Changeset 7645

Timestamp:

04/14/2008 04:13:25 PM (18 years ago)

Author:

ryan

Message:

Prepare DB queries in more places. Props filosofo. see #6644

Location:

trunk

Files:

• wp-admin/admin-ajax.php (modified) (1 diff)
• wp-admin/edit-comments.php (modified) (1 diff)
• wp-admin/edit-pages.php (modified) (1 diff)
• wp-admin/edit.php (modified) (1 diff)
• wp-admin/import/blogger.php (modified) (2 diffs)
• wp-admin/import/dotclear.php (modified) (2 diffs)
• wp-admin/import/textpattern.php (modified) (2 diffs)
• wp-admin/import/wp-cat2tag.php (modified) (2 diffs)
• wp-admin/includes/bookmark.php (modified) (2 diffs)
• wp-admin/includes/comment.php (modified) (2 diffs)
• wp-admin/includes/export.php (modified) (3 diffs)
• wp-admin/includes/post.php (modified) (8 diffs)
• wp-admin/includes/template.php (modified) (1 diff)
• wp-admin/includes/upgrade.php (modified) (24 diffs)
• wp-admin/includes/user.php (modified) (10 diffs)
• wp-admin/update-links.php (modified) (1 diff)
• wp-admin/upload.php (modified) (1 diff)
• wp-comments-post.php (modified) (1 diff)
• wp-includes/comment.php (modified) (11 diffs)
• wp-includes/post.php (modified) (4 diffs)
• wp-includes/taxonomy.php (modified) (4 diffs)
• wp-includes/user.php (modified) (6 diffs)
• wp-trackback.php (modified) (1 diff)
• xmlrpc.php (modified) (5 diffs)

trunk/wp-admin/admin-ajax.php

@@ -16 +16 @@
         if ( strstr( $s, ',' ) )
                 die; // it's a multiple tag insert, we won't find anything
-        $results = $wpdb->get_col( "SELECT name FROM $wpdb->terms WHERE name LIKE ('%$s%')" );
+        $results = $wpdb->get_col( $wpdb->prepare("SELECT name FROM $wpdb->terms WHERE name LIKE (%s)", '%' . $s . '%') );
         echo join( $results, "\n" );
         die;

trunk/wp-admin/edit-comments.php

@@ -13 +13 @@
         foreach ($_REQUEST['delete_comments'] as $comment) : // Check the permissions on each
                 $comment = (int) $comment;
-                $post_id = (int) $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = $comment");
-                // $authordata = get_userdata( $wpdb->get_var("SELECT post_author FROM $wpdb->posts WHERE ID = $post_id") );
+                $post_id = (int) $wpdb->get_var( $wpdb->prepare( "SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = %d", $comment) );
                 if ( !current_user_can('edit_post', $post_id) )
                         continue;

trunk/wp-admin/edit-pages.php

@@ -176 +176 @@
 if ( 1 == count($posts) && is_singular() ) :
 
-        $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $id AND comment_approved != 'spam' ORDER BY comment_date");
+        $comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved != 'spam' ORDER BY comment_date", $id) );
         if ( $comments ) :
                 // Make sure comments, post, and post_author are cached

trunk/wp-admin/edit.php

@@ -206 +206 @@
 if ( 1 == count($posts) && is_singular() ) :
 
-        $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $id AND comment_approved != 'spam' ORDER BY comment_date");
+        $comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved != 'spam' ORDER BY comment_date", $id) );
         if ( $comments ) :
                 // Make sure comments, post, and post_author are cached

trunk/wp-admin/import/blogger.php

@@ -642 +642 @@
 
                 // Get an array of posts => authors
-                $post_ids = (array) $wpdb->get_col("SELECT post_id FROM $wpdb->postmeta WHERE meta_key = 'blogger_blog' AND meta_value = '$host'");
+                $post_ids = (array) $wpdb->get_col( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_key = 'blogger_blog' AND meta_value = %s", $host) );
                 $post_ids = join( ',', $post_ids );
                 $results = (array) $wpdb->get_results("SELECT post_id, meta_value FROM $wpdb->postmeta WHERE meta_key = 'blogger_author' AND post_id IN ($post_ids)");
@@ -659 +659 @@
                         $post_ids = join( ',', $post_ids);
 
-                        $wpdb->query("UPDATE $wpdb->posts SET post_author = $user_id WHERE id IN ($post_ids)");
+                        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_author = %d WHERE id IN ($post_ids)", $user_id) );
                         $this->blogs[$importing_blog]['authors'][$author][1] = $user_id;
                 }

trunk/wp-admin/import/dotclear.php

@@ -14 +14 @@
         {
                 global $wpdb;
-                return $wpdb->get_var('SELECT count(*) FROM '.$wpdb->comments.' WHERE comment_post_ID = '.$post_ID);
+                return $wpdb->get_var( $wpdb->prepare("SELECT count(*) FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
         }
 }
@@ -23 +23 @@
         {
                 global $wpdb;
-                return $wpdb->get_var('SELECT link_id FROM '.$wpdb->links.' WHERE link_name = "'.$linkname.'"');
+                return $wpdb->get_var( $wpdb->prepare("SELECT link_id FROM $wpdb->links WHERE link_name = %s", $linkname) );
         }
 }

trunk/wp-admin/import/textpattern.php

@@ -9 +9 @@
         {
                 global $wpdb;
-                return $wpdb->get_var('SELECT count(*) FROM '.$wpdb->comments.' WHERE comment_post_ID = '.$post_ID);
+                return $wpdb->get_var( $wpdb->prepare("SELECT count(*) FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
         }
 }
@@ -18 +18 @@
         {
                 global $wpdb;
-                return $wpdb->get_var('SELECT link_id FROM '.$wpdb->links.' WHERE link_name = "'.$wpdb->escape($linkname).'"');
+                return $wpdb->get_var( $wpdb->prepare("SELECT link_id FROM $wpdb->links WHERE link_name = %s", $linkname) );
         }
 }

