WordPress.org

Make WordPress Core


Ignore:
Timestamp:
09/27/2007 07:34:15 AM (14 years ago)
Author:
markjaquith
Message:

prepare() for wp-includes/ bookmark.php, canonical.php, comment.php, comment-template.php. see #4553

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-includes/comment-template.php

    r6026 r6173  
    289289    // TODO: Use API instead of SELECTs.
    290290    if ( $user_ID) {
    291         $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post->ID' AND (comment_approved = '1' OR ( user_id = '$user_ID' AND comment_approved = '0' ) )  ORDER BY comment_date");
     291        $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND (comment_approved = '1' OR ( user_id = %d AND comment_approved = '0' ) )  ORDER BY comment_date", $post->ID, $user_ID));
    292292    } else if ( empty($comment_author) ) {
    293         $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post->ID' AND comment_approved = '1' ORDER BY comment_date");
     293        $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '1' ORDER BY comment_date", $post->ID));
    294294    } else {
    295         $author_db = $wpdb->escape($comment_author);
    296         $email_db  = $wpdb->escape($comment_author_email);
    297         $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post->ID' AND ( comment_approved = '1' OR ( comment_author = '$author_db' AND comment_author_email = '$email_db' AND comment_approved = '0' ) ) ORDER BY comment_date");
     295        $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND ( comment_approved = '1' OR ( comment_author = %s AND comment_author_email = %s AND comment_approved = '0' ) ) ORDER BY comment_date", $post->ID, $comment_author, $comment_author_email));
    298296    }
    299297
Note: See TracChangeset for help on using the changeset viewer.