WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Always use mysql_real_escape_string(), even when DB_CHARSET is not properly set. fixes #24773. 

git-svn-id: http://core.svn.wordpress.org/trunk@24712 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Andrew Nacin 2013-07-16 14:07:53 +00:00
parent bb4cc55ccf
commit dffd2b1bd9
1 changed files with 2 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
wp-includes/wp-db.php
View File

@ -441,15 +441,6 @@ class wpdb {
*/ */
var $collate; var $collate;
/**
* Whether to use mysql_real_escape_string
*
* @since 2.8.0
* @access public
* @var bool
*/
var $real_escape = false;
/** /**
* Database Username * Database Username
* *
@ -648,7 +639,6 @@ class wpdb {
if ( $this->has_cap( 'collation' ) && ! empty( $charset ) ) { if ( $this->has_cap( 'collation' ) && ! empty( $charset ) ) {
if ( function_exists( 'mysql_set_charset' ) && $this->has_cap( 'set_charset' ) ) { if ( function_exists( 'mysql_set_charset' ) && $this->has_cap( 'set_charset' ) ) {
mysql_set_charset( $charset, $dbh ); mysql_set_charset( $charset, $dbh );
$this->real_escape = true;
} else { } else {
$query = $this->prepare( 'SET NAMES %s', $charset ); $query = $this->prepare( 'SET NAMES %s', $charset );
if ( ! empty( $collate ) ) if ( ! empty( $collate ) )
@ -870,10 +860,9 @@ class wpdb {
} }
/** /**
* Real escape, using mysql_real_escape_string() or addslashes() * Real escape, using mysql_real_escape_string()
* *
* @see mysql_real_escape_string() * @see mysql_real_escape_string()
* @see addslashes()
* @since 2.8.0 * @since 2.8.0
* @access private * @access private
* *
@ -881,10 +870,7 @@ class wpdb {
* @return string escaped * @return string escaped
*/ */
function _real_escape( $string ) { function _real_escape( $string ) {
if ( $this->dbh && $this->real_escape ) return mysql_real_escape_string( $string, $this->dbh );
return mysql_real_escape_string( $string, $this->dbh );
else
return addslashes( $string );
} }
/** /**