trunk/wp-admin/import/wp-cat2tag.php

@@ -165 +165 @@
                                         $posts = get_objects_in_term($category->term_id, 'category');
                                         foreach ( $posts as $post ) {
-                                                if ( !$wpdb->get_var("SELECT object_id FROM $wpdb->term_relationships WHERE object_id = '$post' AND term_taxonomy_id = '$id'") )
-                                                        $wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ('$post', '$id')");
+                                                if ( !$wpdb->get_var( $wpdb->prepare("SELECT object_id FROM $wpdb->term_relationships WHERE object_id = %d AND term_taxonomy_id = %d", $post, $id) ) )
+                                                        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES (%d, %d)", $post, $id) );
                                                 clean_post_cache($post);
                                         }
                                 } else {
-                                        $tt_ids = $wpdb->get_col("SELECT term_taxonomy_id FROM $wpdb->term_taxonomy WHERE term_id = '{$category->term_id}' AND taxonomy = 'category'");
+                                        $tt_ids = $wpdb->get_col( $wpdb->prepare("SELECT term_taxonomy_id FROM $wpdb->term_taxonomy WHERE term_id = %d AND taxonomy = 'category'", $category->term_id) );
                                         if ( $tt_ids ) {
                                                 $posts = $wpdb->get_col("SELECT object_id FROM $wpdb->term_relationships WHERE term_taxonomy_id IN (" . join(',', $tt_ids) . ") GROUP BY object_id");
@@ -178 +178 @@
 
                                         // Change the category to a tag.
-                                        $wpdb->query("UPDATE $wpdb->term_taxonomy SET taxonomy = 'post_tag' WHERE term_id = '{$category->term_id}' AND taxonomy = 'category'");
-
-                                        $terms = $wpdb->get_col("SELECT term_id FROM $wpdb->term_taxonomy WHERE parent = '{$category->term_id}' AND taxonomy = 'category'");
+                                        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->term_taxonomy SET taxonomy = 'post_tag' WHERE term_id = %d AND taxonomy = 'category'", $category->term_id) );
+
+                                        $terms = $wpdb->get_col( $wpdb->prepare("SELECT term_id FROM $wpdb->term_taxonomy WHERE parent = %d AND taxonomy = 'category'", $category->term_id) );
                                         foreach ( (array) $terms as $term )
                                                 clean_category_cache($term);
 
                                         // Set all parents to 0 (root-level) if their parent was the converted tag
-                                        $wpdb->query("UPDATE $wpdb->term_taxonomy SET parent = 0 WHERE parent = '{$category->term_id}' AND taxonomy = 'category'");
+                                        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->term_taxonomy SET parent = 0 WHERE parent = %d AND taxonomy = 'category'", $category->term_id) );
                                 }
                                 // Clean the cache

trunk/wp-admin/includes/bookmark.php

@@ -48 +48 @@
         wp_delete_object_term_relationships($link_id, 'link_category');
 
-        $wpdb->query("DELETE FROM $wpdb->links WHERE link_id = '$link_id'");
+        $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->links WHERE link_id = %d", $link_id) );
 
         do_action('deleted_link', $link_id);
@@ -120 +120 @@
 
         if ( $update ) {
-                $wpdb->query("UPDATE $wpdb->links SET link_url='$link_url',
-                        link_name='$link_name', link_image='$link_image',
-                        link_target='$link_target',
-                        link_visible='$link_visible', link_description='$link_description',
-                        link_rating='$link_rating', link_rel='$link_rel',
-                        link_notes='$link_notes', link_rss = '$link_rss'
-                        WHERE link_id='$link_id'");
+                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->links SET link_url = %s,
+                        link_name = %s, link_image = %s, link_target = %s, 
+                        link_visible = %s, link_description = %s, link_rating = %s, 
+                        link_rel = %s, link_notes = %s, link_rss = %s
+                        WHERE link_id = %s", $link_url, $link_name, $link_image, $link_target, $link_visible, $link_description, $link_rating, $link_rel, $link_notes, $link_rss, $link_id) );
         } else {
-                $wpdb->query("INSERT INTO $wpdb->links (link_url, link_name, link_image, link_target, link_description, link_visible, link_owner, link_rating, link_rel, link_notes, link_rss) VALUES('$link_url','$link_name', '$link_image', '$link_target', '$link_description', '$link_visible', '$link_owner', '$link_rating', '$link_rel', '$link_notes', '$link_rss')");
+                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->links (link_url, link_name, link_image, link_target, link_description, link_visible, link_owner, link_rating, link_rel, link_notes, link_rss) VALUES(%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)", 
+                $link_url,$link_name, $link_image, $link_target, $link_description, $link_visible, $link_owner, $link_rating, $link_rel, $link_notes, $link_rss) );
                 $link_id = (int) $wpdb->insert_id;
         }

trunk/wp-admin/includes/comment.php

@@ -4 +4 @@
         global $wpdb;
 
-        return $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments
-                        WHERE comment_author = '$comment_author' AND comment_date = '$comment_date'");
+        return $wpdb->get_var( $wpdb->prepare("SELECT comment_post_ID FROM $wpdb->comments
+                        WHERE comment_author = %s AND comment_date = %s", $comment_author, $comment_date) );
 }
 
@@ -68 +68 @@
         global $wpdb;
         $post_id = (int) $post_id;
-        $pending = $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = $post_id AND comment_approved = '0'" );
+        $pending = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '0'", $post_id) );
         return $pending;
 }

trunk/wp-admin/includes/export.php

@@ -18 +18 @@
 if ( $author and $author != 'all' ) {
         $author_id = (int) $author;
-        $where = " WHERE post_author = '$author_id' ";
+        $where = $wpdb->prepare(" WHERE post_author = %d ", $author_id);
 }
 
@@ -218 +218 @@
 <?php } ?>
 <?php
-$postmeta = $wpdb->get_results("SELECT * FROM $wpdb->postmeta WHERE post_id = $post->ID");
+$postmeta = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->postmeta WHERE post_id = %d", $post->ID) );
 if ( $postmeta ) {
 ?>
@@ -229 +229 @@
 <?php } ?>
 <?php
-$comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $post->ID");
+$comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d", $post->ID) );
 if ( $comments ) { foreach ( $comments as $c ) { ?>
 <wp:comment>

trunk/wp-admin/includes/post.php

@@ -195 +195 @@
 
         if (!empty ($post_date))
-                $post_date = "AND post_date = '$post_date'";
+                $post_date = $wpdb->prepare("AND post_date = %s", $post_date);
 
         if (!empty ($title))
-                return $wpdb->get_var("SELECT ID FROM $wpdb->posts WHERE post_title = '$title' $post_date");
+                return $wpdb->get_var( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title = %s $post_date", $title) );
         else
                 if (!empty ($content))
-                        return $wpdb->get_var("SELECT ID FROM $wpdb->posts WHERE post_content = '$content' $post_date");
+                        return $wpdb->get_var( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_content = %s $post_date", $content) );
 
         return 0;
@@ -381 +381 @@
                 wp_cache_delete($post_ID, 'post_meta');
 
