Changeset 5559

Timestamp:

06/08/2017 08:18:24 PM (9 years ago)

Author:

iandunn

Message:

Events: Harden geoname query against SQL injection

This was introduced in r5543.

Props xknown

File:

• sites/trunk/api.wordpress.org/public_html/events/1.0/index.php (modified) (1 diff)

sites/trunk/api.wordpress.org/public_html/events/1.0/index.php

@@ -291 +291 @@
                 population DESC
             LIMIT 1",
-            $location_name . '%',
+            $wpdb->esc_like( $location_name ) . '%',
             $country,
             $timezone