Changeset 7645

trunk/wp-admin/admin-ajax.php

r7509	r7645
16	16	if ( strstr( $s, ',' ) )
17	17	die; // it's a multiple tag insert, we won't find anything
18		$results = $wpdb->get_col( ~~"SELECT name FROM $wpdb->terms WHERE name LIKE ('%$s%')"~~ );
	18	$results = $wpdb->get_col( $wpdb->prepare("SELECT name FROM $wpdb->terms WHERE name LIKE (%s)", '%' . $s . '%') );
19	19	echo join( $results, "\n" );
20	20	die;

trunk/wp-admin/edit-comments.php

r7424	r7645
13	13	foreach ($_REQUEST['delete_comments'] as $comment) : // Check the permissions on each
14	14	$comment = (int) $comment;
15		$post_id = (int) $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = $comment");
16		// $authordata = get_userdata( $wpdb->get_var("SELECT post_author FROM $wpdb->posts WHERE ID = $post_id") );
	15	$post_id = (int) $wpdb->get_var( $wpdb->prepare( "SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = %d", $comment) );
17	16	if ( !current_user_can('edit_post', $post_id) )
18	17	continue;

trunk/wp-admin/edit-pages.php

r7485	r7645
176	176	if ( 1 == count($posts) && is_singular() ) :
177	177
178		$comments = $wpdb->get_results(~~"SELECT * FROM $wpdb->comments WHERE comment_post_ID = $id AND comment_approved != 'spam' ORDER BY comment_date"~~);
	178	$comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved != 'spam' ORDER BY comment_date", $id) );
179	179	if ( $comments ) :
180	180	// Make sure comments, post, and post_author are cached

trunk/wp-admin/edit.php

r7625	r7645
206	206	if ( 1 == count($posts) && is_singular() ) :
207	207
208		$comments = $wpdb->get_results(~~"SELECT * FROM $wpdb->comments WHERE comment_post_ID = $id AND comment_approved != 'spam' ORDER BY comment_date"~~);
	208	$comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved != 'spam' ORDER BY comment_date", $id) );
209	209	if ( $comments ) :
210	210	// Make sure comments, post, and post_author are cached

trunk/wp-admin/import/blogger.php

r7072	r7645
642	642
643	643	// Get an array of posts => authors
644		$post_ids = (array) $wpdb->get_col(~~"SELECT post_id FROM $wpdb->postmeta WHERE meta_key = 'blogger_blog' AND meta_value = '$host'"~~);
	644	$post_ids = (array) $wpdb->get_col( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_key = 'blogger_blog' AND meta_value = %s", $host) );
645	645	$post_ids = join( ',', $post_ids );
646	646	$results = (array) $wpdb->get_results("SELECT post_id, meta_value FROM $wpdb->postmeta WHERE meta_key = 'blogger_author' AND post_id IN ($post_ids)");
…	…
659	659	$post_ids = join( ',', $post_ids);
660	660
661		$wpdb->query(~~"UPDATE $wpdb->posts SET post_author = $user_id WHERE id IN ($post_ids)"~~);
	661	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_author = %d WHERE id IN ($post_ids)", $user_id) );
662	662	$this->blogs[$importing_blog]['authors'][$author][1] = $user_id;
663	663	}

trunk/wp-admin/import/dotclear.php

r7397	r7645
14	14	{
15	15	global $wpdb;
16		return $wpdb->get_var(~~'SELECT count(*) FROM '.$wpdb->comments.' WHERE comment_post_ID = '.$post_ID~~);
	16	return $wpdb->get_var( $wpdb->prepare("SELECT count(*) FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
17	17	}
18	18	}
…	…
23	23	{
24	24	global $wpdb;
25		return $wpdb->get_var(~~'SELECT link_id FROM '.$wpdb->links.' WHERE link_name = "'.$linkname.'"'~~);
	25	return $wpdb->get_var( $wpdb->prepare("SELECT link_id FROM $wpdb->links WHERE link_name = %s", $linkname) );
26	26	}
27	27	}

trunk/wp-admin/import/textpattern.php

r7397	r7645
9	9	{
10	10	global $wpdb;
11		return $wpdb->get_var(~~'SELECT count(*) FROM '.$wpdb->comments.' WHERE comment_post_ID = '.$post_ID~~);
	11	return $wpdb->get_var( $wpdb->prepare("SELECT count(*) FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
12	12	}
13	13	}
…	…
18	18	{
19	19	global $wpdb;
20		return $wpdb->get_var(~~'SELECT link_id FROM '.$wpdb->links.' WHERE link_name = "'.$wpdb->escape($linkname).'"'~~);
	20	return $wpdb->get_var( $wpdb->prepare("SELECT link_id FROM $wpdb->links WHERE link_name = %s", $linkname) );
21	21	}
22	22	}

