WordPress.org
Get WordPress

Make WordPress Core

Changeset 6180


Ignore:
Timestamp:
10/02/2007 06:45:47 PM (19 years ago)
Author:
markjaquith
Message:

prepare() for wp-includes/ link-template.php, post.php, general-template.php, pluggable.php, functions.php. see #4553

Location:
trunk/wp-includes
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/wp-includes/functions.php

    r6153 r6180  
    200200                        if ( defined('WP_INSTALLING') )
    201201                                $wpdb->hide_errors();
     202                        // expected_slashed ($setting)
    202203                        $row = $wpdb->get_row("SELECT option_value FROM $wpdb->options WHERE option_name = '$setting' LIMIT 1");
    203204                        if ( defined('WP_INSTALLING') )
    … …  
    316317        }
    317318
    318         $newvalue = $wpdb->escape($newvalue);
    319         $option_name = $wpdb->escape($option_name);
    320         $wpdb->query("UPDATE $wpdb->options SET option_value = '$newvalue' WHERE option_name = '$option_name'");
     319        $wpdb->query($wpdb->prepare("UPDATE $wpdb->options SET option_value = %s WHERE option_name = %s", $newvalue, $option_name));
    321320        if ( $wpdb->rows_affected == 1 ) {
    322321                do_action("update_option_{$option_name}", $oldvalue, $_newvalue);
    … …  
    358357        }
    359358
    360         $name = $wpdb->escape($name);
    361         $value = $wpdb->escape($value);
    362         $wpdb->query("INSERT INTO $wpdb->options (option_name, option_value, autoload) VALUES ('$name', '$value', '$autoload')");
     359        $wpdb->query($wpdb->prepare("INSERT INTO $wpdb->options (option_name, option_value, autoload) VALUES (%s, %s, %s)", $name, $value, $autoload));
    363360
    364361        return;
    … …  
    371368
    372369        // Get the ID, if no ID then return
     370        // expected_slashed ($name)
    373371        $option = $wpdb->get_row("SELECT option_id, autoload FROM $wpdb->options WHERE option_name = '$name'");
    374372        if ( !$option->option_id ) return false;
     373        // expected_slashed ($name)
    375374        $wpdb->query("DELETE FROM $wpdb->options WHERE option_name = '$name'");
    376375        if ( 'yes' == $option->autoload ) {
    … …  
    515514
    516515        foreach ($post_links as $url) :
    517                 if ( $url != '' && !$wpdb->get_var("SELECT post_id FROM $wpdb->postmeta WHERE post_id = '$post_ID' AND meta_key = 'enclosure' AND meta_value LIKE ('$url%')") ) {
     516                if ( $url != '' && !$wpdb->get_var($wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = 'enclosure' AND meta_value LIKE (%s)", $post_ID, $url.'%')) ) {
    518517                        if ( $headers = wp_get_http_headers( $url) ) {
    519518                                $len = (int) $headers['content-length'];
    … …  
    522521                                if ( in_array( substr( $type, 0, strpos( $type, "/" ) ), $allowed_types ) ) {
    523522                                        $meta_value = "$url\n$len\n$type\n";
    524                                         $wpdb->query( "INSERT INTO `$wpdb->postmeta` ( `post_id` , `meta_key` , `meta_value` )
    525                                         VALUES ( '$post_ID', 'enclosure' , '$meta_value')" );
     523                                        $wpdb->query($wpdb->prepare("INSERT INTO `$wpdb->postmeta` ( `post_id` , `meta_key` , `meta_value` )
     524                                        VALUES ( %d, 'enclosure' , %s)", $post_ID, $meta_value));
    526525                                }
    527526                        }

  • trunk/wp-includes/general-template.php

    r6148 r6180  
    209209        if ( !empty($author_name) ) {
    210210                // We do a direct query here because we don't cache by nicename.