-                $wpdb->query( "
-                                INSERT INTO $wpdb->postmeta
-                                (post_id,meta_key,meta_value )
-                                VALUES ('$post_ID','$metakey','$metavalue' )
-                        " );
+                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta 
+                        (post_id,meta_key,meta_value ) VALUES (%s, %s, %s)",
+                        $post_ID, $metakey, $metavalue) );
                 return $wpdb->insert_id;
         }
@@ -395 +393 @@
         $mid = (int) $mid;
 
-        $post_id = $wpdb->get_var("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = '$mid'");
+        $post_id = $wpdb->get_var( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
         wp_cache_delete($post_id, 'post_meta');
 
-        return $wpdb->query( "DELETE FROM $wpdb->postmeta WHERE meta_id = '$mid'" );
+        return $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
 }
 
@@ -418 +416 @@
         $mid = (int) $mid;
 
-        $meta = $wpdb->get_row( "SELECT * FROM $wpdb->postmeta WHERE meta_id = '$mid'" );
+        $meta = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
         if ( is_serialized_string( $meta->meta_value ) )
                 $meta->meta_value = maybe_unserialize( $meta->meta_value );
@@ -428 +426 @@
         global $wpdb;
 
-        return $wpdb->get_results( "
-                        SELECT meta_key, meta_value, meta_id, post_id
-                        FROM $wpdb->postmeta
-                        WHERE post_id = '$postid'
-                        ORDER BY meta_key,meta_id", ARRAY_A );
+        return $wpdb->get_results( $wpdb->prepare("SELECT meta_key, meta_value, meta_id, post_id
+                        FROM $wpdb->postmeta WHERE post_id = %d
+                        ORDER BY meta_key,meta_id", $postid), ARRAY_A );
 
 }
@@ -444 +440 @@
                 return false;
 
-        $post_id = $wpdb->get_var("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = '$mid'");
+        $post_id = $wpdb->get_var( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
         wp_cache_delete($post_id, 'post_meta');
 
@@ -450 +446 @@
         $mvalue = $wpdb->escape( $mvalue );
         $mid = (int) $mid;
-        return $wpdb->query( "UPDATE $wpdb->postmeta SET meta_key = '$mkey', meta_value = '$mvalue' WHERE meta_id = '$mid'" );
+        return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->postmeta SET meta_key = %s, meta_value = %s WHERE meta_id = %d", $mkey, $mvalue, $mid) );
 }
 
@@ -503 +499 @@
         $old_ID = (int) $old_ID;
         $new_ID = (int) $new_ID;
-        return $wpdb->query( "UPDATE $wpdb->posts SET post_parent = $new_ID WHERE post_parent = $old_ID" );
+        return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_parent = %d WHERE post_parent = %d", $new_ID, $old_ID) );
 }
 

trunk/wp-admin/includes/template.php

@@ -893 +893 @@
 function parent_dropdown( $default = 0, $parent = 0, $level = 0 ) {
         global $wpdb, $post_ID;
-        $items = $wpdb->get_results( "SELECT ID, post_parent, post_title FROM $wpdb->posts WHERE post_parent = $parent AND post_type = 'page' ORDER BY menu_order" );
+        $items = $wpdb->get_results( $wpdb->prepare("SELECT ID, post_parent, post_title FROM $wpdb->posts WHERE post_parent = %d AND post_type = 'page' ORDER BY menu_order", $parent) );
 
         if ( $items ) {

trunk/wp-admin/includes/upgrade.php

@@ -219 +219 @@
                         if ('' == $post->post_name) {
                                 $newtitle = sanitize_title($post->post_title);
-                                $wpdb->query("UPDATE $wpdb->posts SET post_name = '$newtitle' WHERE ID = '$post->ID'");
+                                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_name = %s WHERE ID = %d", $newtitle, $post->ID) );
                         }
                 }
@@ -228 +228 @@
                 if ('' == $category->category_nicename) {
                         $newtitle = sanitize_title($category->cat_name);
-                        $wpdb->query("UPDATE $wpdb->categories SET category_nicename = '$newtitle' WHERE cat_ID = '$category->cat_ID'");
+                        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->categories SET category_nicename = %s WHERE cat_ID = %d", $newtitle, $category->cat_ID) );
                 }
         }
@@ -251 +251 @@
                 foreach ($allposts as $post) {
                         // Check to see if it's already been imported
-                        $cat = $wpdb->get_row("SELECT * FROM $wpdb->post2cat WHERE post_id = $post->ID AND category_id = $post->post_category");
+                        $cat = $wpdb->get_row( $wpdb->("SELECT * FROM $wpdb->post2cat WHERE post_id = %d AND category_id = %d", $post->ID, $post->post_category) );
                         if (!$cat && 0 != $post->post_category) { // If there's no result
-                                $wpdb->query("
-                                        INSERT INTO $wpdb->post2cat
+                                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->post2cat
                                         (post_id, category_id)
-                                        VALUES
-                                        ('$post->ID', '$post->post_category')
-                                        ");
+                                        VALUES (%s, %s)
+                                        ", $post->ID, $post->post_category) );
                         }
                 }
@@ -286 +284 @@
                 if ('' == $user->user_nicename) {
                         $newname = sanitize_title($user->user_nickname);
-                        $wpdb->query("UPDATE $wpdb->users SET user_nicename = '$newname' WHERE ID = '$user->ID'");
+                        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->users SET user_nicename = %s WHERE ID = %d", $newname, $user->ID) );
                 }
         }
@@ -402 +400 @@
                 if ( 1 != $option->dupes ) { // Could this be done in the query?
                         $limit = $option->dupes - 1;
-                        $dupe_ids = $wpdb->get_col("SELECT option_id FROM $wpdb->options WHERE option_name = '$option->option_name' LIMIT $limit");
+                        $dupe_ids = $wpdb->get_col( $wpdb->prepare("SELECT option_id FROM $wpdb->options WHERE option_name = %s LIMIT %d", $option->option_name, $limit) );
                         $dupe_ids = join($dupe_ids, ',');
                         $wpdb->query("DELETE FROM $wpdb->options WHERE option_id IN ($dupe_ids)");
@@ -446 +444 @@
                         if ($idmode == 'namelf') $id = $user->user_lastname.' '.$user->user_firstname;
                         if (!$idmode) $id = $user->user_nickname;
-                        $id = $wpdb->escape( $id );
-                        $wpdb->query("UPDATE $wpdb->users SET display_name = '$id' WHERE ID = '$user->ID'");
+                        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->users SET display_name = %s WHERE ID = %d", $id, $user->ID) );
                 endif;
 
