过期的 mysql_escape_string 在 WordPress 下的解决办法

对 string 稍作处理, 避免在写 query 的时候被 SQL 注入, 这是常识. 我们若变更 PHP 版本, 有时候会出现 Call To Undefined Function 这样的错误. 很多时候, 我们需要做出一些兼容性的处理.

不过, 若我们是在 WordPress 的平台上写插件, 则不必这么麻烦了.

在 WordPress 环境下, 系统已经为我们提供了一些有趣的 function, 来包装这些兼容性处理. 我们只消如下 fix 即可:

- $dest = mysql_escape_string($src);
+ $dest = esc_sql($src);

这样就已经足够了.

相关代码如下:

/**
 * Escapes data for use in a MySQL query.
 *
 * Usually you should prepare queries using wpdb::prepare().
 * Sometimes, spot-escaping is required or useful. One example
 * is preparing an array for use in an IN clause.
 *
 * @since 2.8.0
 *
 * @global wpdb $wpdb WordPress database abstraction object.
 *
 * @param string|array $data Unescaped data
 * @return string|array Escaped data
 */
function esc_sql( $data ) {
        global $wpdb;
        return $wpdb->_escape( $data );
}

/**
 * Escape data. Works on arrays.
 *
 * @uses wpdb::_real_escape()
 * @since  2.8.0
 * @access private
 *
 * @param  string|array $data
 * @return string|array escaped
 */
function _escape( $data ) {
        if ( is_array( $data ) ) {
                foreach ( $data as $k => $v ) {
                        if ( is_array($v) )
                                $data[$k] = $this->_escape( $v );
                        else
                                $data[$k] = $this->_real_escape( $v );
                }
        } else {
                $data = $this->_real_escape( $data );
        }

        return $data;
}

/**
 * Real escape, using mysqli_real_escape_string() or mysql_real_escape_string()
 *
 * @see mysqli_real_escape_string()
 * @see mysql_real_escape_string()
 * @since 2.8.0
 * @access private
 *
 * @param  string $string to escape
 * @return string escaped
 */
function _real_escape( $string ) {
        if ( $this->dbh ) {
                if ( $this->use_mysqli ) {
                        return mysqli_real_escape_string( $this->dbh, $string );
                } else {
                        return mysql_real_escape_string( $string, $this->dbh );
                }
        }

        $class = get_class( $this );
        if ( function_exists( '__' ) ) {
                /* translators: %s: database access abstraction class, usually wpdb or a class extending wpdb */
                _doing_it_wrong( $class, sprintf( __( '%s must set a database connection for use with escaping.' ), $class ), E_USER_NOTICE );
        } else {
                _doing_it_wrong( $class, sprintf( '%s must set a database connection for use with escaping.', $class ), E_USER_NOTICE );
        }
        return addslashes( $string );
}

如上, 在 WordPress 上, 平台已经对此有所包装. 若自己写, 也也可以有所借鉴. 但若写 WP 插件还自己来轮子一下, 着实没什么必要.