4 ms·
A few notes on PHP's behaviour to anyone trying to follow the code: In PHP, GET and POST arguments that look like arrays are automatically converted to arrays
by paulgb 17y ago
A few notes on PHP's behaviour to anyone trying to follow the code:
In PHP, GET and POST arguments that look like arrays are automatically converted to arrays. So "key[]=" in the query string has the result that $_GET['key'] = array('');
empty(array('')) = false, because the array has one element.
$wpdb->prepare uses the PHP function vsprintf, which has undocumented behaviour when it gets an array as an argument. The (undocumented) behaviour is (apparently) that if the contents of the array are concatenated together and treated as a single string.
- paulgb 17y agoActually, I was wrong about the last one. vsprintf does what it is supposed to. The issue is that $wpdb->prepare can take an array of strings as one argument (as in $wpdb->prepare("%s - %s", array("a","b"))), or as multiple arguments ($wpdb->prepare("%s - %s", "a", "b")). The code that calls $wpdb->prepare in this exploit intends to do the latter, but because there is only one argument which happens to be an array, it ends up that the former is used.