@@ -469 +466 @@
         if( is_array( $comments ) ) {
                 foreach ($comments as $comment) {
-                        $wpdb->query( "UPDATE $wpdb->posts SET comment_count = $comment->c WHERE ID = '$comment->comment_post_ID'" );
+                        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET comment_count = %d WHERE ID = %d", $comment->c, $comment->comment_post_ID) );
                 }
         }
@@ -478 +475 @@
                 $objects = $wpdb->get_results("SELECT ID, post_type FROM $wpdb->posts WHERE post_status = 'object'");
                 foreach ($objects as $object) {
-                        $wpdb->query("UPDATE $wpdb->posts SET post_status = 'attachment',
-                        post_mime_type = '$object->post_type',
+                        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_status = 'attachment',
+                        post_mime_type = %s,
                         post_type = ''
-                        WHERE ID = $object->ID");
+                        WHERE ID = %d", $object->post_type, $object->ID) );
 
                         $meta = get_post_meta($object->ID, 'imagedata', true);
@@ -509 +506 @@
                         }
 
-                        $wpdb->query("UPDATE $wpdb->posts SET post_status = '$status', post_type = '$type' WHERE ID = '$post->ID'");
+                        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_status = %s, post_type = %s WHERE ID = %d", $status, $type, $post->ID) );
                 }
         }
@@ -542 +539 @@
         foreach ($categories as $category) {
                 $term_id = (int) $category->cat_ID;
-                $name = $wpdb->escape($category->cat_name);
-                $description = $wpdb->escape($category->category_description);
-                $slug = $wpdb->escape($category->category_nicename);
-                $parent = $wpdb->escape($category->category_parent);
                 $term_group = 0;
 
                 // Associate terms with the same slug in a term group and make slugs unique.
-                if ( $exists = $wpdb->get_results("SELECT term_id, term_group FROM $wpdb->terms WHERE slug = '$slug'") ) {
+                if ( $exists = $wpdb->get_results( $wpdb->prepare("SELECT term_id, term_group FROM $wpdb->terms WHERE slug = %s", $slug) ) ) {
                         $term_group = $exists[0]->term_group;
                         $id = $exists[0]->term_id;
@@ -556 +549 @@
                                 $alt_slug = $slug . "-$num";
                                 $num++;
-                                $slug_check = $wpdb->get_var("SELECT slug FROM $wpdb->terms WHERE slug = '$alt_slug'");
+                                $slug_check = $wpdb->get_var( $wpdb->prepare("SELECT slug FROM $wpdb->terms WHERE slug = %s", $alt_slug) );
                         } while ( $slug_check );
 
@@ -563 +556 @@
                         if ( empty( $term_group ) ) {
                                 $term_group = $wpdb->get_var("SELECT MAX(term_group) FROM $wpdb->terms GROUP BY term_group") + 1;
-                                $wpdb->query("UPDATE $wpdb->terms SET term_group = '$term_group' WHERE term_id = '$id'");
+                                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->terms SET term_group = %d WHERE term_id = %d", $term_group, $id) );
                         }
                 }
 
-                $wpdb->query("INSERT INTO $wpdb->terms (term_id, name, slug, term_group) VALUES ('$term_id', '$name', '$slug', '$term_group')");
+                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->terms (term_id, name, slug, term_group) VALUES 
+                (%d, %s, %s, %d)", $term_id, $name, $slug, $term_group) );
 
                 $count = 0;
@@ -573 +567 @@
                         $count = (int) $category->category_count;
                         $taxonomy = 'category';
-                        $wpdb->query("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')");
+                        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
                         $tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
                 }
@@ -580 +574 @@
                         $count = (int) $category->link_count;
                         $taxonomy = 'link_category';
-                        $wpdb->query("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')");
+                        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
                         $tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
                 }
@@ -588 +582 @@
                         $count = (int) $category->tag_count;
                         $taxonomy = 'post_tag';
-                        $wpdb->query("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')");
+                        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
                         $tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
                 }
@@ -595 +589 @@
                         $count = 0;
                         $taxonomy = 'category';
-                        $wpdb->query("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')");
+                        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
                         $tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
                 }
@@ -615 +609 @@
                         continue;
 
-                $wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ('$post_id', '$tt_id')");
+                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ( %d, %d)", $post_id, $tt_id) );
         }
 
@@ -634 +628 @@
 
                         // Associate terms with the same slug in a term group and make slugs unique.
-                        if ( $exists = $wpdb->get_results("SELECT term_id, term_group FROM $wpdb->terms WHERE slug = '$slug'") ) {
+                        if ( $exists = $wpdb->get_results( $wpdb->prepare("SELECT term_id, term_group FROM $wpdb->terms WHERE slug = %s", $slug) ) ) {
                                 $term_group = $exists[0]->term_group;
                                 $term_id = $exists[0]->term_id;
@@ -640 +634 @@
 
                         if ( empty($term_id) ) {
-                                $wpdb->query("INSERT INTO $wpdb->terms (name, slug, term_group) VALUES ('$name', '$slug', '$term_group')");
+                                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->terms (name, slug, term_group) VALUES (%s, %s, %d)", $name, $slug, $term_group) );
                                 $term_id = (int) $wpdb->insert_id;
                         }
@@ -647 +641 @@
                         $default_link_cat = $term_id;
 
-                        $wpdb->query("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', 'link_category', '', '0', '0')");
+                        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES (%d, 'link_category', '', '0', '0')", $term_id) );
                         $tt_ids[$term_id] = (int) $wpdb->insert_id;
                 }
@@ -663 +657 @@
                                 continue;
 
-                        $wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ('$link->link_id', '$tt_id')");
+                        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ( %d, %d)", $link->link_id, $tt_id) );
                 }
 
@@ -678 +672 @@
                                 continue;
 
