As I said on the other thread... http://news.ycombinator.com/item?id=755244 http://news.ycombinator.com/item?id=755244 It's worth noting that this has already

As I said on the other thread... http://news.ycombinator.com/item?id=755244 http://news.ycombinator.com/item?id=755244 It's worth noting that this has already been patched on trunk and the latest stable branch (2.8), so if you run svn update now you'll get this fix. http://core.trac.wordpress.org/timeline http://core.trac.wordpress.org/timeline The patches there are also more extensive. I would recommend getting it direct from the WordPress svn repository rather than using random third-party patches. These are the commits so far, in sequence. As we can see, the erroneous blacklist approach has been replaced in [11799] by a whitelist one (is_array replaced by !is_string). http://core.trac.wordpress.org/changeset/11797 http://core.trac.wordpress.org/changeset/11797 http://core.trac.wordpress.org/changeset/11799 http://core.trac.wordpress.org/changeset/11799 http://core.trac.wordpress.org/changeset/11801 http://core.trac.wordpress.org/changeset/11801 http://core.trac.wordpress.org/changeset/11802 http://core.trac.wordpress.org/changeset/11802 http://core.trac.wordpress.org/changeset/11803 http://core.trac.wordpress.org/changeset/11803 (Note that these are just the changes on trunk, not the commits to the 2.8 stable branch, which are identical.)