trunk/wp-admin/import/wp-cat2tag.php

r6950	r7645
165	165	$posts = get_objects_in_term($category->term_id, 'category');
166	166	foreach ( $posts as $post ) {
167		if ( !$wpdb->get_var(~~"SELECT object_id FROM $wpdb->term_relationships WHERE object_id = '$post' AND term_taxonomy_id = '$id'"~~) )
168		$wpdb->query(~~"INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ('$post', '$id')"~~);
	167	if ( !$wpdb->get_var( $wpdb->prepare("SELECT object_id FROM $wpdb->term_relationships WHERE object_id = %d AND term_taxonomy_id = %d", $post, $id) ) )
	168	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES (%d, %d)", $post, $id) );
169	169	clean_post_cache($post);
170	170	}
171	171	} else {
172		$tt_ids = $wpdb->get_col(~~"SELECT term_taxonomy_id FROM $wpdb->term_taxonomy WHERE term_id = '{$category->term_id}' AND taxonomy = 'category'"~~);
	172	$tt_ids = $wpdb->get_col( $wpdb->prepare("SELECT term_taxonomy_id FROM $wpdb->term_taxonomy WHERE term_id = %d AND taxonomy = 'category'", $category->term_id) );
173	173	if ( $tt_ids ) {
174	174	$posts = $wpdb->get_col("SELECT object_id FROM $wpdb->term_relationships WHERE term_taxonomy_id IN (" . join(',', $tt_ids) . ") GROUP BY object_id");
…	…
178	178
179	179	// Change the category to a tag.
180		$wpdb->query(~~"UPDATE $wpdb->term_taxonomy SET taxonomy = 'post_tag' WHERE term_id = '{$category->term_id}' AND taxonomy = 'category'"~~);
181
182		$terms = $wpdb->get_col(~~"SELECT term_id FROM $wpdb->term_taxonomy WHERE parent = '{$category->term_id}' AND taxonomy = 'category'"~~);
	180	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->term_taxonomy SET taxonomy = 'post_tag' WHERE term_id = %d AND taxonomy = 'category'", $category->term_id) );
	181
	182	$terms = $wpdb->get_col( $wpdb->prepare("SELECT term_id FROM $wpdb->term_taxonomy WHERE parent = %d AND taxonomy = 'category'", $category->term_id) );
183	183	foreach ( (array) $terms as $term )
184	184	clean_category_cache($term);
185	185
186	186	// Set all parents to 0 (root-level) if their parent was the converted tag
187		$wpdb->query(~~"UPDATE $wpdb->term_taxonomy SET parent = 0 WHERE parent = '{$category->term_id}' AND taxonomy = 'category'"~~);
	187	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->term_taxonomy SET parent = 0 WHERE parent = %d AND taxonomy = 'category'", $category->term_id) );
188	188	}
189	189	// Clean the cache

trunk/wp-admin/includes/bookmark.php

r7193	r7645
48	48	wp_delete_object_term_relationships($link_id, 'link_category');
49	49
50		$wpdb->query(~~"DELETE FROM $wpdb->links WHERE link_id = '$link_id'"~~);
	50	$wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->links WHERE link_id = %d", $link_id) );
51	51
52	52	do_action('deleted_link', $link_id);
…	…
120	120
121	121	if ( $update ) {
122		$wpdb->query("UPDATE $wpdb->links SET link_url='$link_url',
123		link_name='$link_name', link_image='$link_image',
124		link_target='$link_target',
125		link_visible='$link_visible', link_description='$link_description',
126		link_rating='$link_rating', link_rel='$link_rel',
127		link_notes='$link_notes', link_rss = '$link_rss'
128		WHERE link_id='$link_id'");
	122	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->links SET link_url = %s,
	123	link_name = %s, link_image = %s, link_target = %s,
	124	link_visible = %s, link_description = %s, link_rating = %s,
	125	link_rel = %s, link_notes = %s, link_rss = %s
	126	WHERE link_id = %s", $link_url, $link_name, $link_image, $link_target, $link_visible, $link_description, $link_rating, $link_rel, $link_notes, $link_rss, $link_id) );
129	127	} else {
130		$wpdb->query("INSERT INTO $wpdb->links (link_url, link_name, link_image, link_target, link_description, link_visible, link_owner, link_rating, link_rel, link_notes, link_rss) VALUES('$link_url','$link_name', '$link_image', '$link_target', '$link_description', '$link_visible', '$link_owner', '$link_rating', '$link_rel', '$link_notes', '$link_rss')");
	128	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->links (link_url, link_name, link_image, link_target, link_description, link_visible, link_owner, link_rating, link_rel, link_notes, link_rss) VALUES(%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
	129	$link_url,$link_name, $link_image, $link_target, $link_description, $link_visible, $link_owner, $link_rating, $link_rel, $link_notes, $link_rss) );
131	130	$link_id = (int) $wpdb->insert_id;
132	131	}

trunk/wp-admin/includes/comment.php

r7609	r7645
4	4	global $wpdb;
5	5
6		return $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments
7		WHERE comment_author = ~~'$comment_author' AND comment_date = '$comment_date'"~~);
	6	return $wpdb->get_var( $wpdb->prepare("SELECT comment_post_ID FROM $wpdb->comments
	7	WHERE comment_author = %s AND comment_date = %s", $comment_author, $comment_date) );
8	8	}
9	9
…	…
68	68	global $wpdb;
69	69	$post_id = (int) $post_id;
70		$pending = $wpdb->get_var( ~~"SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = $post_id AND comment_approved = '0'"~~ );
	70	$pending = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '0'", $post_id) );
71	71	return $pending;
72	72	}

