Changeset 3740

Show
Ignore:
Timestamp:
04/22/06 00:02:00 (3 years ago)
Author:
ryan
Message:

Add some prophylactic int casts and quoting.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/wp-includes/comment.php

    r3714 r3740  
    6161function get_approved_comments($post_id) { 
    6262    global $wpdb; 
    63     return $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $post_id AND comment_approved = '1' ORDER BY comment_date"); 
     63 
     64    $post_id = (int) $post_id; 
     65    return $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post_id' AND comment_approved = '1' ORDER BY comment_date"); 
    6466} 
    6567 

  • trunk/wp-includes/functions-post.php

    r3709 r3740  
    366366    $postid = (int) $postid; 
    367367 
    368     if ( !$post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID = $postid") ) 
     368    if ( !$post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID = '$postid'") ) 
    369369        return $post; 
    370370 
    …… 
    375375    $file = get_post_meta($postid, '_wp_attached_file', true); 
    376376 
    377     $wpdb->query("DELETE FROM $wpdb->posts WHERE ID = $postid"); 
    378  
    379     $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_post_ID = $postid"); 
    380  
    381     $wpdb->query("DELETE FROM $wpdb->post2cat WHERE post_id = $postid"); 
    382  
    383     $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = $postid"); 
     377    $wpdb->query("DELETE FROM $wpdb->posts WHERE ID = '$postid'"); 
     378 
     379    $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_post_ID = '$postid'"); 
     380 
     381    $wpdb->query("DELETE FROM $wpdb->post2cat WHERE post_id = '$postid'"); 
     382 
     383    $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$postid'"); 
    384384 
    385385    if ( ! empty($meta['thumb']) ) { 
    386386        // Don't delete the thumb if another attachment uses it 
    387         if (! $foo = $wpdb->get_row("SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE '%".$wpdb->escape($meta['thumb'])."%' AND post_id <> $postid")) 
     387        if (! $foo = $wpdb->get_row("SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE '%".$wpdb->escape($meta['thumb'])."%' AND post_id <> '$postid'")) 
    388388            @ unlink(str_replace(basename($file), $meta['thumb'], $file)); 
    389389    } 
    …… 
    482482    global $wpdb; 
    483483 
     484    $post_ID = (int) $post_ID; 
     485 
    484486    $sql = "SELECT category_id  
    485487        FROM $wpdb->post2cat  
    486         WHERE post_id = $post_ID  
     488        WHERE post_id = '$post_ID'  
    487489        ORDER BY category_id"; 
    488490 

  • trunk/wp-includes/template-functions-bookmarks.php

    r3707 r3740  
    169169 */ 
    170170function get_linkcatname($id = 0) { 
     171    $id = (int) $id; 
     172 
    171173    if ( empty($id) ) 
    172174        return ''; 

  • trunk/wp-includes/template-functions-general.php

    r3681 r3740  
    502502    // Get days with posts 
    503503    $dayswithposts = $wpdb->get_results("SELECT DISTINCT DAYOFMONTH(post_date) 
    504         FROM $wpdb->posts WHERE MONTH(post_date) = $thismonth 
    505         AND YEAR(post_date) = $thisyear 
     504        FROM $wpdb->posts WHERE MONTH(post_date) = '$thismonth' 
     505        AND YEAR(post_date) = '$thisyear' 
    506506        AND post_type = 'post' AND post_status = 'publish' 
    507507        AND post_date < '" . current_time('mysql') . '\'', ARRAY_N);