-                        $wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ('$link_id', '$tt_id')");
+                        $wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ( %d, %d)", $link_id, $tt_id) );
                 }
         }
@@ -691 +685 @@
         foreach ( (array) $terms as $term ) {
                 if ( ('post_tag' == $term->taxonomy) || ('category' == $term->taxonomy) )
-                        $count = $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->term_relationships, $wpdb->posts WHERE $wpdb->posts.ID = $wpdb->term_relationships.object_id AND post_status = 'publish' AND post_type = 'post' AND term_taxonomy_id = '$term->term_taxonomy_id'");
+                        $count = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->term_relationships, $wpdb->posts WHERE $wpdb->posts.ID = $wpdb->term_relationships.object_id AND post_status = 'publish' AND post_type = 'post' AND term_taxonomy_id = %d", $term->term_taxonomy_id) );
                 else
-                        $count = $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->term_relationships WHERE term_taxonomy_id = '$term->term_taxonomy_id'");
-                $wpdb->query("UPDATE $wpdb->term_taxonomy SET count = '$count' WHERE term_taxonomy_id = '$term->term_taxonomy_id'");
+                        $count = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->term_relationships WHERE term_taxonomy_id = %d", $term->term_taxonomy_id) );
+                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->term_taxonomy SET count = %d WHERE term_taxonomy_id = %d", $count, $term->term_taxonomy_id) );
         }
 }
@@ -824 +818 @@
         }
 
-        $option = $wpdb->get_var("SELECT option_value FROM $wpdb->options WHERE option_name = '$setting'");
+        $option = $wpdb->get_var( $wpdb->prepare("SELECT option_value FROM $wpdb->options WHERE option_name = %s", $setting) );
 
         if ( 'home' == $setting && '' == $option )

trunk/wp-admin/includes/user.php

@@ -142 +142 @@
         global $wpdb;
         $level_key = $wpdb->prefix . 'user_level';
-
-        $query = "SELECT user_id FROM $wpdb->usermeta WHERE meta_key = '$level_key' AND meta_value != '0'";
-
-        return $wpdb->get_col( $query );
+        return $wpdb->get_col( $wpdb->prepare("SELECT user_id FROM $wpdb->usermeta WHERE meta_key = %s AND meta_value != '0'", $level_key) );
 }
 
@@ -177 +174 @@
         $level_key = $wpdb->prefix . 'user_level';
 
-        $query = "SELECT user_id FROM $wpdb->usermeta WHERE meta_key = '$level_key'";
+        $query = $wpdb->prepare("SELECT user_id FROM $wpdb->usermeta WHERE meta_key = %s", $level_key);
         if ( $exclude_zeros )
                 $query .= " AND meta_value != '0'";
@@ -188 +185 @@
         $level_key = $wpdb->prefix . 'user_level';
 
-        $query = "SELECT user_id FROM $wpdb->usermeta WHERE meta_key = '$level_key' AND meta_value = '0'";
-
-        return $wpdb->get_col( $query );
+        return $wpdb->get_col( $wpdb->prepare("SELECT user_id FROM $wpdb->usermeta WHERE meta_key = %s AND meta_value = '0'", $level_key) );
 }
 
@@ -209 +204 @@
         } else {
                 $editable = join(',', $editable);
-                $other_unpubs = $wpdb->get_results("SELECT ID, post_title, post_author FROM $wpdb->posts WHERE post_type = 'post' AND $type_sql AND post_author IN ($editable) AND post_author != '$user_id' ORDER BY post_modified $dir");
+                $other_unpubs = $wpdb->get_results( $wpdb->prepare("SELECT ID, post_title, post_author FROM $wpdb->posts WHERE post_type = 'post' AND $type_sql AND post_author IN ($editable) AND post_author != %d ORDER BY post_modified $dir", $user_id) );
         }
 
@@ -242 +237 @@
 function get_users_drafts( $user_id ) {
         global $wpdb;
-        $user_id = (int) $user_id;
-        $query = "SELECT ID, post_title FROM $wpdb->posts WHERE post_type = 'post' AND post_status = 'draft' AND post_author = $user_id ORDER BY post_modified DESC";
+        $query = $wpdb->prepare("SELECT ID, post_title FROM $wpdb->posts WHERE post_type = 'post' AND post_status = 'draft' AND post_author = %d ORDER BY post_modified DESC", $user_id);
         $query = apply_filters('get_users_drafts', $query);
         return $wpdb->get_results( $query );
@@ -254 +248 @@
 
         if ($reassign == 'novalue') {
-                $post_ids = $wpdb->get_col("SELECT ID FROM $wpdb->posts WHERE post_author = $id");
+                $post_ids = $wpdb->get_col( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_author = %d", $id) );
 
                 if ($post_ids) {
@@ -262 +256 @@
 
                 // Clean links
-                $wpdb->query("DELETE FROM $wpdb->links WHERE link_owner = $id");
+                $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->links WHERE link_owner = %d", $id) );
         } else {
                 $reassign = (int) $reassign;
-                $wpdb->query("UPDATE $wpdb->posts SET post_author = {$reassign} WHERE post_author = {$id}");
-                $wpdb->query("UPDATE $wpdb->links SET link_owner = {$reassign} WHERE link_owner = {$id}");
+                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_author = %d WHERE post_author = %d", $reassign, $id) );
+                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->links SET link_owner = %d WHERE link_owner = %d}", $reassign, $id) );
         }
 
@@ -272 +266 @@
         do_action('delete_user', $id);
 
-        $wpdb->query("DELETE FROM $wpdb->users WHERE ID = $id");
-        $wpdb->query("DELETE FROM $wpdb->usermeta WHERE user_id = '$id'");
+        $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->users WHERE ID = %d", $id) );
+        $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->usermeta WHERE user_id = %d", $id) );
 
         wp_cache_delete($id, 'users');
@@ -324 +318 @@
                 global $wpdb;
                 $this->first_user = ($this->page - 1) * $this->users_per_page;
-                $this->query_limit = ' LIMIT ' . $this->first_user . ',' . $this->users_per_page;
+                $this->query_limit = $wpdb->prepare(" LIMIT %d, %d", $this->first_user, $this->users_per_page);
                 $this->query_sort = ' ORDER BY user_login';
                 $search_sql = '';
@@ -338 +332 @@
                 $this->query_from_where = "FROM $wpdb->users";
                 if ( $this->role )
-                        $this->query_from_where .= " INNER JOIN $wpdb->usermeta ON $wpdb->users.ID = $wpdb->usermeta.user_id WHERE $wpdb->usermeta.meta_key = '{$wpdb->prefix}capabilities' AND $wpdb->usermeta.meta_value LIKE '%$this->role%'";
+                        $this->query_from_where .= $wpdb->prepare(" INNER JOIN $wpdb->usermeta ON $wpdb->users.ID = $wpdb->usermeta.user_id WHERE $wpdb->usermeta.meta_key = '{$wpdb->prefix}capabilities' AND $wpdb->usermeta.meta_value LIKE %s", '%' . $this->role . '%');
                 else
                         $this->query_from_where .= " WHERE 1=1";

