Wordpress support potentially misleading

[kentfredric]

http://bobby-tables.com/php.html

I should point out, that the Wordpress DB "parameter binding" is not only sprintf like, but is in fact, implemented in terms of sprintf and the queries are interpolated and sent as single queries to the database after throwing mysql_real_escape_string at them ( and a bunch of other regular expressions ).

As such, I don't believe calling it parameter binding is truthful in anyway, and there are potential security leaks hiding in wordpresses custom escaping logic.

• Calling real_escape
• Using addslashes
• String building prepare function