Changeset 6823

Timestamp:

03/02/2018 08:48:38 PM (6 years ago)

Author:

iandunn

Message:

Official WordPress Events: Remove sprintf() from query.

This was only used to avoid ugly string concatenation, making the query more readible. It's too easy to confuse it with $wpdb->prepare(), though; a future developer could accidentally pass untrusted user input to it, expecting it to be prepared, when in reality it would be passed directly to MySQL, allowing SQL injection.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/official-wordpress-events/official-wordpress-events.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/official-wordpress-events/official-wordpress-events.php

@@ -144 +144 @@
 
         // Include yesterday's events because server timezone may be ahead of user's timezone
-        $raw_events = $wpdb->get_results( sprintf( "
+        $raw_events = $wpdb->get_results( "
             SELECT *
-            FROM `%s`
+            FROM ``
             WHERE
                 date_utc >= SUBDATE( CURRENT_DATE(), 1 ) AND
                 status    = 'scheduled'
             ORDER BY date_utc ASC
-            LIMIT 300",
-            self::EVENTS_TABLE
-        ) );
+            LIMIT 300"
+        );
 
         foreach ( $raw_events as $event ) {