trunk/wp-admin/update-links.php

@@ -37 +37 @@
 
         foreach ($returns as $return) :
-                $time = $wpdb->escape( substr($return, 0, 19) );
-                $uri = $wpdb->escape( preg_replace('/(.*?) | (.*?)/', '$2', $return) );
-                $wpdb->query("UPDATE $wpdb->links SET link_updated = '$time' WHERE link_url = '$uri'");
+                $time = substr($return, 0, 19);
+                $uri = preg_replace('/(.*?) | (.*?)/', '$2', $return);
+                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->links SET link_updated = %s WHERE link_url = %s", $time, $uri) );
         endforeach;
 }

trunk/wp-admin/upload.php

@@ -212 +212 @@
 if ( 1 == count($posts) && is_singular() ) :
         
-        $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $id AND comment_approved != 'spam' ORDER BY comment_date");
+        $comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved != 'spam' ORDER BY comment_date", $id) );
         if ( $comments ) :
                 // Make sure comments, post, and post_author are cached

trunk/wp-comments-post.php

@@ -12 +12 @@
 $comment_post_ID = (int) $_POST['comment_post_ID'];
 
-$status = $wpdb->get_row("SELECT post_status, comment_status FROM $wpdb->posts WHERE ID = '$comment_post_ID'");
+$status = $wpdb->get_row( $wpdb->prepare("SELECT post_status, comment_status FROM $wpdb->posts WHERE ID = %d", $comment_post_ID) );
 
 if ( empty($status->comment_status) ) {

trunk/wp-includes/comment.php

@@ -242 +242 @@
         $where = '';
         if ( $post_id > 0 ) {
-                $where = "WHERE comment_post_ID = {$post_id}";
+                $where = $wpdb->prepare("WHERE comment_post_ID = %d", $post_id);
         }
 
@@ -380 +380 @@
         if ( current_user_can( 'manage_options' ) )
                 return; // don't throttle admins
-        if ( $lasttime = $wpdb->get_var("SELECT comment_date_gmt FROM $wpdb->comments WHERE comment_author_IP = '$ip' OR comment_author_email = '$email' ORDER BY comment_date DESC LIMIT 1") ) {
+        if ( $lasttime = $wpdb->get_var( $wpdb->prepare("SELECT comment_date_gmt FROM $wpdb->comments WHERE comment_author_IP = %s OR comment_author_email = %s ORDER BY comment_date DESC LIMIT 1", $ip, $email) ) ) {
                 $time_lastcomment = mysql2date('U', $lasttime);
                 $time_newcomment  = mysql2date('U', $date);
@@ -488 +488 @@
         $comment = get_comment($comment_id);
 
-        if ( ! $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_ID='$comment_id' LIMIT 1") )
+        if ( ! $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->comments WHERE comment_ID = %d LIMIT 1", $comment_id) ) )
                 return false;
 
@@ -586 +586 @@
                 $user_id = 0;
 
-        $result = $wpdb->query("INSERT INTO $wpdb->comments
+        $result = $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->comments
         (comment_post_ID, comment_author, comment_author_email, comment_author_url, comment_author_IP, comment_date, comment_date_gmt, comment_content, comment_approved, comment_agent, comment_type, comment_parent, user_id)
-        VALUES
-        ('$comment_post_ID', '$comment_author', '$comment_author_email', '$comment_author_url', '$comment_author_IP', '$comment_date', '$comment_date_gmt', '$comment_content', '$comment_approved', '$comment_agent', '$comment_type', '$comment_parent', '$user_id')
-        ");
+        VALUES (%d, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %d, %d)",
+        $comment_post_ID, $comment_author, $comment_author_email, $comment_author_url, $comment_author_IP, $comment_date, $comment_date_gmt, $comment_content, $comment_approved, $comment_agent, $comment_type, $comment_parent, $user_id) );
 
         $id = (int) $wpdb->insert_id;
@@ -715 +714 @@
         switch ( $comment_status ) {
                 case 'hold':
-                        $query = "UPDATE $wpdb->comments SET comment_approved='0' WHERE comment_ID='$comment_id' LIMIT 1";
+                        $query = $wpdb->prepare("UPDATE $wpdb->comments SET comment_approved='0' WHERE comment_ID = %d LIMIT 1", $comment_id);
                         break;
                 case 'approve':
-                        $query = "UPDATE $wpdb->comments SET comment_approved='1' WHERE comment_ID='$comment_id' LIMIT 1";
+                        $query = $wpdb->prepare("UPDATE $wpdb->comments SET comment_approved='1' WHERE comment_ID = %d LIMIT 1", $comment_id);
                         break;
                 case 'spam':
-                        $query = "UPDATE $wpdb->comments SET comment_approved='spam' WHERE comment_ID='$comment_id' LIMIT 1";
+                        $query = $wpdb->prepare("UPDATE $wpdb->comments SET comment_approved='spam' WHERE comment_ID = %d LIMIT 1", $comment_id);
                         break;
                 case 'delete':
@@ -775 +774 @@
         $comment_date_gmt = get_gmt_from_date($comment_date);
 
-        $wpdb->query(
-                "UPDATE $wpdb->comments SET
-                        comment_content      = '$comment_content',
-                        comment_author       = '$comment_author',
-                        comment_author_email = '$comment_author_email',
-                        comment_approved     = '$comment_approved',
-                        comment_author_url   = '$comment_author_url',
-                        comment_date         = '$comment_date',
-                        comment_date_gmt     = '$comment_date_gmt'
-                WHERE comment_ID = $comment_ID" );
+        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->comments SET
+                        comment_content      = %s,
+                        comment_author       = %s,
+                        comment_author_email = %s,
+                        comment_approved     = %s,
+                        comment_author_url   = %s,
+                        comment_date         = %s,
+                        comment_date_gmt     = %s
+                WHERE comment_ID = %d",
+                        $comment_content,
+                        $comment_author,
+                        $comment_author_email,
+                        $comment_approved,
+                        $comment_author_url,
+                        $comment_date,
+                        $comment_date_gmt
+                        $comment_ID) );
 
