Changeset 15340 for trunk/wp-admin/ms-edit.php

Timestamp:

06/27/2010 07:55:55 PM (14 years ago)

Author:

ryan

Message:

Use prepare(). Props Ben Ward.

File:

• trunk/wp-admin/ms-edit.php (modified) (2 diffs)

trunk/wp-admin/ms-edit.php

@@ -287 +287 @@
                 $_POST['role'] = $newroles[ $userid ];
                 if ( $pass != '' ) {
-                    $cap = $wpdb->get_var( "SELECT meta_value FROM {$wpdb->usermeta} WHERE user_id = '{$userid}' AND meta_key = '{$blog_prefix}capabilities' AND meta_value = 'a:0:{}'" );
+                    $cap = $wpdb->get_var( $wpdb->prepare( "SELECT meta_value FROM {$wpdb->usermeta} WHERE user_id = %d AND meta_key = '{$blog_prefix}capabilities' AND meta_value = 'a:0:{}'", $userid ) );
                     $userdata = get_userdata($userid);
                     $_POST['pass1'] = $_POST['pass2'] = $pass;
@@ -294 +294 @@
                     edit_user( $userid );
                     if ( $cap == null )
-                        $wpdb->query( "DELETE FROM {$wpdb->usermeta} WHERE user_id = '{$userid}' AND meta_key = '{$blog_prefix}capabilities' AND meta_value = 'a:0:{}'" );
+                        $wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->usermeta} WHERE user_id = %d AND meta_key = '{$blog_prefix}capabilities' AND meta_value = 'a:0:{}'", $userid ) );
                 }
             }