Changeset 3762

Show
Ignore:
Timestamp:
05/04/06 22:25:24 (3 years ago)
Author:
ryan
Message:

Add some prophylactic int casts and quoting.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/2.0/wp-includes/comment-functions.php

    r3737 r3762  
    903903function get_approved_comments($post_id) { 
    904904    global $wpdb; 
     905 
     906    $post_id = (int) $post_id; 
    905907    return $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $post_id AND comment_approved = '1' ORDER BY comment_date"); 
    906908} 

  • branches/2.0/wp-includes/functions-post.php

    r3496 r3762  
    353353    $postid = (int) $postid; 
    354354 
    355     if ( !$post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID = $postid") ) 
     355    if ( !$post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID = '$postid'") ) 
    356356        return $post; 
    357357 
    …… 
    362362    $file = get_post_meta($postid, '_wp_attached_file', true); 
    363363 
    364     $wpdb->query("DELETE FROM $wpdb->posts WHERE ID = $postid"); 
    365  
    366     $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_post_ID = $postid"); 
    367  
    368     $wpdb->query("DELETE FROM $wpdb->post2cat WHERE post_id = $postid"); 
    369  
    370     $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = $postid"); 
     364    $wpdb->query("DELETE FROM $wpdb->posts WHERE ID = '$postid'"); 
     365 
     366    $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_post_ID = '$postid'"); 
     367 
     368    $wpdb->query("DELETE FROM $wpdb->post2cat WHERE post_id = '$postid'"); 
     369 
     370    $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$postid'"); 
    371371 
    372372    if ( ! empty($meta['thumb']) ) { 
    373373        // Don't delete the thumb if another attachment uses it 
    374         if (! $foo = $wpdb->get_row("SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE '%".$wpdb->escape($meta['thumb'])."%' AND post_id <> $postid")) 
     374        if (! $foo = $wpdb->get_row("SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE '%".$wpdb->escape($meta['thumb'])."%' AND post_id <> '$postid'")) 
    375375            @ unlink(str_replace(basename($file), $meta['thumb'], $file)); 
    376376    } 
    …… 
    457457    global $wpdb; 
    458458     
     459    $post_ID = (int) $post_ID; 
     460 
    459461    $sql = "SELECT category_id  
    460462        FROM $wpdb->post2cat  
    461         WHERE post_id = $post_ID  
     463        WHERE post_id = '$post_ID'  
    462464        ORDER BY category_id"; 
    463465 

  • branches/2.0/wp-includes/links.php

    r2795 r3762  
    446446 */ 
    447447function get_linkcatname($id = 0) { 
     448    $id = (int) $id; 
    448449    global $wpdb; 
    449450    $cat_name = ''; 
    450     if ('' != $id) { 
     451    if ( !empty($id) ) { 
    451452        $cat_name = $wpdb->get_var("SELECT cat_name FROM $wpdb->linkcategories WHERE cat_id=$id"); 
    452453    } 

  • branches/2.0/wp-includes/template-functions-general.php

    r3746 r3762  
    510510    // Get days with posts 
    511511    $dayswithposts = $wpdb->get_results("SELECT DISTINCT DAYOFMONTH(post_date) 
    512         FROM $wpdb->posts WHERE MONTH(post_date) = $thismonth 
    513         AND YEAR(post_date) = $thisyear 
     512        FROM $wpdb->posts WHERE MONTH(post_date) = '$thismonth' 
     513        AND YEAR(post_date) = '$thisyear' 
    514514        AND post_status = 'publish' 
    515515        AND post_date < '" . current_time('mysql') . '\'', ARRAY_N);