sergiotarxz/Wordpress
sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Stripslashes post meta values before handing off to add_post_meta. Use wpdb::escape instead of addslashes. Props takayukister. fixes #4028

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@5249 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren 2007-04-12 02:58:41 +00:00
parent d8c8ecb711
commit 3a9b0e0c08
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
wp-admin/import/wordpress.php
View File

@ -35,8 +35,9 @@ class WP_Import {
}
function get_tag( $string, $tag ) {
global $wpdb;
preg_match("|<$tag.*?>(.*?)</$tag>|is", $string, $return);
$return = addslashes( trim( $return[1] ) );
$return = $wpdb->escape( trim( $return[1] ) );
return $return;
}
@ -336,6 +337,7 @@ class WP_Import {
if ( $postmeta) { foreach ($postmeta as $p) {
$key = $this->get_tag( $p, 'wp:meta_key' );
$value = $this->get_tag( $p, 'wp:meta_value' );
$value = stripslashes($value); // add_post_meta() will escape.
add_post_meta( $post_id, $key, $value );
} }
}