[wp-trac] [WordPress Trac] #24941: esc_sql in 3.6 changes how /r /n and maybe other characters handled

[WordPress Trac]

#24941: esc_sql in 3.6 changes how /r /n and maybe other characters handled
--------------------------+------------------------------
 Reporter:  sc0ttkclark   |       Owner:
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Formatting    |     Version:  3.6
 Severity:  normal        |  Resolution:
 Keywords:                |
--------------------------+------------------------------

Comment (by nofearinc):

 Maybe the core ninjas could give a reason for esc_sql to be used there,
 but I can't find any.

 I see your point of testing with addslashes (even if we have functions
 like `esc_html`), just FYI if you think that `esc_sql` is using addslashes
 - it does only if no SQL connection is available in the $wpdb object when
 the esc_sql call is executed. Or moreover, `mysql_real_escape_string` is
 being called instead which could escape the things differently (in SQL it
 makes sense to parse input in a different way to prevent injections).

 http://core.trac.wordpress.org/browser/trunk/wp-includes/wp-db.php#L879

--
Ticket URL: <http://core.trac.wordpress.org/ticket/24941#comment:8>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software