    211                 $title = $wpdb->get_var("SELECT display_name FROM $wpdb->users WHERE user_nicename = '$author_name'");
     211                $title = $wpdb->get_var($wpdb->prepare("SELECT display_name FROM $wpdb->users WHERE user_nicename = %s", $author_name));
    212212        }
    213213
    … …  
    256256        if ( intval($p) || '' != $name ) {
    257257                if ( !$p )
    258                         $p = $wpdb->get_var("SELECT ID FROM $wpdb->posts WHERE post_name = '$name'");
     258                        $p = $wpdb->get_var($wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_name = %s", $name));
    259259                $post = & get_post($p);
    260260                $title = $post->post_title;
    … …  
    364364
    365365        if ( '' != $limit ) {
    366                 $limit = (int) $limit;
     366                $limit = abs(intval($limit));
    367367                $limit = ' LIMIT '.$limit;
    368368        }

  • trunk/wp-includes/link-template.php

    r6152 r6180  
    368368                $join = " INNER JOIN $wpdb->term_relationships AS tr ON p.ID = tr.object_id ";
    369369                $cat_array = wp_get_object_terms($post->ID, 'category', 'fields=tt_ids');
    370                 $join .= ' AND (tr.term_taxonomy_id = ' . intval($cat_array[0]);
     370                $join .= $wpdb->prepare(' AND (tr.term_taxonomy_id = %d', $cat_array[0]);
    371371                for ( $i = 1; $i < (count($cat_array)); $i++ ) {
    372                         $join .= ' OR tr.term_taxonomy_id = ' . intval($cat_array[$i]);
     372                        $join .= $wpdb->prepare(' OR tr.term_taxonomy_id = %d', $cat_array[$i]);
    373373                }
    374374                $join .= ')';
    … …  
    383383
    384384        $join  = apply_filters( 'get_previous_post_join', $join, $in_same_cat, $excluded_categories );
    385         $where = apply_filters( 'get_previous_post_where', "WHERE p.post_date < '$current_post_date' AND p.post_type = 'post' AND p.post_status = 'publish' $posts_in_ex_cats_sql", $in_same_cat, $excluded_categories );
     385        $where = apply_filters( 'get_previous_post_where', $wpdb->prepare("WHERE p.post_date < %s AND p.post_type = 'post' AND p.post_status = 'publish' $posts_in_ex_cats_sql", $current_post_date), $in_same_cat, $excluded_categories );
    386386        $sort  = apply_filters( 'get_previous_post_sort', 'ORDER BY p.post_date DESC LIMIT 1' );
    387387
    … …  
    401401                $join = " INNER JOIN $wpdb->term_relationships AS tr ON p.ID = tr.object_id ";
    402402                $cat_array = wp_get_object_terms($post->ID, 'category', 'fields=tt_ids');
    403                 $join .= ' AND (tr.term_taxonomy_id = ' . intval($cat_array[0]);
     403                $join .= $wpdb->prepare(' AND (tr.term_taxonomy_id = %d', $cat_array[0]);
    404404                for ( $i = 1; $i < (count($cat_array)); $i++ ) {
    405                         $join .= ' OR tr.term_taxonomy_id = ' . intval($cat_array[$i]);
     405                        $join .= $wpdb->prepare(' OR tr.term_taxonomy_id = $d', $cat_array[$i]);
    406406                }
    407407                $join .= ')';
    … …  
    416416
    417417        $join  = apply_filters( 'get_next_post_join', $join, $in_same_cat, $excluded_categories );
    418         $where = apply_filters( 'get_next_post_where', "WHERE p.post_date > '$current_post_date' AND p.post_type = 'post' AND p.post_status = 'publish' $posts_in_ex_cats_sql AND p.ID != $post->ID", $in_same_cat, $excluded_categories );
     418        $where = apply_filters( 'get_next_post_where', $wpdb->prepare("WHERE p.post_date > %s AND p.post_type = 'post' AND p.post_status = 'publish' $posts_in_ex_cats_sql AND p.ID != %d", $current_post_date, $post->ID), $in_same_cat, $excluded_categories );
    419419        $sort  = apply_filters( 'get_next_post_sort', 'ORDER BY p.post_date ASC LIMIT 1' );
    420420

  • trunk/wp-includes/pluggable.php

    r6145 r6180  
    6161function get_userdata( $user_id ) {
    6262        global $wpdb;
    63         $user_id = (int) $user_id;
     63        $user_id = abs(intval($user_id));
    6464        if ( $user_id == 0 )
    6565                return false;
    … …  
    7070                return $user;
    7171
    72         if ( !$user = $wpdb->get_row("SELECT * FROM $wpdb->users WHERE ID = '$user_id' LIMIT 1") )
     72        if ( !$user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE ID = %d LIMIT 1", $user_id)) )
    7373                return false;
    7474
    7575        $wpdb->hide_errors();
    76         $metavalues = $wpdb->get_results("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = '$user_id'");
     76        $metavalues = $wpdb->get_results($wpdb->prepare("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = %d", $user_id));
    7777        $wpdb->show_errors();
    7878
    … …  
    122122                return $userdata;
    123123
    124         $user_login = $wpdb->escape($user_login);
    125 
    126         if ( !$user_ID = $wpdb->get_var("SELECT ID FROM $wpdb->users WHERE user_login = '$user_login'") )
     124        if ( !$user_ID = $wpdb->get_var($wpdb->prepare("SELECT ID FROM $wpdb->users WHERE user_login = %s", $user_login)) )
    127125                return false;
    128126
