Changeset 7645

Timestamp:

04/14/2008 04:13:25 PM (17 years ago)

Author:

ryan

Message:

Prepare DB queries in more places. Props filosofo. see #6644

Location:

trunk

Files:

• wp-admin/admin-ajax.php (modified) (1 diff)
• wp-admin/edit-comments.php (modified) (1 diff)
• wp-admin/edit-pages.php (modified) (1 diff)
• wp-admin/edit.php (modified) (1 diff)
• wp-admin/import/blogger.php (modified) (2 diffs)
• wp-admin/import/dotclear.php (modified) (2 diffs)
• wp-admin/import/textpattern.php (modified) (2 diffs)
• wp-admin/import/wp-cat2tag.php (modified) (2 diffs)
• wp-admin/includes/bookmark.php (modified) (2 diffs)
• wp-admin/includes/comment.php (modified) (2 diffs)
• wp-admin/includes/export.php (modified) (3 diffs)
• wp-admin/includes/post.php (modified) (8 diffs)
• wp-admin/includes/template.php (modified) (1 diff)
• wp-admin/includes/upgrade.php (modified) (24 diffs)
• wp-admin/includes/user.php (modified) (10 diffs)
• wp-admin/update-links.php (modified) (1 diff)
• wp-admin/upload.php (modified) (1 diff)
• wp-comments-post.php (modified) (1 diff)
• wp-includes/comment.php (modified) (11 diffs)
• wp-includes/post.php (modified) (4 diffs)
• wp-includes/taxonomy.php (modified) (4 diffs)
• wp-includes/user.php (modified) (6 diffs)
• wp-trackback.php (modified) (1 diff)
• xmlrpc.php (modified) (5 diffs)

trunk/wp-admin/admin-ajax.php

@@ -16 +16 @@
     if ( strstr( $s, ',' ) )
         die; // it's a multiple tag insert, we won't find anything
-    $results = $wpdb->get_col( "SELECT name FROM $wpdb->terms WHERE name LIKE ('%$s%')" );
+    $results = $wpdb->get_col( $wpdb->prepare("SELECT name FROM $wpdb->terms WHERE name LIKE (%s)", '%' . $s . '%') );
     echo join( $results, "\n" );
     die;

trunk/wp-admin/edit-comments.php

@@ -13 +13 @@
     foreach ($_REQUEST['delete_comments'] as $comment) : // Check the permissions on each
         $comment = (int) $comment;
-        $post_id = (int) $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = $comment");
-        // $authordata = get_userdata( $wpdb->get_var("SELECT post_author FROM $wpdb->posts WHERE ID = $post_id") );
+        $post_id = (int) $wpdb->get_var( $wpdb->prepare( "SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = %d", $comment) );
         if ( !current_user_can('edit_post', $post_id) )
             continue;

trunk/wp-admin/edit-pages.php

@@ -176 +176 @@
 if ( 1 == count($posts) && is_singular() ) :
 
-    $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $id AND comment_approved != 'spam' ORDER BY comment_date");
+    $comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved != 'spam' ORDER BY comment_date", $id) );
     if ( $comments ) :
         // Make sure comments, post, and post_author are cached

trunk/wp-admin/edit.php

@@ -206 +206 @@
 if ( 1 == count($posts) && is_singular() ) :
 
-    $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $id AND comment_approved != 'spam' ORDER BY comment_date");
+    $comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved != 'spam' ORDER BY comment_date", $id) );
     if ( $comments ) :
         // Make sure comments, post, and post_author are cached

trunk/wp-admin/import/blogger.php

@@ -642 +642 @@
 
         // Get an array of posts => authors
-        $post_ids = (array) $wpdb->get_col("SELECT post_id FROM $wpdb->postmeta WHERE meta_key = 'blogger_blog' AND meta_value = '$host'");
+        $post_ids = (array) $wpdb->get_col( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_key = 'blogger_blog' AND meta_value = %s", $host) );
         $post_ids = join( ',', $post_ids );
         $results = (array) $wpdb->get_results("SELECT post_id, meta_value FROM $wpdb->postmeta WHERE meta_key = 'blogger_author' AND post_id IN ($post_ids)");
@@ -659 +659 @@
             $post_ids = join( ',', $post_ids);
 
-            $wpdb->query("UPDATE $wpdb->posts SET post_author = $user_id WHERE id IN ($post_ids)");
+            $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_author = %d WHERE id IN ($post_ids)", $user_id) );
             $this->blogs[$importing_blog]['authors'][$author][1] = $user_id;
         }

trunk/wp-admin/import/dotclear.php

@@ -14 +14 @@
     {
         global $wpdb;
-        return $wpdb->get_var('SELECT count(*) FROM '.$wpdb->comments.' WHERE comment_post_ID = '.$post_ID);
+        return $wpdb->get_var( $wpdb->prepare("SELECT count(*) FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
     }
 }
@@ -23 +23 @@
     {
         global $wpdb;
-        return $wpdb->get_var('SELECT link_id FROM '.$wpdb->links.' WHERE link_name = "'.$linkname.'"');
+        return $wpdb->get_var( $wpdb->prepare("SELECT link_id FROM $wpdb->links WHERE link_name = %s", $linkname) );
     }
 }

