vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-06-28 14:20:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Use sanitize_key() instead of esc_sql() when 'escaping' variable DB field names. see #21767.

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@24714 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Nacin
2013-07-16 14:21:05 +00:00
parent 25708e95f1
commit 40623f1c68
3 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
wp-includes/user.php
View File

@@ -393,7 +393,7 @@ class WP_User_Query {
$this->query_fields = array();
foreach ( $qv['fields'] as $field )
$this->query_fields[] = $wpdb->users . '.' . esc_sql( $field );
$this->query_fields[] = $wpdb->users . '.' . sanitize_key( $field );
$this->query_fields = implode( ',', $this->query_fields );
} elseif ( 'all' == $qv['fields'] ) {
$this->query_fields = "$wpdb->users.*";