{5} Assigned, Active Tickets by Owner (Full Description) (9 matches)

Track progress on replacing the FAT and Prototype libraries here.

bbPress has two kinds of functions that interact with the database: those that expect data to be pre-escaped, and those that escape the data for you.

All bbPress functions should expect data to be un-escaped.

This means that bbPress will be able to (and should) escape the data right before the actual query is made, greatly reducing any chance of SQL injection holes in core or plugins. It also makes passing data around between functions easier.

We have a new prepare() method [906] in the DB classes now that will do the escaping for us via a printf-like mechanism:

$result = $bbdb->get_results( $bbdb->prepare(
	"SELECT something FROM $bbdb->table WHERE foo = %s LIMIT %d",
	$value,
	$number
) );

See #WP4553

This will "break" some plugins that use certain bbPress functions. I put break in quotes because the only symptom will be extra slashes (which are, granted, super annoying). The present and future benefits, I think, will greatly outweigh any backward incompatibility.

The installer no longer matches the look and feel of the admin area since it has changed. We need to design a new installer which more closely resembles the new admin area in colour and feel. We should also assess some of the installation workflow parts of WordPress and see if there is anything in the way of helpful error messages which can be ported across.

example bb_get_title and get_user_title.. prefix bb_ is missing in the second one..