql( sanitize_term_field( $query['field'], $term, 0, $query['taxonomy'], 'db' ) ) . "'";
+					$clean_term = sanitize_term_field( $query['field'], $term, 0, $query['taxonomy'], 'db' );
+
+					// Match sanitization in wp_insert_term().
+					$clean_term = wp_unslash( $clean_term );
+
+					$term = "'" . esc_sql( $clean_term ) . "'";
 				}
 
 				$terms = implode( ",", $query['terms'] );
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 3745cc060c..e040f0df69 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-alpha-39660';
+$wp_version = '4.8-alpha-39662';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.