    … …  
    580578                return true;
    581579
    582         $comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID='$comment_id' LIMIT 1");
    583         $post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID='$comment->comment_post_ID' LIMIT 1");
     580        $comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_ID=%d LIMIT 1", $comment_id));
     581        $post = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->posts WHERE ID=%d LIMIT 1", $comment->comment_post_ID));
    584582
    585583        $comment_author_domain = @gethostbyaddr($comment->comment_author_IP);

  • trunk/wp-includes/post.php

    r6155 r6180  
    114114                        return get_page($_post, $output);
    115115                else {
    116                         $query = "SELECT * FROM $wpdb->posts WHERE ID = '$post' LIMIT 1";
    117                         $_post = & $wpdb->get_row($query);
     116                        $_post = & $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->posts WHERE ID = %d LIMIT 1", $post));
    118117                        if ( 'page' == $_post->post_type )
    119118                                return get_page($_post, $output);
    … …  
    224223                        foreach ( $incposts as $incpost ) {
    225224                                if (empty($inclusions))
    226                                         $inclusions = ' AND ( ID = ' . intval($incpost) . ' ';
     225                                        $inclusions = $wpdb->prepare(' AND ( ID = %d ', $incpost);
    227226                                else
    228                                         $inclusions .= ' OR ID = ' . intval($incpost) . ' ';
     227                                        $inclusions .= $wpdb->prepare(' OR ID = %d ', $incpost);
    229228                        }
    230229                }
    … …  
    239238                        foreach ( $exposts as $expost ) {
    240239                                if (empty($exclusions))
    241                                         $exclusions = ' AND ( ID <> ' . intval($expost) . ' ';
     240                                        $exclusions = $wpdb->prepare(' AND ( ID <> %d ', $expost);
    242241                                else
    243                                         $exclusions .= ' AND ID <> ' . intval($expost) . ' ';
     242                                        $exclusions .= $wpdb->prepare(' AND ID <> %d ', $expost);
    244243                        }
    245244                }
    … …  
    252251        $query .= empty( $meta_key ) ? '' : ", $wpdb->postmeta ";
    253252        $query .= " WHERE 1=1 ";
    254         $query .= empty( $post_type ) ? '' : "AND post_type = '$post_type' ";
    255         $query .= empty( $post_status ) ? '' : "AND post_status = '$post_status' ";
     253        $query .= empty( $post_type ) ? '' : $wpdb->prepare("AND post_type = %s ", $post_type);
     254        $query .= empty( $post_status ) ? '' : $wpdb->prepare("AND post_status = %s ", $post_status);
    256255        $query .= "$exclusions $inclusions " ;
    257         $query .= empty( $category ) ? '' : "AND ($wpdb->posts.ID = $wpdb->term_relationships.object_id AND $wpdb->term_relationships.term_taxonomy_id = $wpdb->term_taxonomy.term_taxonomy_id AND $wpdb->term_taxonomy.term_id = " . $category. ") ";
    258         $query .= empty( $post_parent ) ? '' : "AND $wpdb->posts.post_parent = '$post_parent' ";
     256        $query .= empty( $category ) ? '' : $wpdb->prepare("AND ($wpdb->posts.ID = $wpdb->term_relationships.object_id AND $wpdb->term_relationships.term_taxonomy_id = $wpdb->term_taxonomy.term_taxonomy_id AND $wpdb->term_taxonomy.term_id = %d) ", $category);
     257        $query .= empty( $post_parent ) ? '' : $wpdb->prepare("AND $wpdb->posts.post_parent = %d ", $post_parent);
     258        // expected_slashed ($meta_key, $meta_value) -- Also, this looks really funky, doesn't seem like it works
    259259        $query .= empty( $meta_key ) | empty($meta_value)  ? '' : " AND ($wpdb->posts.ID = $wpdb->postmeta.post_id AND $wpdb->postmeta.meta_key = '$meta_key' AND $wpdb->postmeta.meta_value = '$meta_value' )";
    260260        $query .= " GROUP BY $wpdb->posts.ID ORDER BY " . $orderby . ' ' . $order;
    261261        if ( 0 < $numberposts )
    262                 $query .= " LIMIT " . $offset . ',' . $numberposts;
     262                $query .= $wpdb->prepare(" LIMIT %d,%d", $offset, $numberposts);
    263263
    264264        $posts = $wpdb->get_results($query);
    … …  
    276276        global $wpdb, $post_meta_cache, $blog_id;
    277277
    278         $post_id = (int) $post_id;
    279 
    280278        if ( $unique ) {
    281                 if ( $wpdb->get_var("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = '$key' AND post_id = '$post_id'") ) {
     279                // expected_slashed ($key)
     280                if ( $wpdb->get_var($wpdb->prepare("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = '$key' AND post_id = %d", $post_id)) ) {
    282281                        return false;
    283282                }
    … …  
    287286
    288287        $value = maybe_serialize($value);
    289         $value = $wpdb->escape($value);
    290 
    291         $wpdb->query("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value) VALUES ('$post_id','$key','$value')");
