[wp-trac] [WordPress Trac] #11819: Use mysql_real_escape_string instead of addslashes

[WordPress Trac]

#11819: Use mysql_real_escape_string instead of addslashes
--------------------------+-------------------------------------------------
 Reporter:  hakre         |        Owner:  ryan    
     Type:  defect (bug)  |       Status:  reopened
 Priority:  high          |    Milestone:  3.0     
Component:  Security      |      Version:  2.5     
 Severity:  critical      |   Resolution:          
 Keywords:  dev-feedback  |  
--------------------------+-------------------------------------------------

Comment(by hakre):

 Refering to my own [comment:14 hakre] ''and SET NAMES'':

 Okay I found the reference regarding
 [http://dev.mysql.com/doc/refman/5.0/en/mysql-real-escape-string.html SET
 NAMES and mysql_real_escape_string(), it's in the MySQL manual]
 ([http://dev.mysql.com/doc/refman/4.1/en/mysql-real-escape-string.html
 Version 3.23/4.0/4.1 Information]). Quote:

  If you need to change the character set of the connection, you should use
 the mysql_set_character_set() function rather than executing a SET NAMES
 (or SET CHARACTER SET) statement. mysql_set_character_set() works like SET
 NAMES but also affects the character set used by
 mysql_real_escape_string(), which SET NAMES does not.

 '''Note:''' This is not the true arumentation why
 mysql_real_escape_string() is not used within the core code. As a proof
 you can compare to the usage of addslashes: It has the same (and even
 more) deficiencies and it is used.

 From what I can say so far is, that there were problems like in #9189
 which motivated the switch back to addslashes. Ryan pointed to that as
 well. Maybe there is an easier fix for #9189 which can pass all DB tests
 as well which will help us to get more safety by escaping database queries
 in the future.

 BTW, I just wonder why #9189 does not regress on those installations that
 do use mysql_real_escape_string() as of today... .

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/11819#comment:15>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software