         $rval = $wpdb->rows_affected;
@@ -880 +886 @@
 
         $old = (int) $post->comment_count;
-        $new = (int) $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = '$post_id' AND comment_approved = '1'");
-        $wpdb->query("UPDATE $wpdb->posts SET comment_count = '$new' WHERE ID = '$post_id'");
+        $new = (int) $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '1'", $post_id) );
+        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET comment_count = %d WHERE ID = %d", $new, $post_id) );
 
         if ( 'page' == $post->post_type )
@@ -1009 +1015 @@
         // Do Enclosures
         while ($enclosure = $wpdb->get_row("SELECT * FROM {$wpdb->posts}, {$wpdb->postmeta} WHERE {$wpdb->posts}.ID = {$wpdb->postmeta}.post_id AND {$wpdb->postmeta}.meta_key = '_encloseme' LIMIT 1")) {
-                $wpdb->query("DELETE FROM {$wpdb->postmeta} WHERE post_id = {$enclosure->ID} AND meta_key = '_encloseme';");
+                $wpdb->query( $wpdb->prepare("DELETE FROM {$wpdb->postmeta} WHERE post_id = %d AND meta_key = '_encloseme';", $enclosure->ID) );
                 do_enclose($enclosure->post_content, $enclosure->ID);
         }
@@ -1036 +1042 @@
         global $wpdb;
 
-        $post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID = $post_id");
+        $post = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->posts WHERE ID = %d", $post_id) );
         $to_ping = get_to_ping($post_id);
         $pinged  = get_pung($post_id);
         if ( empty($to_ping) ) {
-                $wpdb->query("UPDATE $wpdb->posts SET to_ping = '' WHERE ID = '$post_id'");
+                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = '' WHERE ID = %d", $post_id) );
                 return;
         }
@@ -1061 +1067 @@
                                 $pinged[] = $tb_ping;
                         } else {
-                                $wpdb->query("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_ping', '')) WHERE ID = '$post_id'");
+                                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_ping', '')) WHERE ID = %d", $post_id) );
                         }
                 }
@@ -1226 +1232 @@
 
         $tb_url = addslashes( $tb_url );
-        $wpdb->query("UPDATE $wpdb->posts SET pinged = CONCAT(pinged, '\n', '$tb_url') WHERE ID = '$ID'");
-        return $wpdb->query("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_url', '')) WHERE ID = '$ID'");
+        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET pinged = CONCAT(pinged, '\n', '$tb_url') WHERE ID = %d", $ID) );
+        return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_url', '')) WHERE ID = %d", $ID) );
 }
 

trunk/wp-includes/post.php

@@ -475 +475 @@
         $query .= empty( $post_parent ) ? '' : $wpdb->prepare("AND $wpdb->posts.post_parent = %d ", $post_parent);
         // expected_slashed ($meta_key, $meta_value) -- Also, this looks really funky, doesn't seem like it works
-        $query .= empty( $meta_key ) | empty($meta_value)  ? '' : " AND ($wpdb->posts.ID = $wpdb->postmeta.post_id AND $wpdb->postmeta.meta_key = '$meta_key' AND $wpdb->postmeta.meta_value = '$meta_value' )";
+        $query .= empty( $meta_key ) | empty($meta_value)  ? '' : $wpdb->prepare(" AND ($wpdb->posts.ID = $wpdb->postmeta.post_id AND $wpdb->postmeta.meta_key = %s AND $wpdb->postmeta.meta_value = %s )", $meta_key, $meta_value);
         $query .= empty( $post_mime_type ) ? '' : wp_post_mime_type_where($post_mime_type);
         $query .= " GROUP BY $wpdb->posts.ID ORDER BY " . $orderby . ' ' . $order;
@@ -1961 +1961 @@
         $query .= " WHERE (post_type = 'page' AND post_status = 'publish') $exclusions $inclusions " ;
         // expected_slashed ($meta_key, $meta_value) -- also, it looks funky
-        $query .= ( empty( $meta_key ) | empty($meta_value)  ? "" : " AND ($wpdb->posts.ID = $wpdb->postmeta.post_id AND $wpdb->postmeta.meta_key = '$meta_key' AND $wpdb->postmeta.meta_value = '$meta_value' )" ) ;
+        $query .= ( empty( $meta_key ) | empty($meta_value)  ? "" : $wpdb->prepare(" AND ($wpdb->posts.ID = $wpdb->postmeta.post_id AND $wpdb->postmeta.meta_key = %s AND $wpdb->postmeta.meta_value = %s )", $meta_key, $meta_value) ) ;
         $query .= $author_query;
         $query .= " ORDER BY " . $sort_column . " " . $sort_order ;
@@ -2738 +2738 @@
         do_action('clean_page_cache', $id);
 
-        if ( $children = $wpdb->get_col( "SELECT ID FROM $wpdb->posts WHERE post_parent = '$id'" ) )
+        if ( $children = $wpdb->get_col( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_parent = %d", $id) ) )
                 foreach( $children as $cid )
                         clean_post_cache( $cid );
@@ -2975 +2975 @@
 
     $id = $_post->ancestors[] = $_post->post_parent;
-    while ( $ancestor = $wpdb->get_var("SELECT `post_parent` FROM $wpdb->posts WHERE ID= '{$id}' LIMIT 1") ) {
+    while ( $ancestor = $wpdb->get_var( $wpdb->prepare("SELECT `post_parent` FROM $wpdb->posts WHERE ID = %d LIMIT 1", $id) ) ) {
         if ( $id == $ancestor )
                 break;

trunk/wp-includes/taxonomy.php

@@ -750 +750 @@
 
         if ( !empty($taxonomy) )
-                return $wpdb->get_row("SELECT tt.term_id, tt.term_taxonomy_id FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy as tt ON tt.term_id = t.term_id WHERE $where AND tt.taxonomy = '$taxonomy'", ARRAY_A);
+                return $wpdb->get_row( $wpdb->prepare("SELECT tt.term_id, tt.term_taxonomy_id FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy as tt ON tt.term_id = t.term_id WHERE $where AND tt.taxonomy = %s", $taxonomy), ARRAY_A);
 
         return $wpdb->get_var("SELECT term_id FROM $wpdb->terms as t WHERE $where");
@@ -889 +889 @@
                 $where = 'AND count > 0';
 