trunk/wp-admin/includes/export.php

r7299	r7645
18	18	if ( $author and $author != 'all' ) {
19	19	$author_id = (int) $author;
20		$where = ~~" WHERE post_author = '$author_id' "~~;
	20	$where = $wpdb->prepare(" WHERE post_author = %d ", $author_id);
21	21	}
22	22
…	…
218	218	<?php } ?>
219	219	<?php
220		$postmeta = $wpdb->get_results(~~"SELECT * FROM $wpdb->postmeta WHERE post_id = $post->ID"~~);
	220	$postmeta = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->postmeta WHERE post_id = %d", $post->ID) );
221	221	if ( $postmeta ) {
222	222	?>
…	…
229	229	<?php } ?>
230	230	<?php
231		$comments = $wpdb->get_results(~~"SELECT * FROM $wpdb->comments WHERE comment_post_ID = $post->ID"~~);
	231	$comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d", $post->ID) );
232	232	if ( $comments ) { foreach ( $comments as $c ) { ?>
233	233	<wp:comment>

trunk/wp-admin/includes/post.php

r7638	r7645
195	195
196	196	if (!empty ($post_date))
197		$post_date = ~~"AND post_date = '$post_date'"~~;
	197	$post_date = $wpdb->prepare("AND post_date = %s", $post_date);
198	198
199	199	if (!empty ($title))
200		return $wpdb->get_var(~~"SELECT ID FROM $wpdb->posts WHERE post_title = '$title' $post_date"~~);
	200	return $wpdb->get_var( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title = %s $post_date", $title) );
201	201	else
202	202	if (!empty ($content))
203		return $wpdb->get_var(~~"SELECT ID FROM $wpdb->posts WHERE post_content = '$content' $post_date"~~);
	203	return $wpdb->get_var( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_content = %s $post_date", $content) );
204	204
205	205	return 0;
…	…
381	381	wp_cache_delete($post_ID, 'post_meta');
382	382
383		$wpdb->query( "
384		INSERT INTO $wpdb->postmeta
385		(post_id,meta_key,meta_value )
386		VALUES ('$post_ID','$metakey','$metavalue' )
387		" );
	383	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta
	384	(post_id,meta_key,meta_value ) VALUES (%s, %s, %s)",
	385	$post_ID, $metakey, $metavalue) );
388	386	return $wpdb->insert_id;
389	387	}
…	…
395	393	$mid = (int) $mid;
396	394
397		$post_id = $wpdb->get_var(~~"SELECT post_id FROM $wpdb->postmeta WHERE meta_id = '$mid'"~~);
	395	$post_id = $wpdb->get_var( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
398	396	wp_cache_delete($post_id, 'post_meta');
399	397
400		return $wpdb->query( ~~"DELETE FROM $wpdb->postmeta WHERE meta_id = '$mid'"~~ );
	398	return $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
401	399	}
402	400
…	…
418	416	$mid = (int) $mid;
419	417
420		$meta = $wpdb->get_row( ~~"SELECT * FROM $wpdb->postmeta WHERE meta_id = '$mid'"~~ );
	418	$meta = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
421	419	if ( is_serialized_string( $meta->meta_value ) )
422	420	$meta->meta_value = maybe_unserialize( $meta->meta_value );
…	…
428	426	global $wpdb;
429	427
430		return $wpdb->get_results( "
431		SELECT meta_key, meta_value, meta_id, post_id
432		FROM $wpdb->postmeta
433		WHERE post_id = '$postid'
434		ORDER BY meta_key,meta_id", ARRAY_A );
	428	return $wpdb->get_results( $wpdb->prepare("SELECT meta_key, meta_value, meta_id, post_id
	429	FROM $wpdb->postmeta WHERE post_id = %d
	430	ORDER BY meta_key,meta_id", $postid), ARRAY_A );
435	431
436	432	}
…	…
444	440	return false;
445	441
446		$post_id = $wpdb->get_var(~~"SELECT post_id FROM $wpdb->postmeta WHERE meta_id = '$mid'"~~);
	442	$post_id = $wpdb->get_var( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
447	443	wp_cache_delete($post_id, 'post_meta');
448	444
…	…
450	446	$mvalue = $wpdb->escape( $mvalue );
451	447	$mid = (int) $mid;
452		return $wpdb->query( ~~"UPDATE $wpdb->postmeta SET meta_key = '$mkey', meta_value = '$mvalue' WHERE meta_id = '$mid'"~~ );
	448	return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->postmeta SET meta_key = %s, meta_value = %s WHERE meta_id = %d", $mkey, $mvalue, $mid) );
453	449	}
454	450
…	…
503	499	$old_ID = (int) $old_ID;
504	500	$new_ID = (int) $new_ID;
505		return $wpdb->query( ~~"UPDATE $wpdb->posts SET post_parent = $new_ID WHERE post_parent = $old_ID"~~ );
	501	return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_parent = %d WHERE post_parent = %d", $new_ID, $old_ID) );
506	502	}
507	503

trunk/wp-admin/includes/template.php

r7595	r7645
893	893	function parent_dropdown( $default = 0, $parent = 0, $level = 0 ) {
894	894	global $wpdb, $post_ID;
895		$items = $wpdb->get_results( ~~"SELECT ID, post_parent, post_title FROM $wpdb->posts WHERE post_parent = $parent AND post_type = 'page' ORDER BY menu_order"~~ );
	895	$items = $wpdb->get_results( $wpdb->prepare("SELECT ID, post_parent, post_title FROM $wpdb->posts WHERE post_parent = %d AND post_type = 'page' ORDER BY menu_order", $parent) );
896	896
897	897	if ( $items ) {