     288
     289        // expected_slashed ($key)
     290        $wpdb->query($wpdb->prepare("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value) VALUES (%d,'$key',%s)", $post_id, $value));
    292291
    293292        return true;
    … …  
    297296        global $wpdb, $post_meta_cache, $blog_id;
    298297
    299         $post_id = (int) $post_id;
    300 
    301298        if ( empty($value) ) {
    302                 $meta_id = $wpdb->get_var("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key'");
    303         } else {
    304                 $meta_id = $wpdb->get_var("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key' AND meta_value = '$value'");
     299                // expected_slashed ($key)
     300                $meta_id = $wpdb->get_var($wpdb->prepare("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = '$key'", $post_id));
     301        } else {
     302                // expected_slashed ($key, $value)
     303                $meta_id = $wpdb->get_var($wpdb->prepare("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = '$key' AND meta_value = '$value'", $post_id));
    305304        }
    306305
    … …  
    309308
    310309        if ( empty($value) ) {
    311                 $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key'");
     310                // expected_slashed ($key)
     311                $wpdb->query($wpdb->prepare("DELETE FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = '$key'", $post_id));
    312312                unset($post_meta_cache[$blog_id][$post_id][$key]);
    313313        } else {
    314                 $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key' AND meta_value = '$value'");
     314                // expected_slashed ($key, $value)
     315                $wpdb->query($wpdb->prepare("DELETE FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = '$key' AND meta_value = '$value'", $post_id));
    315316                $cache_key = $post_meta_cache[$blog_id][$post_id][$key];
    316317                if ($cache_key) foreach ( $cache_key as $index => $data )
    … …  
    353354        global $wpdb, $post_meta_cache, $blog_id;
    354355
    355         $post_id = (int) $post_id;
    356 
    357356        $original_value = $value;
    358357        $value = maybe_serialize($value);
    359         $value = $wpdb->escape($value);
    360358
    361359        $original_prev = $prev_value;
    362360        $prev_value = maybe_serialize($prev_value);
    363         $prev_value = $wpdb->escape($prev_value);
    364 
    365         if (! $wpdb->get_var("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = '$key' AND post_id = '$post_id'") ) {
     361
     362        // expected_slashed ($key)
     363        if (! $wpdb->get_var($wpdb->prepare("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = '$key' AND post_id = %d", $post_id)) ) {
    366364                return false;
    367365        }
    368366
    369367        if ( empty($prev_value) ) {
    370                 $wpdb->query("UPDATE $wpdb->postmeta SET meta_value = '$value' WHERE meta_key = '$key' AND post_id = '$post_id'");
     368                // expected_slashed ($key)
     369                $wpdb->query($wpdb->prepare("UPDATE $wpdb->postmeta SET meta_value = %s WHERE meta_key = '$key' AND post_id = %d", $value, $post_id));
    371370                $cache_key = $post_meta_cache[$blog_id][$post_id][$key];
    372371                if ( !empty($cache_key) )
    … …  
    374373                                $post_meta_cache[$blog_id][$post_id][$key][$index] = $original_value;
    375374        } else {
    376                 $wpdb->query("UPDATE $wpdb->postmeta SET meta_value = '$value' WHERE meta_key = '$key' AND post_id = '$post_id' AND meta_value = '$prev_value'");
     375                // expected_slashed ($key)
     376                $wpdb->query($wpdb->prepare("UPDATE $wpdb->postmeta SET meta_value = %s WHERE meta_key = '$key' AND post_id = %d AND meta_value = %s", $value, $post_id, $prev_value));
    377377                $cache_key = $post_meta_cache[$blog_id][$post_id][$key];
    378378                if ( !empty($cache_key) )
    … …  
    388388function delete_post_meta_by_key($post_meta_key) {
    389389        global $wpdb, $post_meta_cache, $blog_id;
    390         $post_meta_key = $wpdb->escape($post_meta_key);
    391         if ( $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = '$post_meta_key'") ) {
     390        if ( $wpdb->query($wpdb->prepare("DELETE FROM $wpdb->postmeta WHERE meta_key = %s", $post_meta_key)) ) {
    392391                unset($post_meta_cache[$blog_id]); // not worth doing the work to iterate through the cache
    393392                return true;
    … …  
    505504function wp_delete_post($postid = 0) {
    506505        global $wpdb, $wp_rewrite;
    507         $postid = (int) $postid;
    508 
    509         if ( !$post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID = $postid") )
     506
     507        if ( !$post = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->posts WHERE ID = %d", $postid)) )
    510508                return $post;
    511509
    … …  
    519517
    520518        if ( 'page' == $post->post_type )