-        $taxonomy = $wpdb->escape( $taxonomy );
-        return $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->term_taxonomy WHERE taxonomy = '$taxonomy' $where");
+        return $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->term_taxonomy WHERE taxonomy = %s $where", $taxonomy) );
 }
 
@@ -919 +918 @@
                 $terms = wp_get_object_terms($object_id, $taxonomy, 'fields=tt_ids');
                 $in_terms = "'" . implode("', '", $terms) . "'";
-                $wpdb->query("DELETE FROM $wpdb->term_relationships WHERE object_id = '$object_id' AND term_taxonomy_id IN ($in_terms)");
+                $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->term_relationships WHERE object_id = %d AND term_taxonomy_id IN ($in_terms)", $object_id) );
                 wp_update_term_count($terms, $taxonomy);
         }
@@ -1294 +1293 @@
                 if ( $delete_terms ) {
                         $in_delete_terms = "'" . implode("', '", $delete_terms) . "'";
-                        $wpdb->query("DELETE FROM $wpdb->term_relationships WHERE object_id = '$object_id' AND term_taxonomy_id IN ($in_delete_terms)");
+                        $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->term_relationships WHERE object_id = %d AND term_taxonomy_id IN ($in_delete_terms)", $object_id) );
                         wp_update_term_count($delete_terms, $taxonomy);
                 }

trunk/wp-includes/user.php

@@ -58 +58 @@
         if ( !$user )
                 $user = $wpdb->escape($_COOKIE[USER_COOKIE]);
-        return $wpdb->get_var("SELECT $field FROM $wpdb->users WHERE user_login = '$user'");
+        return $wpdb->get_var( $wpdb->prepare("SELECT $field FROM $wpdb->users WHERE user_login = %s", $user) );
 }
 
@@ -64 +64 @@
         global $wpdb;
         $userid = (int) $userid;
-        return $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->posts WHERE post_author = '$userid' AND post_type = 'post' AND " . get_private_posts_cap_sql('post'));
+        return $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->posts WHERE post_author = %d AND post_type = 'post' AND ", $userid) . get_private_posts_cap_sql('post'));
 }
 
@@ -131 +131 @@
 
         if ( ! empty($meta_value) )
-                $wpdb->query("DELETE FROM $wpdb->usermeta WHERE user_id = '$user_id' AND meta_key = '$meta_key' AND meta_value = '$meta_value'");
-        else
-                $wpdb->query("DELETE FROM $wpdb->usermeta WHERE user_id = '$user_id' AND meta_key = '$meta_key'");
+                $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->usermeta WHERE user_id = %d AND meta_key = %s AND meta_value = %s", $userid, $meta_key, $meta_value) );
+        else
+                $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->usermeta WHERE user_id = %d AND meta_key = %s", $user_id, $meta_key) );
 
         wp_cache_delete($user_id, 'users');
@@ -149 +149 @@
         if ( !empty($meta_key) ) {
                 $meta_key = preg_replace('|[^a-z0-9_]|i', '', $meta_key);
-                $metas = $wpdb->get_results("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = '$user_id' AND meta_key = '$meta_key'");
+                $metas = $wpdb->get_results( $wpdb->prepare("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = %d AND meta_key = %s", $user_id, $meta_key) );
         } else {
-                $metas = $wpdb->get_results("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = '$user_id'");
+                $metas = $wpdb->get_results( $wpdb->prepare("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = %d", $user_id) );
         }
 
@@ -186 +186 @@
         }
 
-        $cur = $wpdb->get_row("SELECT * FROM $wpdb->usermeta WHERE user_id = '$user_id' AND meta_key = '$meta_key'");
+        $cur = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->usermeta WHERE user_id = %d AND meta_key = %d", $user_id, $meta_key) );
         if ( !$cur ) {
                 $wpdb->query("INSERT INTO $wpdb->usermeta ( user_id, meta_key, meta_value )
@@ -192 +192 @@
                 ( '$user_id', '$meta_key', '$meta_value' )");
         } else if ( $cur->meta_value != $meta_value ) {
-                $wpdb->query("UPDATE $wpdb->usermeta SET meta_value = '$meta_value' WHERE user_id = '$user_id' AND meta_key = '$meta_key'");
+                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->usermeta SET meta_value = %s WHERE user_id = %d AND meta_key = %s", $meta_value, $user_id, $meta_key) );
         } else {
                 return false;

trunk/wp-trackback.php

@@ -87 +87 @@
         $comment_type = 'trackback';
 
-        $dupe = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND comment_author_url = '$comment_author_url'");
+        $dupe = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s", $comment_post_ID, $comment_author_url) );
         if ( $dupe )
                 trackback_response(1, 'We already have a ping from that URL for this post.');

trunk/xmlrpc.php

@@ -1353 +1353 @@
                         foreach( $attachments as $file ) {
                                 if( strpos( $post_content, $file->guid ) !== false ) {
-                                        $wpdb->query( "UPDATE {$wpdb->posts} SET post_parent = '$post_ID' WHERE ID = '{$file->ID}'" );
+                                        $wpdb->query( $wpdb->prepare("UPDATE {$wpdb->posts} SET post_parent = %d WHERE ID = %d", $post_ID, $file->ID) );
                                 }
                         }
@@ -2094 +2094 @@
                 }
 
-                $comments = $wpdb->get_results("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = $post_ID");
+                $comments = $wpdb->get_results( $wpdb->prepare("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
 
                 if (!$comments) {
@@ -2207 +2207 @@
                                 // ...or a string #title, a little more complicated
                                 $title = preg_replace('/[^a-z0-9]/i', '.', $urltest['fragment']);
-                                $sql = "SELECT ID FROM $wpdb->posts WHERE post_title RLIKE '$title'";
+                                $sql = $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", $title);
                                 if (! ($post_ID = $wpdb->get_var($sql)) ) {
                                         // returning unknown error '0' is better than die()ing
@@ -2236 +2236 @@
 
                 // Let's check that the remote site didn't already pingback this entry
-                $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post_ID' AND comment_author_url = '$pagelinkedfrom'");
+                $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s", $post_ID, $pagelinkedfrom) );
 
                 if ( $wpdb->num_rows ) // We already have a Pingback from this URL
@@ -2345 +2345 @@
                 }
 
-                $comments = $wpdb->get_results("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = $post_ID");
+                $comments = $wpdb->get_results( $wpdb->prepare("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
 
                 if (!$comments) {