trunk/wp-admin/includes/upgrade.php

r7628	r7645
219	219	if ('' == $post->post_name) {
220	220	$newtitle = sanitize_title($post->post_title);
221		$wpdb->query(~~"UPDATE $wpdb->posts SET post_name = '$newtitle' WHERE ID = '$post->ID'"~~);
	221	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_name = %s WHERE ID = %d", $newtitle, $post->ID) );
222	222	}
223	223	}
…	…
228	228	if ('' == $category->category_nicename) {
229	229	$newtitle = sanitize_title($category->cat_name);
230		$wpdb->query(~~"UPDATE $wpdb->categories SET category_nicename = '$newtitle' WHERE cat_ID = '$category->cat_ID'"~~);
	230	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->categories SET category_nicename = %s WHERE cat_ID = %d", $newtitle, $category->cat_ID) );
231	231	}
232	232	}
…	…
251	251	foreach ($allposts as $post) {
252	252	// Check to see if it's already been imported
253		$cat = $wpdb->get_row(~~"SELECT * FROM $wpdb->post2cat WHERE post_id = $post->ID AND category_id = $post->post_category"~~);
	253	$cat = $wpdb->get_row( $wpdb->("SELECT * FROM $wpdb->post2cat WHERE post_id = %d AND category_id = %d", $post->ID, $post->post_category) );
254	254	if (!$cat && 0 != $post->post_category) { // If there's no result
255		$wpdb->query("
256		INSERT INTO $wpdb->post2cat
	255	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->post2cat
257	256	(post_id, category_id)
258		VALUES
259		('$post->ID', '$post->post_category')
260		");
	257	VALUES (%s, %s)
	258	", $post->ID, $post->post_category) );
261	259	}
262	260	}
…	…
286	284	if ('' == $user->user_nicename) {
287	285	$newname = sanitize_title($user->user_nickname);
288		$wpdb->query(~~"UPDATE $wpdb->users SET user_nicename = '$newname' WHERE ID = '$user->ID'"~~);
	286	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->users SET user_nicename = %s WHERE ID = %d", $newname, $user->ID) );
289	287	}
290	288	}
…	…
402	400	if ( 1 != $option->dupes ) { // Could this be done in the query?
403	401	$limit = $option->dupes - 1;
404		$dupe_ids = $wpdb->get_col(~~"SELECT option_id FROM $wpdb->options WHERE option_name = '$option->option_name' LIMIT $limit"~~);
	402	$dupe_ids = $wpdb->get_col( $wpdb->prepare("SELECT option_id FROM $wpdb->options WHERE option_name = %s LIMIT %d", $option->option_name, $limit) );
405	403	$dupe_ids = join($dupe_ids, ',');
406	404	$wpdb->query("DELETE FROM $wpdb->options WHERE option_id IN ($dupe_ids)");
…	…
446	444	if ($idmode == 'namelf') $id = $user->user_lastname.' '.$user->user_firstname;
447	445	if (!$idmode) $id = $user->user_nickname;
448		$id = $wpdb->escape( $id );
449		$wpdb->query("UPDATE $wpdb->users SET display_name = '$id' WHERE ID = '$user->ID'");
	446	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->users SET display_name = %s WHERE ID = %d", $id, $user->ID) );
450	447	endif;
451	448
…	…
469	466	if( is_array( $comments ) ) {
470	467	foreach ($comments as $comment) {
471		$wpdb->query( ~~"UPDATE $wpdb->posts SET comment_count = $comment->c WHERE ID = '$comment->comment_post_ID'"~~ );
	468	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET comment_count = %d WHERE ID = %d", $comment->c, $comment->comment_post_ID) );
472	469	}
473	470	}
…	…
478	475	$objects = $wpdb->get_results("SELECT ID, post_type FROM $wpdb->posts WHERE post_status = 'object'");
479	476	foreach ($objects as $object) {
480		$wpdb->query("UPDATE $wpdb->posts SET post_status = 'attachment',
481		post_mime_type = ~~'$object->post_type'~~,
	477	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_status = 'attachment',
	478	post_mime_type = %s,
482	479	post_type = ''
483		WHERE ID = ~~$object->ID"~~);
	480	WHERE ID = %d", $object->post_type, $object->ID) );
484	481
485	482	$meta = get_post_meta($object->ID, 'imagedata', true);
…	…
509	506	}
510	507
511		$wpdb->query(~~"UPDATE $wpdb->posts SET post_status = '$status', post_type = '$type' WHERE ID = '$post->ID'"~~);
	508	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_status = %s, post_type = %s WHERE ID = %d", $status, $type, $post->ID) );
512	509	}
513	510	}
…	…
542	539	foreach ($categories as $category) {
543	540	$term_id = (int) $category->cat_ID;
544		~~$name = $wpdb->escape($category->cat_name);~~
545		~~$description = $wpdb->escape($category->category_description);~~
546		~~$slug = $wpdb->escape($category->category_nicename);~~
547		~~$parent = $wpdb->escape($category->category_parent);~~
548	541	$term_group = 0;
549	542
550	543	// Associate terms with the same slug in a term group and make slugs unique.
551		if ( $exists = $wpdb->get_results(~~"SELECT term_id, term_group FROM $wpdb->terms WHERE slug = '$slug'"~~) ) {
	544	if ( $exists = $wpdb->get_results( $wpdb->prepare("SELECT term_id, term_group FROM $wpdb->terms WHERE slug = %s", $slug) ) ) {
552	545	$term_group = $exists[0]->term_group;
553	546	$id = $exists[0]->term_id;
…	…
556	549	$alt_slug = $slug . "-$num";
557	550	$num++;
558		$slug_check = $wpdb->get_var(~~"SELECT slug FROM $wpdb->terms WHERE slug = '$alt_slug'"~~);
	551	$slug_check = $wpdb->get_var( $wpdb->prepare("SELECT slug FROM $wpdb->terms WHERE slug = %s", $alt_slug) );
559	552	} while ( $slug_check );
560	553
…	…
563	556	if ( empty( $term_group ) ) {
564	557	$term_group = $wpdb->get_var("SELECT MAX(term_group) FROM $wpdb->terms GROUP BY term_group") + 1;
