[wp-trac] [WordPress Trac] #12402: make addslashes_gpc() use addslashes() fix to use real_escape, rather than addslashes

[WordPress Trac]

#12402: make addslashes_gpc() use addslashes() fix to use real_escape, rather than
addslashes
-------------------------------+--------------------------------------------
 Reporter:  Denis-de-Bernardy  |       Owner:  ryan                   
     Type:  defect (bug)       |      Status:  new                    
 Priority:  normal             |   Milestone:  3.0                    
Component:  Security           |     Version:  3.0                    
 Severity:  normal             |    Keywords:  has-patch needs-testing
-------------------------------+--------------------------------------------

Comment(by Denis-de-Bernardy):

 Replying to [comment:2 miqrogroove]:
 > I'll give this +1 if the patch makes esc_sql() deprecated or aliases
 weak_escape instead of magic_quotes.  Otherwise, that can of worms is
 looking rather large.

 I think that, in the long term esc_sql() should call wpdb->escape(). But
 for the sake of doing incremental fixes, however, I felt it was better to
 just keep esc_sql()'s behavior unchanged for now (which is exactly what
 the patch does).

 We'll look into making esc_sql() call _real_escape() once this gets
 checked in. I think it'll largely be a matter of replacing most calls to
 esc_sql() into calls to add_magic_quotes().

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/12402#comment:3>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software