From 1f4997686b88c43c98b5b167446bfa49dcaa8226 Mon Sep 17 00:00:00 2001 From: Andrew Nacin Date: Tue, 16 Jul 2013 14:23:29 +0000 Subject: [PATCH] More clear and concise escaping in get_page_by_path(). see #21767. git-svn-id: https://develop.svn.wordpress.org/trunk@24715 602fd350-edb4-49c9-b593-d223f7449a82 --- wp-includes/post.php | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/wp-includes/post.php b/wp-includes/post.php index 47a5ae0873..eb636864e5 100644 --- a/wp-includes/post.php +++ b/wp-includes/post.php @@ -3417,12 +3417,11 @@ function get_page_by_path($page_path, $output = OBJECT, $post_type = 'page') { $page_path = str_replace('%2F', '/', $page_path); $page_path = str_replace('%20', ' ', $page_path); $parts = explode( '/', trim( $page_path, '/' ) ); - $parts = array_map( 'esc_sql', $parts ); + $parts = esc_sql( $parts ); $parts = array_map( 'sanitize_title_for_query', $parts ); $in_string = "'". implode( "','", $parts ) . "'"; - $post_type_sql = $post_type; - $wpdb->escape_by_ref( $post_type_sql ); + $post_type_sql = esc_sql( $post_type ); $pages = $wpdb->get_results( "SELECT ID, post_name, post_parent, post_type FROM $wpdb->posts WHERE post_name IN ($in_string) AND (post_type = '$post_type_sql' OR post_type = 'attachment')", OBJECT_K ); $revparts = array_reverse( $parts );