565		$wpdb->query(~~"UPDATE $wpdb->terms SET term_group = '$term_group' WHERE term_id = '$id'"~~);
	558	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->terms SET term_group = %d WHERE term_id = %d", $term_group, $id) );
566	559	}
567	560	}
568	561
569		$wpdb->query("INSERT INTO $wpdb->terms (term_id, name, slug, term_group) VALUES ('$term_id', '$name', '$slug', '$term_group')");
	562	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->terms (term_id, name, slug, term_group) VALUES
	563	(%d, %s, %s, %d)", $term_id, $name, $slug, $term_group) );
570	564
571	565	$count = 0;
…	…
573	567	$count = (int) $category->category_count;
574	568	$taxonomy = 'category';
575		$wpdb->query(~~"INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')"~~);
	569	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
576	570	$tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
577	571	}
…	…
580	574	$count = (int) $category->link_count;
581	575	$taxonomy = 'link_category';
582		$wpdb->query(~~"INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')"~~);
	576	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
583	577	$tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
584	578	}
…	…
588	582	$count = (int) $category->tag_count;
589	583	$taxonomy = 'post_tag';
590		$wpdb->query(~~"INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')"~~);
	584	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
591	585	$tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
592	586	}
…	…
595	589	$count = 0;
596	590	$taxonomy = 'category';
597		$wpdb->query(~~"INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')"~~);
	591	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
598	592	$tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
599	593	}
…	…
615	609	continue;
616	610
617		$wpdb->query(~~"INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ('$post_id', '$tt_id')"~~);
	611	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ( %d, %d)", $post_id, $tt_id) );
618	612	}
619	613
…	…
634	628
635	629	// Associate terms with the same slug in a term group and make slugs unique.
636		if ( $exists = $wpdb->get_results(~~"SELECT term_id, term_group FROM $wpdb->terms WHERE slug = '$slug'"~~) ) {
	630	if ( $exists = $wpdb->get_results( $wpdb->prepare("SELECT term_id, term_group FROM $wpdb->terms WHERE slug = %s", $slug) ) ) {
637	631	$term_group = $exists[0]->term_group;
638	632	$term_id = $exists[0]->term_id;
…	…
640	634
641	635	if ( empty($term_id) ) {
642		$wpdb->query(~~"INSERT INTO $wpdb->terms (name, slug, term_group) VALUES ('$name', '$slug', '$term_group')"~~);
	636	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->terms (name, slug, term_group) VALUES (%s, %s, %d)", $name, $slug, $term_group) );
643	637	$term_id = (int) $wpdb->insert_id;
644	638	}
…	…
647	641	$default_link_cat = $term_id;
648	642
649		$wpdb->query(~~"INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', 'link_category', '', '0', '0')"~~);
	643	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES (%d, 'link_category', '', '0', '0')", $term_id) );
650	644	$tt_ids[$term_id] = (int) $wpdb->insert_id;
651	645	}
…	…
663	657	continue;
664	658
665		$wpdb->query(~~"INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ('$link->link_id', '$tt_id')"~~);
	659	$wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ( %d, %d)", $link->link_id, $tt_id) );
666	660	}
667	661
…	…
678	672	continue;
679	673
680		$wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES (~~'$link_id', '$tt_id')"~~);
	674	$wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ( %d, %d)", $link_id, $tt_id) );
681	675	}
682	676	}
…	…
691	685	foreach ( (array) $terms as $term ) {
692	686	if ( ('post_tag' == $term->taxonomy) \|\| ('category' == $term->taxonomy) )
693		$count = $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->term_relationships, $wpdb->posts WHERE $wpdb->posts.ID = $wpdb->term_relationships.object_id AND post_status = 'publish' AND post_type = 'post' AND term_taxonomy_id = '$term->term_taxonomy_id'");
	687	$count = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->term_relationships, $wpdb->posts WHERE $wpdb->posts.ID = $wpdb->term_relationships.object_id AND post_status = 'publish' AND post_type = 'post' AND term_taxonomy_id = %d", $term->term_taxonomy_id) );
694	688	else
695		$count = $wpdb->get_var(~~"SELECT COUNT(*) FROM $wpdb->term_relationships WHERE term_taxonomy_id = '$term->term_taxonomy_id'"~~);
696		$wpdb->query(~~"UPDATE $wpdb->term_taxonomy SET count = '$count' WHERE term_taxonomy_id = '$term->term_taxonomy_id'"~~);
	689	$count = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->term_relationships WHERE term_taxonomy_id = %d", $term->term_taxonomy_id) );
	690	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->term_taxonomy SET count = %d WHERE term_taxonomy_id = %d", $count, $term->term_taxonomy_id) );
697	691	}
698	692	}
…	…
824	818	}
825	819
826		$option = $wpdb->get_var(~~"SELECT option_value FROM $wpdb->options WHERE option_name = '$setting'"~~);
	820	$option = $wpdb->get_var( $wpdb->prepare("SELECT option_value FROM $wpdb->options WHERE option_name = %s", $setting) );
827	821
828	822	if ( 'home' == $setting && '' == $option )

