Re: WordPress Search Function SQL-Injection

[kelson@xxxxxxxxx]

This looks like the bug described here: http://trac.wordpress.org/ticket/3722
"DB error when sanitized search string results in empty query" (Filed January 
31)

According to that page:
> I guess it's also worth mentioning that commas
> _are_ being sanitized. The reason for the error is
> that once the commas are gone WordPress attempts 
> to wrap the search query with "AND ( $search )"
> 
> Since $search is null MySQL throws up an error.

The same error results from searching for just a space.  In either case, adding 
other characters to the field results in the expected query.  It doesn't look 
like injection would be possible.