Changeset 1122852

Timestamp:

03/28/2015 08:48:35 PM (11 years ago)

Author:

pathawks

Message:

We had better escape our queries

File:

• dirtysuds-category-thumbnail/trunk/thumb.php (modified) (1 diff)

dirtysuds-category-thumbnail/trunk/thumb.php

@@ -41 +41 @@
 
     $embed = '';
-    $posts = get_posts('cat='.$id.'&post_type='.$post_type.'&showposts=1&meta_key=_thumbnail_id');
+    $q = $wpdb->prepare(
+        'cat=%s&post_type=%s&showposts=1&meta_key=_thumbnail_id',
+        $id,
+        $post_type
+    );
+    $posts = get_posts( $q );
     if( isset( $posts[0] ) ) {
         $embed = get_the_post_thumbnail($posts[0]->ID, $size);