    521                 $wpdb->query("UPDATE $wpdb->posts SET post_parent = $post->post_parent WHERE post_parent = $postid AND post_type = 'page'");
    522 
    523         $wpdb->query("UPDATE $wpdb->posts SET post_parent = $post->post_parent WHERE post_parent = $postid AND post_type = 'attachment'");
    524 
    525         $wpdb->query("DELETE FROM $wpdb->posts WHERE ID = $postid");
    526 
    527         $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_post_ID = $postid");
    528 
    529         $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = $postid");
     519                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_parent = $post->post_parent WHERE post_parent = %d AND post_type = 'page'", $postid ));
     520
     521        $wpdb->query( $wpdb->prepare( "UPDATE $wpdb->posts SET post_parent = %s WHERE post_parent = %d AND post_type = 'attachment'", $post->post_parent, $postid ));
     522
     523        $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->posts WHERE ID = %d", $postid ));
     524
     525        $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->comments WHERE comment_post_ID = %d", $postid ));
     526
     527        $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->postmeta WHERE post_id = %d", $postid ));
    530528
    531529        if ( 'page' == $post->post_type ) {
    … …  
    695693
    696694        if ( 'draft' != $post_status ) {
    697                 $post_name_check = $wpdb->get_var("SELECT post_name FROM $wpdb->posts WHERE post_name = '$post_name' AND post_type = '$post_type' AND ID != '$post_ID' AND post_parent = '$post_parent' LIMIT 1");
     695                // expected_slashed ($post_name, $post_type)
     696                $post_name_check = $wpdb->get_var($wpdb->prepare("SELECT post_name FROM $wpdb->posts WHERE post_name = '$post_name' AND post_type = '$post_type' AND ID != %d AND post_parent = %d LIMIT 1", $post_ID, $post_parent));
    698697
    699698                if ($post_name_check || in_array($post_name, $wp_rewrite->feeds) ) {
    … …  
    701700                        do {
    702701                                $alt_post_name = substr($post_name, 0, 200-(strlen($suffix)+1)). "-$suffix";
    703                                 $post_name_check = $wpdb->get_var("SELECT post_name FROM $wpdb->posts WHERE post_name = '$alt_post_name' AND post_type = '$post_type' AND ID != '$post_ID' AND post_parent = '$post_parent' LIMIT 1");
     702                                // expected_slashed ($alt_post_name, $post_name, $post_type)
     703                                $post_name_check = $wpdb->get_var($wpdb->prepare("SELECT post_name FROM $wpdb->posts WHERE post_name = '$alt_post_name' AND post_type = '$post_type' AND ID != %d AND post_parent = %d LIMIT 1", $post_ID, $post_parent));
    704704                                $suffix++;
    705705                        } while ($post_name_check);
    … …  
    709709
    710710        if ($update) {
     711                // expected_slashed (everything!)
    711712                $wpdb->query(
     713                        $wpdb->prepare(
    712714                        "UPDATE IGNORE $wpdb->posts SET
    713715                        post_author = '$post_author',
    … …  
    728730                        post_modified = '".current_time('mysql')."',
    729731                        post_modified_gmt = '".current_time('mysql',1)."',
    730                         post_parent = '$post_parent',
     732                        post_parent = %d,
    731733                        menu_order = '$menu_order'
    732                         WHERE ID = $post_ID");
    733         } else {
     734                        WHERE ID = %d"
     735                        , $post_parent, $post_ID ));
     736        } else {
     737                // expected_slashed (everything!)
    734738                $wpdb->query(
     739                        $wpdb->prepare(
    735740                        "INSERT IGNORE INTO $wpdb->posts
    736741                        (post_author, post_date, post_date_gmt, post_content, post_content_filtered, post_title, post_excerpt,  post_status, post_type, comment_status, ping_status, post_password, post_name, to_ping, pinged, post_modified, post_modified_gmt, post_parent, menu_order, post_mime_type)
    737742                        VALUES
    738                         ('$post_author', '$post_date', '$post_date_gmt', '$post_content', '$post_content_filtered', '$post_title', '$post_excerpt', '$post_status', '$post_type', '$comment_status', '$ping_status', '$post_password', '$post_name', '$to_ping', '$pinged', '$post_date', '$post_date_gmt', '$post_parent', '$menu_order', '$post_mime_type')");
     743                        ('$post_author', '$post_date', '$post_date_gmt', '$post_content', '$post_content_filtered', '$post_title', '$post_excerpt', '$post_status', '$post_type', '$comment_status', '$ping_status', '$post_password', '$post_name', '$to_ping', '$pinged', '$post_date', '$post_date_gmt', %d, '$menu_order', '$post_mime_type')", $post_parent));
    739744                        $post_ID = (int) $wpdb->insert_id;
    740745        }
    … …  
    742747        if ( empty($post_name) && 'draft' != $post_status ) {
    743748                $post_name = sanitize_title($post_title, $post_ID);