trunk/wp-admin/includes/user.php

r7313	r7645
142	142	global $wpdb;
143	143	$level_key = $wpdb->prefix . 'user_level';
144
145		$query = "SELECT user_id FROM $wpdb->usermeta WHERE meta_key = '$level_key' AND meta_value != '0'";
146
147		return $wpdb->get_col( $query );
	144	return $wpdb->get_col( $wpdb->prepare("SELECT user_id FROM $wpdb->usermeta WHERE meta_key = %s AND meta_value != '0'", $level_key) );
148	145	}
149	146
…	…
177	174	$level_key = $wpdb->prefix . 'user_level';
178	175
179		$query = ~~"SELECT user_id FROM $wpdb->usermeta WHERE meta_key = '$level_key'"~~;
	176	$query = $wpdb->prepare("SELECT user_id FROM $wpdb->usermeta WHERE meta_key = %s", $level_key);
180	177	if ( $exclude_zeros )
181	178	$query .= " AND meta_value != '0'";
…	…
188	185	$level_key = $wpdb->prefix . 'user_level';
189	186
190		$query = "SELECT user_id FROM $wpdb->usermeta WHERE meta_key = '$level_key' AND meta_value = '0'";
191
192		return $wpdb->get_col( $query );
	187	return $wpdb->get_col( $wpdb->prepare("SELECT user_id FROM $wpdb->usermeta WHERE meta_key = %s AND meta_value = '0'", $level_key) );
193	188	}
194	189
…	…
209	204	} else {
210	205	$editable = join(',', $editable);
211		$other_unpubs = $wpdb->get_results(~~"SELECT ID, post_title, post_author FROM $wpdb->posts WHERE post_type = 'post' AND $type_sql AND post_author IN ($editable) AND post_author != '$user_id' ORDER BY post_modified $dir"~~);
	206	$other_unpubs = $wpdb->get_results( $wpdb->prepare("SELECT ID, post_title, post_author FROM $wpdb->posts WHERE post_type = 'post' AND $type_sql AND post_author IN ($editable) AND post_author != %d ORDER BY post_modified $dir", $user_id) );
212	207	}
213	208
…	…
242	237	function get_users_drafts( $user_id ) {
243	238	global $wpdb;
244		$user_id = (int) $user_id;
245		$query = "SELECT ID, post_title FROM $wpdb->posts WHERE post_type = 'post' AND post_status = 'draft' AND post_author = $user_id ORDER BY post_modified DESC";
	239	$query = $wpdb->prepare("SELECT ID, post_title FROM $wpdb->posts WHERE post_type = 'post' AND post_status = 'draft' AND post_author = %d ORDER BY post_modified DESC", $user_id);
246	240	$query = apply_filters('get_users_drafts', $query);
247	241	return $wpdb->get_results( $query );
…	…
254	248
255	249	if ($reassign == 'novalue') {
256		$post_ids = $wpdb->get_col(~~"SELECT ID FROM $wpdb->posts WHERE post_author = $id"~~);
	250	$post_ids = $wpdb->get_col( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_author = %d", $id) );
257	251
258	252	if ($post_ids) {
…	…
262	256
263	257	// Clean links
264		$wpdb->query(~~"DELETE FROM $wpdb->links WHERE link_owner = $id"~~);
	258	$wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->links WHERE link_owner = %d", $id) );
265	259	} else {
266	260	$reassign = (int) $reassign;
267		$wpdb->query(~~"UPDATE $wpdb->posts SET post_author = {$reassign} WHERE post_author = {$id}"~~);
268		$wpdb->query(~~"UPDATE $wpdb->links SET link_owner = {$reassign} WHERE link_owner = {$id}"~~);
	261	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_author = %d WHERE post_author = %d", $reassign, $id) );
	262	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->links SET link_owner = %d WHERE link_owner = %d}", $reassign, $id) );
269	263	}
270	264
…	…
272	266	do_action('delete_user', $id);
273	267
274		$wpdb->query(~~"DELETE FROM $wpdb->users WHERE ID = $id"~~);
275		$wpdb->query(~~"DELETE FROM $wpdb->usermeta WHERE user_id = '$id'"~~);
	268	$wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->users WHERE ID = %d", $id) );
	269	$wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->usermeta WHERE user_id = %d", $id) );
276	270
277	271	wp_cache_delete($id, 'users');
…	…
324	318	global $wpdb;
325	319	$this->first_user = ($this->page - 1) * $this->users_per_page;
326		$this->query_limit = ~~' LIMIT ' . $this->first_user . ',' . $this->users_per_page~~;
	320	$this->query_limit = $wpdb->prepare(" LIMIT %d, %d", $this->first_user, $this->users_per_page);
327	321	$this->query_sort = ' ORDER BY user_login';
328	322	$search_sql = '';
…	…
338	332	$this->query_from_where = "FROM $wpdb->users";
339	333	if ( $this->role )
340		$this->query_from_where .= ~~" INNER JOIN $wpdb->usermeta ON $wpdb->users.ID = $wpdb->usermeta.user_id WHERE $wpdb->usermeta.meta_key = '{$wpdb->prefix}capabilities' AND $wpdb->usermeta.meta_value LIKE '%$this->role%'"~~;
	334	$this->query_from_where .= $wpdb->prepare(" INNER JOIN $wpdb->usermeta ON $wpdb->users.ID = $wpdb->usermeta.user_id WHERE $wpdb->usermeta.meta_key = '{$wpdb->prefix}capabilities' AND $wpdb->usermeta.meta_value LIKE %s", '%' . $this->role . '%');
341	335	else
342	336	$this->query_from_where .= " WHERE 1=1";

