WordPress 4.7.2

[autoinstalls/wordpress.git] / wp-includes / class-wp-query.php

diff --git a/wp-includes/class-wp-query.php b/wp-includes/class-wp-query.php
index 7f3c22a785e368cc23d320b89b5db3cfa10443db..c0de352c2de3693b1badd14778e6347a9bcfda0e 100644 (file)
--- a/wp-includes/class-wp-query.php
+++ b/wp-includes/class-wp-query.php
@@ -2255,12 +2255,12 @@ class WP_Query {
                        if ( empty( $in_search_post_types ) ) {
                                $where .= ' AND 1=0 ';
                        } else {
-                               $where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", $in_search_post_types ) . "')";
+                               $where .= " AND {$wpdb->posts}.post_type IN ('" . join( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')";
                        }
                } elseif ( !empty( $post_type ) && is_array( $post_type ) ) {
-                       $where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", $post_type) . "')";
+                       $where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", esc_sql( $post_type ) ) . "')";
                } elseif ( ! empty( $post_type ) ) {
-                       $where .= " AND {$wpdb->posts}.post_type = '$post_type'";
+                       $where .= $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type );
                        $post_type_object = get_post_type_object ( $post_type );
                } elseif ( $this->is_attachment ) {
                        $where .= " AND {$wpdb->posts}.post_type = 'attachment'";