    744                 $wpdb->query( "UPDATE $wpdb->posts SET post_name = '$post_name' WHERE ID = '$post_ID'" );
     749                // expected_slashed ($post_name)
     750                $wpdb->query($wpdb->prepare("UPDATE $wpdb->posts SET post_name = '$post_name' WHERE ID = %d", $post_ID));
    745751        }
    746752
    … …  
    756762        // Set GUID
    757763        if ( ! $update )
    758                 $wpdb->query("UPDATE $wpdb->posts SET guid = '" . get_permalink($post_ID) . "' WHERE ID = '$post_ID'");
     764                $wpdb->query( $wpdb->prepare( "UPDATE $wpdb->posts SET guid = %s WHERE ID = %d", get_permalink($post_ID), $post_ID ));
    759765
    760766        $post = get_post($post_ID);
    … …  
    824830                return;
    825831
    826         $wpdb->query( "UPDATE $wpdb->posts SET post_status = 'publish' WHERE ID = '$post_id'" );
     832        $wpdb->query( $wpdb->prepare( "UPDATE $wpdb->posts SET post_status = 'publish' WHERE ID = %d", $post_id ));
    827833
    828834        $old_status = $post->post_status;
    … …  
    884890function add_ping($post_id, $uri) { // Add a URL to those already pung
    885891        global $wpdb;
    886         $pung = $wpdb->get_var("SELECT pinged FROM $wpdb->posts WHERE ID = $post_id");
     892        $pung = $wpdb->get_var( $wpdb->prepare( "SELECT pinged FROM $wpdb->posts WHERE ID = %d", $post_id ));
    887893        $pung = trim($pung);
    888894        $pung = preg_split('/\s/', $pung);
    … …  
    890896        $new = implode("\n", $pung);
    891897        $new = apply_filters('add_ping', $new);
    892         return $wpdb->query("UPDATE $wpdb->posts SET pinged = '$new' WHERE ID = $post_id");
     898        // expected_slashed ($new)
     899        return $wpdb->query( $wpdb->prepare( "UPDATE $wpdb->posts SET pinged = '$new' WHERE ID = %d", $post_id ));
    893900}
    894901
    … …  
    914921function get_pung($post_id) { // Get URLs already pung for a post
    915922        global $wpdb;
    916         $pung = $wpdb->get_var("SELECT pinged FROM $wpdb->posts WHERE ID = $post_id");
     923        $pung = $wpdb->get_var( $wpdb->prepare( "SELECT pinged FROM $wpdb->posts WHERE ID = %d", $post_id ));
    917924        $pung = trim($pung);
    918925        $pung = preg_split('/\s/', $pung);
    … …  
    923930function get_to_ping($post_id) { // Get any URLs in the todo list
    924931        global $wpdb;
    925         $to_ping = $wpdb->get_var("SELECT to_ping FROM $wpdb->posts WHERE ID = $post_id");
     932        $to_ping = $wpdb->get_var( $wpdb->prepare( "SELECT to_ping FROM $wpdb->posts WHERE ID = %d", $post_id ));
    926933        $to_ping = trim($to_ping);
    927934        $to_ping = preg_split('/\s/', $to_ping, -1, PREG_SPLIT_NO_EMPTY);
    … …  
    10021009                        } else { // it's not in any caches, so off to the DB we go
    10031010                                // Why are we using assignment for this query?
    1004                                 $_page = & $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID= '$page' LIMIT 1");
     1011                                $_page = & $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->posts WHERE ID= %d LIMIT 1", $page ));
    10051012                                if ( 'post' == $_page->post_type )
    10061013                                        return get_post($_page, $output);
    … …  
    10361043                $full_path .= ($pathdir!=''?'/':'') . sanitize_title($pathdir);
    10371044
    1038         $pages = $wpdb->get_results("SELECT ID, post_name, post_parent FROM $wpdb->posts WHERE post_name = '$leaf_path' AND post_type='page'");
     1045        $pages = $wpdb->get_results( $wpdb->prepare( "SELECT ID, post_name, post_parent FROM $wpdb->posts WHERE post_name = %s AND post_type='page'", $leaf_path ));
    10391046
    10401047        if ( empty($pages) )
    … …  
    10451052                $curpage = $page;
    10461053                while ($curpage->post_parent != 0) {
    1047                         $curpage = $wpdb->get_row("SELECT ID, post_name, post_parent FROM $wpdb->posts WHERE ID = '$curpage->post_parent' and post_type='page'");
     1054                        $curpage = $wpdb->get_row( $wpdb->prepare( "SELECT ID, post_name, post_parent FROM $wpdb->posts WHERE ID = %d and post_type='page'", $curpage->post_parent ));
    10481055                        $path = '/' . $curpage->post_name . $path;
    10491056                }
    … …  
    10581065function get_page_by_title($page_title, $output = OBJECT) {
    10591066        global $wpdb;
    1060         $page_title = $wpdb->escape($page_title);
    1061         $page = $wpdb->get_var("SELECT ID FROM $wpdb->posts WHERE post_title = '$page_title' AND post_type='page'");
     1067        $page = $wpdb->get_var( $wpdb->prepare( "SELECT ID FROM $wpdb->posts WHERE post_title = %s AND post_type='page'", $page_title ));
    10621068        if ( $page )
    10631069                return get_page($page, $output);
    … …  
    11421148                        foreach ( $incpages as $incpage ) {
    11431149                                if (empty($inclusions))
    1144                                         $inclusions = ' AND ( ID = ' . intval($incpage) . ' ';
     1150                                        $inclusions = $wpdb->prepare(' AND ( ID = %d ', $incpage);