trunk/wp-admin/update-links.php

r5843	r7645
37	37
38	38	foreach ($returns as $return) :
39		$time = ~~$wpdb->escape( substr($return, 0, 19)~~ );
40		$uri = ~~$wpdb->escape( preg_replace('/(.?) \| (.?)/', '$2', $return)~~ );
41		$wpdb->query(~~"UPDATE $wpdb->links SET link_updated = '$time' WHERE link_url = '$uri'"~~);
	39	$time = substr($return, 0, 19);
	40	$uri = preg_replace('/(.?) \| (.?)/', '$2', $return);
	41	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->links SET link_updated = %s WHERE link_url = %s", $time, $uri) );
42	42	endforeach;
43	43	}

trunk/wp-admin/upload.php

r7542	r7645
212	212	if ( 1 == count($posts) && is_singular() ) :
213	213
214		$comments = $wpdb->get_results(~~"SELECT * FROM $wpdb->comments WHERE comment_post_ID = $id AND comment_approved != 'spam' ORDER BY comment_date"~~);
	214	$comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved != 'spam' ORDER BY comment_date", $id) );
215	215	if ( $comments ) :
216	216	// Make sure comments, post, and post_author are cached

trunk/wp-comments-post.php

r6716	r7645
12	12	$comment_post_ID = (int) $_POST['comment_post_ID'];
13	13
14		$status = $wpdb->get_row(~~"SELECT post_status, comment_status FROM $wpdb->posts WHERE ID = '$comment_post_ID'"~~);
	14	$status = $wpdb->get_row( $wpdb->prepare("SELECT post_status, comment_status FROM $wpdb->posts WHERE ID = %d", $comment_post_ID) );
15	15
16	16	if ( empty($status->comment_status) ) {

