Prepare queries using INSERT/UPDATE should use wpdb::insert() or wpdb::update()

Cheers! I think the best way to do it is one file at a time. That way a lot of people can participate without having to all share one big monster diff.

I think the best way to do it is one file at a time.

Yep, I agree with that. I might make a start over the weekend on some of them.

attachment 6836.diff added.

Note: There was a escaping issue with adding meta/updating meta, ' and " were being double escaped. Patch as such removes the double escpaping.

Also renamed a few variables so as to use compact('meta_value') instead of array('meta_value' => $metavalue,..). Just makes it look a bit more clean and keeps fields named the same throughout.

All Meta changes were tested working, The last chunk(Change to _relocate_children()) hasnt been tested, But i see no reason it should fail.

changes tested.

Tested with a New Install only; Upgrade functions not tested, Could do with an extra eye-over

remains of wp-admin/

/ and /wp-includes/ untested

Just noticed this: http://trac.wordpress.org/browser/trunk/wp-includes/functions.php#L527

532: $type = $wpdb->escape( $headers['content-type'] );
}}

I assume it was probably left over from when the raw query was there.. removed it in 6836.5-2.diff

About to add a full refreshed patch.

I've been running my local install patched like this for awhile, and not had any issues with escaped data.

also includes a logic inversion in the original patch for wp-includes/comment.php

Assigning to me for review and commit.

insert() and update() don't do prepare(). I would like to pass format specifiers to them somehow before moving everything over.

Replying to ryan:

insert() and update() don't do prepare(). I would like to pass format specifiers to them somehow before moving everything over.

How about something similar to this:

insert ('test_table', array('ID' => 's', 'post' => 'test'), array('ID' => '%d'));
creating:
INSERT INTO test_table (`ID`,`post`) VALUES ('0','test')

(See patch)

that could be changed to this to make it more compact:

foreach( (array)$types as $key => $type )
	if( isset($data[$key]) )
		$data[$key] = sprintf($type, $data[$key]);