    11451151                                else
    1146                                         $inclusions .= ' OR ID = ' . intval($incpage) . ' ';
     1152                                        $inclusions .= $wpdb->prepare(' OR ID = %d ', $incpage);
    11471153                        }
    11481154                }
    … …  
    11571163                        foreach ( $expages as $expage ) {
    11581164                                if (empty($exclusions))
    1159                                         $exclusions = ' AND ( ID <> ' . intval($expage) . ' ';
     1165                                        $exclusions = $wpdb->prepare(' AND ( ID <> %d ', $expage);
    11601166                                else
    1161                                         $exclusions .= ' AND ID <> ' . intval($expage) . ' ';
     1167                                        $exclusions .= $wpdb->prepare(' AND ID <> %d ', $expage);
    11621168                        }
    11631169                }
    … …  
    11831189
    11841190                                if ( '' == $author_query )
    1185                                         $author_query = ' post_author = ' . intval($post_author) . ' ';
     1191                                        $author_query = $wpdb->prepare(' post_author = %d ', $post_author);
    11861192                                else
    1187                                         $author_query .= ' OR post_author = ' . intval($post_author) . ' ';
     1193                                        $author_query .= $wpdb->prepare(' OR post_author = %d ', $post_author);
    11881194                        }
    11891195                        if ( '' != $author_query )
    … …  
    11951201        $query .= ( empty( $meta_key ) ? "" : ", $wpdb->postmeta " ) ;
    11961202        $query .= " WHERE (post_type = 'page' AND post_status = 'publish') $exclusions $inclusions " ;
     1203        // expected_slashed ($meta_key, $meta_value) -- also, it looks funky
    11971204        $query .= ( empty( $meta_key ) | empty($meta_value)  ? "" : " AND ($wpdb->posts.ID = $wpdb->postmeta.post_id AND $wpdb->postmeta.meta_key = '$meta_key' AND $wpdb->postmeta.meta_value = '$meta_value' )" ) ;
    11981205        $query .= $author_query;
    … …  
    12351242                        // URL => page name
    12361243                        $uri = get_page_uri($id);
    1237                         $attachments = $wpdb->get_results("SELECT ID, post_name, post_parent FROM $wpdb->posts WHERE post_type = 'attachment' AND post_parent = '$id'");
     1244                        $attachments = $wpdb->get_results( $wpdb->prepare( "SELECT ID, post_name, post_parent FROM $wpdb->posts WHERE post_type = 'attachment' AND post_parent = %d", $id ));
    12381245                        if ( $attachments ) {
    12391246                                foreach ( $attachments as $attachment ) {
    … …  
    13131320                $post_name = sanitize_title($post_name);
    13141321
     1322        // expected_slashed ($post_name)
    13151323        $post_name_check =
    1316                 $wpdb->get_var("SELECT post_name FROM $wpdb->posts WHERE post_name = '$post_name' AND post_status = 'inherit' AND ID != '$post_ID' LIMIT 1");
     1324                $wpdb->get_var( $wpdb->prepare( "SELECT post_name FROM $wpdb->posts WHERE post_name = '$post_name' AND post_status = 'inherit' AND ID != %d LIMIT 1", $post_ID));
    13171325
    13181326        if ($post_name_check) {
    … …  
    13201328                while ($post_name_check) {
    13211329                        $alt_post_name = $post_name . "-$suffix";
    1322                         $post_name_check = $wpdb->get_var("SELECT post_name FROM $wpdb->posts WHERE post_name = '$alt_post_name' AND post_status = 'inherit' AND ID != '$post_ID' AND post_parent = '$post_parent' LIMIT 1");
     1330                        // expected_slashed ($alt_post_name, $post_name)
     1331                        $post_name_check = $wpdb->get_var( $wpdb->prepare( "SELECT post_name FROM $wpdb->posts WHERE post_name = '$alt_post_name' AND post_status = 'inherit' AND ID != %d AND post_parent = %d LIMIT 1", $post_ID, $post_parent));
    13231332                        $suffix++;
    13241333                }
    … …  
    13621371
    13631372        if ($update) {
     1373                // expected_slashed (everything!)
    13641374                $wpdb->query(
     1375                        $wpdb->prepare(
    13651376                        "UPDATE $wpdb->posts SET
    13661377                        post_author = '$post_author',
    … …  
    13811392                        post_modified = '".current_time('mysql')."',
    13821393                        post_modified_gmt = '".current_time('mysql',1)."',
    1383                         post_parent = '$post_parent',
     1394                        post_parent = %d,
    13841395                        menu_order = '$menu_order',
    13851396                        post_mime_type = '$post_mime_type',
    13861397                        guid = '$guid'
    1387                         WHERE ID = $post_ID");
    1388         } else {
     1398                        WHERE ID = %d", $post_parent, $post_ID));
     1399        } else {
     1400                // expected_slashed (everything!)
