Ticket #6644: prepared_queries6.diff
| File prepared_queries6.diff, 3.1 kB (added by filosofo, 5 months ago) |
|---|
-
wp-admin/update-links.php
old new 36 36 $returns = explode("\n", $body); 37 37 38 38 foreach ($returns as $return) : 39 $time = $wpdb->escape( substr($return, 0, 19));40 $uri = $wpdb->escape( preg_replace('/(.*?) | (.*?)/', '$2', $return));41 $wpdb->query( "UPDATE $wpdb->links SET link_updated = '$time' WHERE link_url = '$uri'");39 $time = substr($return, 0, 19); 40 $uri = preg_replace('/(.*?) | (.*?)/', '$2', $return); 41 $wpdb->query( $wpdb->prepare("UPDATE $wpdb->links SET link_updated = %s WHERE link_url = %s", $time, $uri) ); 42 42 endforeach; 43 43 } 44 44 ?> -
wp-admin/edit-comments.php
old new 12 12 $comments_deleted = $comments_approved = $comments_unapproved = $comments_spammed = 0; 13 13 foreach ($_REQUEST['delete_comments'] as $comment) : // Check the permissions on each 14 14 $comment = (int) $comment; 15 $post_id = (int) $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = $comment"); 16 // $authordata = get_userdata( $wpdb->get_var("SELECT post_author FROM $wpdb->posts WHERE ID = $post_id") ); 15 $post_id = (int) $wpdb->get_var( $wpdb->prepare( "SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = %d", $comment) ); 17 16 if ( !current_user_can('edit_post', $post_id) ) 18 17 continue; 19 18 if ( !empty( $_REQUEST['spamit'] ) ) { -
wp-admin/admin-ajax.php
old new 15 15 16 16 if ( strstr( $s, ',' ) ) 17 17 die; // it's a multiple tag insert, we won't find anything 18 $results = $wpdb->get_col( "SELECT name FROM $wpdb->terms WHERE name LIKE ('%$s%')");18 $results = $wpdb->get_col( $wpdb->prepare("SELECT name FROM $wpdb->terms WHERE name LIKE (%s)", '%' . $s . '%') ); 19 19 echo join( $results, "\n" ); 20 20 die; 21 21 } -
wp-admin/includes/comment.php
old new 3 3 function comment_exists($comment_author, $comment_date) { 4 4 global $wpdb; 5 5 6 return $wpdb->get_var( "SELECT comment_post_ID FROM $wpdb->comments7 WHERE comment_author = '$comment_author' AND comment_date = '$comment_date'");6 return $wpdb->get_var( $wpdb->prepare("SELECT comment_post_ID FROM $wpdb->comments 7 WHERE comment_author = %s AND comment_date = %s", $comment_author, $comment_date) ); 8 8 } 9 9 10 10 function edit_comment() { … … 67 67 function get_pending_comments_num( $post_id ) { 68 68 global $wpdb; 69 69 $post_id = (int) $post_id; 70 $pending = $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = $post_id AND comment_approved = '0'");70 $pending = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '0'", $post_id) ); 71 71 return $pending; 72 72 } 73 73
