X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/a66f9e26487c560245ef9cd17d7e87c0cbb650af..refs/tags/wordpress-2.5.1:/wp-includes/canonical.php diff --git a/wp-includes/canonical.php b/wp-includes/canonical.php index e4a5c530..5ad44575 100644 --- a/wp-includes/canonical.php +++ b/wp-includes/canonical.php @@ -1,8 +1,39 @@ escape(get_query_var('name')) . "%'"; + $where = $wpdb->prepare("post_name LIKE %s", get_query_var('name') . '%'); // if any of year, monthnum, or day are set, use them to refine the query if ( get_query_var('year') ) - $where .= " AND YEAR(post_date) = '" . $wpdb->escape(get_query_var('year')) . "'"; + $where .= $wpdb->prepare(" AND YEAR(post_date) = %d", get_query_var('year')); if ( get_query_var('monthnum') ) - $where .= " AND MONTH(post_date) = '" . $wpdb->escape(get_query_var('monthnum')) . "'"; + $where .= $wpdb->prepare(" AND MONTH(post_date) = %d", get_query_var('monthnum')); if ( get_query_var('day') ) - $where .= " AND DAYOFMONTH(post_date) = '" . $wpdb->escape(get_query_var('day')) . "'"; + $where .= $wpdb->prepare(" AND DAYOFMONTH(post_date) = %d", get_query_var('day')); $post_id = $wpdb->get_var("SELECT ID FROM $wpdb->posts WHERE $where AND post_status = 'publish'"); if ( !$post_id ) @@ -198,4 +240,4 @@ function redirect_guess_404_permalink() { add_action('template_redirect', 'redirect_canonical'); -?> \ No newline at end of file +?>