Changeset 6221

Timestamp:

10/10/07 22:01:40 (9 months ago)

Author:

markjaquith

Message:

Introducing db_insert() and db_update(), with immediate usage in wp_insert_post(). fixes #5178

Files:

• trunk/wp-includes/post.php (modified) (1 diff)
• trunk/wp-includes/wp-db.php (modified) (1 diff)

trunk/wp-includes/post.php

@@ -1369 +1369 @@
-        $pinged = '';
-
+    // expected_slashed (everything!)
+    $data = array();
+    foreach ( array('post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_content_filtered', 'post_title', 'post_excerpt', 'post_status', 'post_type', 'comment_status', 'ping_status', 'post_password', 'post_name', 'to_ping', 'pinged', 'post_modified', 'post_modified_gmt', 'post_parent', 'menu_order', 'post_mime_type', 'guid') as $f )
+        $data[$f] = stripslashes($$f);
+    unset($f);
+
-    if ($update) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
-    }
-
-    if ( empty($post_name) ) {
-        $post_name = sanitize_title($post_title, $post_ID);
-
-
+
-    }
-

trunk/wp-includes/wp-db.php

@@ -252 +252 @@
-
-    /**
+     * Insert an array of data into a table
+     * @param string $table WARNING: not sanitized!
+     * @param array $data should not already be SQL-escaped
+     * @return mixed results of $this->query()
+     */
+    function db_insert($table, $data) {
+        $data = add_magic_quotes($data);
+        $fields = array_keys($data);
+        return $this->query("INSERT INTO $table (`" . implode('`,`',$fields) . "`) VALUES ('".implode("','",$data)."')");
+    }
+
+    /**
+     * Update a row in the table with an array of data
+     * @param string $table WARNING: not sanitized!
+     * @param array $data should not already be SQL-escaped
+     * @param string $where_col the column of the WHERE statement.  WARNING: not sanitized!
+     * @param string $where_val the value of the WHERE statement.  Should not already be SQL-escaped.
+     * @return mixed results of $this->query()
+     */
+    function db_update($table, $data, $where_col, $where_val){
+        $data = add_magic_quotes($data);
+        $bits = array();
+        foreach ( array_keys($data) as $k )
+            $bits[] = "`$k`='$data[$k]'";
+        $where_val = $wpdb->escape($where_val);
+        return $this->query("UPDATE $table SET ".implode(', ',$bits)." WHERE $where_col = '$where_val' LIMIT 1");
+    }
+
+    /**
-     * Get one variable from the database
-     * @param string $query (can be null as well, for caching, see codex)