Changeset 3762

Timestamp:

05/04/2006 10:25:24 PM (20 years ago)

Author:

ryan

Message:

Add some prophylactic int casts and quoting.

Location:

branches/2.0/wp-includes

Files:

• comment-functions.php (modified) (1 diff)
• functions-post.php (modified) (3 diffs)
• links.php (modified) (1 diff)
• template-functions-general.php (modified) (1 diff)

branches/2.0/wp-includes/comment-functions.php

@@ -903 +903 @@
 function get_approved_comments($post_id) {
     global $wpdb;
+
+    $post_id = (int) $post_id;
     return $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $post_id AND comment_approved = '1' ORDER BY comment_date");
 }

branches/2.0/wp-includes/functions-post.php

@@ -353 +353 @@
     $postid = (int) $postid;
 
-    if ( !$post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID = $postid") )
+    if ( !$post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID = '$postid'") )
         return $post;
 
@@ -362 +362 @@
     $file = get_post_meta($postid, '_wp_attached_file', true);
 
-    $wpdb->query("DELETE FROM $wpdb->posts WHERE ID = $postid");
-
-    $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_post_ID = $postid");
-
-    $wpdb->query("DELETE FROM $wpdb->post2cat WHERE post_id = $postid");
-
-    $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = $postid");
+    $wpdb->query("DELETE FROM $wpdb->posts WHERE ID = '$postid'");
+
+    $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_post_ID = '$postid'");
+
+    $wpdb->query("DELETE FROM $wpdb->post2cat WHERE post_id = '$postid'");
+
+    $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$postid'");
 
     if ( ! empty($meta['thumb']) ) {
         // Don't delete the thumb if another attachment uses it
-        if (! $foo = $wpdb->get_row("SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE '%".$wpdb->escape($meta['thumb'])."%' AND post_id <> $postid"))
+        if (! $foo = $wpdb->get_row("SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE '%".$wpdb->escape($meta['thumb'])."%' AND post_id <> '$postid'"))
             @ unlink(str_replace(basename($file), $meta['thumb'], $file));
     }
@@ -457 +457 @@
     global $wpdb;
     
+    $post_ID = (int) $post_ID;
+
     $sql = "SELECT category_id 
         FROM $wpdb->post2cat 
-        WHERE post_id = $post_ID 
+        WHERE post_id = '$post_ID' 
         ORDER BY category_id";
 

branches/2.0/wp-includes/links.php

@@ -446 +446 @@
  */
 function get_linkcatname($id = 0) {
+    $id = (int) $id;
     global $wpdb;
     $cat_name = '';
-    if ('' != $id) {
+    if ( !empty($id) ) {
         $cat_name = $wpdb->get_var("SELECT cat_name FROM $wpdb->linkcategories WHERE cat_id=$id");
     }

branches/2.0/wp-includes/template-functions-general.php

@@ -510 +510 @@
     // Get days with posts
     $dayswithposts = $wpdb->get_results("SELECT DISTINCT DAYOFMONTH(post_date)
-        FROM $wpdb->posts WHERE MONTH(post_date) = $thismonth
-        AND YEAR(post_date) = $thisyear
+        FROM $wpdb->posts WHERE MONTH(post_date) = '$thismonth'
+        AND YEAR(post_date) = '$thisyear'
         AND post_status = 'publish'
         AND post_date < '" . current_time('mysql') . '\'', ARRAY_N);