trunk/wp-includes/comment.php

r7425	r7645
242	242	$where = '';
243	243	if ( $post_id > 0 ) {
244		$where = ~~"WHERE comment_post_ID = {$post_id}"~~;
	244	$where = $wpdb->prepare("WHERE comment_post_ID = %d", $post_id);
245	245	}
246	246
…	…
380	380	if ( current_user_can( 'manage_options' ) )
381	381	return; // don't throttle admins
382		if ( $lasttime = $wpdb->get_var(~~"SELECT comment_date_gmt FROM $wpdb->comments WHERE comment_author_IP = '$ip' OR comment_author_email = '$email' ORDER BY comment_date DESC LIMIT 1"~~) ) {
	382	if ( $lasttime = $wpdb->get_var( $wpdb->prepare("SELECT comment_date_gmt FROM $wpdb->comments WHERE comment_author_IP = %s OR comment_author_email = %s ORDER BY comment_date DESC LIMIT 1", $ip, $email) ) ) {
383	383	$time_lastcomment = mysql2date('U', $lasttime);
384	384	$time_newcomment = mysql2date('U', $date);
…	…
488	488	$comment = get_comment($comment_id);
489	489
490		if ( ! $wpdb->query(~~"DELETE FROM $wpdb->comments WHERE comment_ID='$comment_id' LIMIT 1"~~) )
	490	if ( ! $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->comments WHERE comment_ID = %d LIMIT 1", $comment_id) ) )
491	491	return false;
492	492
…	…
586	586	$user_id = 0;
587	587
588		$result = $wpdb->query("INSERT INTO $wpdb->comments
	588	$result = $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->comments
589	589	(comment_post_ID, comment_author, comment_author_email, comment_author_url, comment_author_IP, comment_date, comment_date_gmt, comment_content, comment_approved, comment_agent, comment_type, comment_parent, user_id)
590		VALUES
591		('$comment_post_ID', '$comment_author', '$comment_author_email', '$comment_author_url', '$comment_author_IP', '$comment_date', '$comment_date_gmt', '$comment_content', '$comment_approved', '$comment_agent', '$comment_type', '$comment_parent', '$user_id')
592		");
	590	VALUES (%d, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %d, %d)",
	591	$comment_post_ID, $comment_author, $comment_author_email, $comment_author_url, $comment_author_IP, $comment_date, $comment_date_gmt, $comment_content, $comment_approved, $comment_agent, $comment_type, $comment_parent, $user_id) );
593	592
594	593	$id = (int) $wpdb->insert_id;
…	…
715	714	switch ( $comment_status ) {
716	715	case 'hold':
717		$query = ~~"UPDATE $wpdb->comments SET comment_approved='0' WHERE comment_ID='$comment_id' LIMIT 1"~~;
	716	$query = $wpdb->prepare("UPDATE $wpdb->comments SET comment_approved='0' WHERE comment_ID = %d LIMIT 1", $comment_id);
718	717	break;
719	718	case 'approve':
720		$query = ~~"UPDATE $wpdb->comments SET comment_approved='1' WHERE comment_ID='$comment_id' LIMIT 1"~~;
	719	$query = $wpdb->prepare("UPDATE $wpdb->comments SET comment_approved='1' WHERE comment_ID = %d LIMIT 1", $comment_id);
721	720	break;
722	721	case 'spam':
723		$query = ~~"UPDATE $wpdb->comments SET comment_approved='spam' WHERE comment_ID='$comment_id' LIMIT 1"~~;
	722	$query = $wpdb->prepare("UPDATE $wpdb->comments SET comment_approved='spam' WHERE comment_ID = %d LIMIT 1", $comment_id);
724	723	break;
725	724	case 'delete':
…	…
775	774	$comment_date_gmt = get_gmt_from_date($comment_date);
776	775
777		$wpdb->query(
778		"UPDATE $wpdb->comments SET
779		comment_content = '$comment_content',
780		comment_author = '$comment_author',
781		comment_author_email = '$comment_author_email',
782		comment_approved = '$comment_approved',
783		comment_author_url = '$comment_author_url',
784		comment_date = '$comment_date',
785		comment_date_gmt = '$comment_date_gmt'
786		WHERE comment_ID = $comment_ID" );
	776	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->comments SET
	777	comment_content = %s,
	778	comment_author = %s,
	779	comment_author_email = %s,
	780	comment_approved = %s,
	781	comment_author_url = %s,
	782	comment_date = %s,
	783	comment_date_gmt = %s
	784	WHERE comment_ID = %d",
	785	$comment_content,
	786	$comment_author,
	787	$comment_author_email,
	788	$comment_approved,
	789	$comment_author_url,
	790	$comment_date,
	791	$comment_date_gmt
	792	$comment_ID) );
787	793
788	794	$rval = $wpdb->rows_affected;
…	…
880	886
881	887	$old = (int) $post->comment_count;
882		$new = (int) $wpdb->get_var(~~"SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = '$post_id' AND comment_approved = '1'"~~);
883		$wpdb->query(~~"UPDATE $wpdb->posts SET comment_count = '$new' WHERE ID = '$post_id'"~~);
	888	$new = (int) $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '1'", $post_id) );
	889	$wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET comment_count = %d WHERE ID = %d", $new, $post_id) );
884	890
885	891	if ( 'page' == $post->post_type )
…	…
1009	1015	// Do Enclosures
1010	1016	while ($enclosure = $wpdb->get_row("SELECT * FROM {$wpdb->posts}, {$wpdb->postmeta} WHERE {$wpdb->posts}.ID = {$wpdb->postmeta}.post_id AND {$wpdb->postmeta}.meta_key = '_encloseme' LIMIT 1")) {
1011		$wpdb->query(~~"DELETE FROM {$wpdb->postmeta} WHERE post_id = {$enclosure->ID} AND meta_key = '_encloseme';"~~);
	1017	$wpdb->query( $wpdb->prepare("DELETE FROM {$wpdb->postmeta} WHERE post_id = %d AND meta_key = '_encloseme';", $enclosure->ID) );
1012	1018	do_enclose($enclosure->post_content, $enclosure->ID);
1013	1019	}
…	…
1036	1042	global $wpdb;
1037	1043
1038		$post = $wpdb->get_row(~~"SELECT * FROM $wpdb->posts WHERE ID = $post_id"~~);
	1044	$post = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->posts WHERE ID = %d", $post_id) );
1039	1045	$to_ping = get_to_ping($post_id);
1040	1046	$pinged = get_pung($post_id);
1041	1047	if ( empty($to_ping) ) {
1042		$wpdb->quer

Navigation

Legend:

trunk/wp-admin/admin-ajax.php

trunk/wp-admin/edit-comments.php

trunk/wp-admin/edit-pages.php

trunk/wp-admin/edit.php

trunk/wp-admin/import/blogger.php

trunk/wp-admin/import/dotclear.php

trunk/wp-admin/import/textpattern.php

trunk/wp-admin/import/wp-cat2tag.php

trunk/wp-admin/includes/bookmark.php

trunk/wp-admin/includes/comment.php

trunk/wp-admin/includes/export.php

trunk/wp-admin/includes/post.php

trunk/wp-admin/includes/template.php

trunk/wp-admin/includes/upgrade.php

trunk/wp-admin/includes/user.php

trunk/wp-admin/update-links.php

trunk/wp-admin/upload.php

trunk/wp-comments-post.php

trunk/wp-includes/comment.php