Changeset 5829

Timestamp:

08/01/07 19:14:10 (1 year ago)

Author:

markjaquith

Message:

add_option()/update_option() should pass the option name to get_option() pre-escaped. fixes #4690 for trunk

Files:

• trunk/wp-includes/functions.php (modified) (5 diffs)

trunk/wp-includes/functions.php

@@ -178 +178 @@
-/* Options functions */
-
+// expects $setting to already be SQL-escaped
-function get_option($setting) {
-    global $wpdb;
@@ -277 +278 @@
-}
-
+// expects $option_name to NOT be SQL-escaped
-function update_option($option_name, $newvalue) {
-    global $wpdb;
@@ -282 +284 @@
-    wp_protect_special_option($option_name);
-
+    $safe_option_name = $wpdb->escape($option_name);
-    $newvalue = sanitize_option($option_name, $newvalue);
-
@@ -288 +291 @@
-
-    // If the new and old values are the same, no need to update.
-
+safe_
-    if ( $newvalue === $oldvalue ) {
-        return false;
@@ -326 +329 @@
-
-// thx Alex Stapleton, http://alex.vort-x.net/blog/
+// expects $name to NOT be SQL-escaped
-function add_option($name, $value = '', $description = '', $autoload = 'yes') {
-    global $wpdb;
-
-    wp_protect_special_option($name);
+    $safe_name = $wpdb->escape($name);
-
-    // Make sure the option doesn't already exist. We can check the 'notoptions' cache before we ask for a db query
-    $notoptions = wp_cache_get('notoptions', 'options');
-    if ( !is_array($notoptions) || !isset($notoptions[$name]) )
-
+safe_
-            return;
-