    13891401                $wpdb->query(
     1402                        $wpdb->prepare(
    13901403                        "INSERT INTO $wpdb->posts
    13911404                        (post_author, post_date, post_date_gmt, post_content, post_content_filtered, post_title, post_excerpt,  post_status, post_type, comment_status, ping_status, post_password, post_name, to_ping, pinged, post_modified, post_modified_gmt, post_parent, menu_order, post_mime_type, guid)
    13921405                        VALUES
    1393                         ('$post_author', '$post_date', '$post_date_gmt', '$post_content', '$post_content_filtered', '$post_title', '$post_excerpt', '$post_status', '$post_type', '$comment_status', '$ping_status', '$post_password', '$post_name', '$to_ping', '$pinged', '$post_date', '$post_date_gmt', '$post_parent', '$menu_order', '$post_mime_type', '$guid')");
     1406                        ('$post_author', '$post_date', '$post_date_gmt', '$post_content', '$post_content_filtered', '$post_title', '$post_excerpt', '$post_status', '$post_type', '$comment_status', '$ping_status', '$post_password', '$post_name', '$to_ping', '$pinged', '$post_date', '$post_date_gmt', %d, '$menu_order', '$post_mime_type', '$guid')", $post_parent ));
    13941407                        $post_ID = (int) $wpdb->insert_id;
    13951408        }
    … …  
    13971410        if ( empty($post_name) ) {
    13981411                $post_name = sanitize_title($post_title, $post_ID);
    1399                 $wpdb->query( "UPDATE $wpdb->posts SET post_name = '$post_name' WHERE ID = '$post_ID'" );
     1412                // expected_slashed ($post_name)
     1413                $wpdb->query( $wpdb->prepare( "UPDATE $wpdb->posts SET post_name = '$post_name' WHERE ID = %d", $post_ID));
    14001414        }
    14011415
    … …  
    14181432function wp_delete_attachment($postid) {
    14191433        global $wpdb;
    1420         $postid = (int) $postid;
    1421 
    1422         if ( !$post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID = '$postid'") )
     1434
     1435        if ( !$post = $wpdb->get_row(  $wpdb->prepare( "SELECT * FROM $wpdb->posts WHERE ID = %d", $postid)) )
    14231436                return $post;
    14241437
    … …  
    14321445        wp_delete_object_term_relationships($postid, array('category', 'post_tag'));
    14331446
    1434         $wpdb->query("DELETE FROM $wpdb->posts WHERE ID = '$postid'");
    1435 
    1436         $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_post_ID = '$postid'");
    1437 
    1438         $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$postid'");
     1447        $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->posts WHERE ID = %d", $postid ));
     1448
     1449        $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->comments WHERE comment_post_ID = %d", $postid ));
     1450
     1451        $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->postmeta WHERE post_id = %d ", $postid ));
    14391452
    14401453        if ( ! empty($meta['thumb']) ) {
    14411454                // Don't delete the thumb if another attachment uses it
    1442                 if (! $wpdb->get_row("SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE '%".$wpdb->escape($meta['thumb'])."%' AND post_id <> $postid")) {
     1455                if (! $wpdb->get_row( $wpdb->prepare( "SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE %s AND post_id <> %d", '%'.$meta['thumb'].'%', $postid)) ) {
    14431456                        $thumbfile = str_replace(basename($file), $meta['thumb'], $file);
    14441457                        $thumbfile = apply_filters('wp_delete_file', $thumbfile);
    … …  
    18321845        if ( $old_status != 'publish' && $new_status == 'publish' ) {
    18331846                        // Reset GUID if transitioning to publish.
    1834                         $wpdb->query("UPDATE $wpdb->posts SET guid = '" . get_permalink($post->ID) . "' WHERE ID = '$post->ID'");
     1847                        $wpdb->query( $wpdb->prepare( "UPDATE $wpdb->posts SET guid = %s WHERE ID = %d", get_permalink($post->ID), $post->ID ));
    18351848                        do_action('private_to_published', $post->ID);  // Deprecated, use private_to_publish
    18361849        }
    … …  
    18601873
    18611874        if ( get_option('default_pingback_flag') )
    1862                 $result = $wpdb->query("
     1875                $result = $wpdb->query( $wpdb->prepare( "
    18631876                        INSERT INTO $wpdb->postmeta
    18641877                        (post_id,meta_key,meta_value)
    1865                         VALUES ('$post_id','_pingme','1')
    1866                 ");
    1867         $result = $wpdb->query("
     1878                        VALUES (%s,'_pingme','1')
     1879                ", $post_id ));
     1880        $result = $wpdb->query( $wpdb->prepare( "
    18681881                INSERT INTO $wpdb->postmeta
    18691882                (post_id,meta_key,meta_value)
    1870                 VALUES ('$post_id','_encloseme','1')
    1871         ");
     1883                VALUES (%s,'_encloseme','1')
     1884        ", $post_id ));
    18721885        wp_schedule_single_event(time(), 'do_pings');
    18731886}
Note: See TracChangeset for help on using the changeset viewer.