Description: Query: remove SQLi with special chars
 Query: Ensure that queries work correctly with post type names with
 special characters.
 Merge of [39952] to the 4.1 branch.
Author: ocean90@wordpress.org
Origin: upstream, https://core.trac.wordpress.org/changeset/39962
Bug-Debian: https://bugs.debian.org/852767
Applied-Upstream: 4.7.2
Reviewed-by: Craig Small <csmall@debian.org>
Last-Update: 2017-01-27
--- a/wp-includes/query.php
+++ b/wp-includes/query.php
@@ -2910,14 +2910,15 @@
 
 		if ( 'any' == $post_type ) {
 			$in_search_post_types = get_post_types( array('exclude_from_search' => false) );
-			if ( empty( $in_search_post_types ) )
+			if ( empty( $in_search_post_types ) ) {
 				$where .= ' AND 1=0 ';
-			else
-				$where .= " AND $wpdb->posts.post_type IN ('" . join("', '", $in_search_post_types ) . "')";
+			} else {
+				$where .= " AND {$wpdb->posts}.post_type IN ('" . join( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')";
+			}
 		} elseif ( !empty( $post_type ) && is_array( $post_type ) ) {
-			$where .= " AND $wpdb->posts.post_type IN ('" . join("', '", $post_type) . "')";
+			$where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", esc_sql( $post_type ) ) . "')";
 		} elseif ( ! empty( $post_type ) ) {
-			$where .= " AND $wpdb->posts.post_type = '$post_type'";
+			$where .= $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type );
 			$post_type_object = get_post_type_object ( $post_type );
 		} elseif ( $this->is_attachment ) {
 			$where .= " AND $wpdb->posts.post_type = 'attachment'";