trunk/wp-admin/import/textpattern.php

@@ -9 +9 @@
     {
         global $wpdb;
-        return $wpdb->get_var('SELECT count(*) FROM '.$wpdb->comments.' WHERE comment_post_ID = '.$post_ID);
+        return $wpdb->get_var( $wpdb->prepare("SELECT count(*) FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
     }
 }
@@ -18 +18 @@
     {
         global $wpdb;
-        return $wpdb->get_var('SELECT link_id FROM '.$wpdb->links.' WHERE link_name = "'.$wpdb->escape($linkname).'"');
+        return $wpdb->get_var( $wpdb->prepare("SELECT link_id FROM $wpdb->links WHERE link_name = %s", $linkname) );
     }
 }

trunk/wp-admin/import/wp-cat2tag.php

@@ -165 +165 @@
                     $posts = get_objects_in_term($category->term_id, 'category');
                     foreach ( $posts as $post ) {
-                        if ( !$wpdb->get_var("SELECT object_id FROM $wpdb->term_relationships WHERE object_id = '$post' AND term_taxonomy_id = '$id'") )
-                            $wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ('$post', '$id')");
+                        if ( !$wpdb->get_var( $wpdb->prepare("SELECT object_id FROM $wpdb->term_relationships WHERE object_id = %d AND term_taxonomy_id = %d", $post, $id) ) )
+                            $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES (%d, %d)", $post, $id) );
                         clean_post_cache($post);
                     }
                 } else {
-                    $tt_ids = $wpdb->get_col("SELECT term_taxonomy_id FROM $wpdb->term_taxonomy WHERE term_id = '{$category->term_id}' AND taxonomy = 'category'");
+                    $tt_ids = $wpdb->get_col( $wpdb->prepare("SELECT term_taxonomy_id FROM $wpdb->term_taxonomy WHERE term_id = %d AND taxonomy = 'category'", $category->term_id) );
                     if ( $tt_ids ) {
                         $posts = $wpdb->get_col("SELECT object_id FROM $wpdb->term_relationships WHERE term_taxonomy_id IN (" . join(',', $tt_ids) . ") GROUP BY object_id");
@@ -178 +178 @@
 
                     // Change the category to a tag.
-                    $wpdb->query("UPDATE $wpdb->term_taxonomy SET taxonomy = 'post_tag' WHERE term_id = '{$category->term_id}' AND taxonomy = 'category'");
-
-                    $terms = $wpdb->get_col("SELECT term_id FROM $wpdb->term_taxonomy WHERE parent = '{$category->term_id}' AND taxonomy = 'category'");
+                    $wpdb->query( $wpdb->prepare("UPDATE $wpdb->term_taxonomy SET taxonomy = 'post_tag' WHERE term_id = %d AND taxonomy = 'category'", $category->term_id) );
+
+                    $terms = $wpdb->get_col( $wpdb->prepare("SELECT term_id FROM $wpdb->term_taxonomy WHERE parent = %d AND taxonomy = 'category'", $category->term_id) );
                     foreach ( (array) $terms as $term )
                         clean_category_cache($term);
 
                     // Set all parents to 0 (root-level) if their parent was the converted tag
-                    $wpdb->query("UPDATE $wpdb->term_taxonomy SET parent = 0 WHERE parent = '{$category->term_id}' AND taxonomy = 'category'");
+                    $wpdb->query( $wpdb->prepare("UPDATE $wpdb->term_taxonomy SET parent = 0 WHERE parent = %d AND taxonomy = 'category'", $category->term_id) );
                 }
                 // Clean the cache

trunk/wp-admin/includes/bookmark.php

@@ -48 +48 @@
     wp_delete_object_term_relationships($link_id, 'link_category');
 
-    $wpdb->query("DELETE FROM $wpdb->links WHERE link_id = '$link_id'");
+    $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->links WHERE link_id = %d", $link_id) );
 
     do_action('deleted_link', $link_id);
@@ -120 +120 @@
 
     if ( $update ) {
-        $wpdb->query("UPDATE $wpdb->links SET link_url='$link_url',
-            link_name='$link_name', link_image='$link_image',
-            link_target='$link_target',
-            link_visible='$link_visible', link_description='$link_description',
-            link_rating='$link_rating', link_rel='$link_rel',
-            link_notes='$link_notes', link_rss = '$link_rss'
-            WHERE link_id='$link_id'");
+        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->links SET link_url = %s,
+            link_name = %s, link_image = %s, link_target = %s, 
+            link_visible = %s, link_description = %s, link_rating = %s, 
+            link_rel = %s, link_notes = %s, link_rss = %s
+            WHERE link_id = %s", $link_url, $link_name, $link_image, $link_target, $link_visible, $link_description, $link_rating, $link_rel, $link_notes, $link_rss, $link_id) );
     } else {
-        $wpdb->query("INSERT INTO $wpdb->links (link_url, link_name, link_image, link_target, link_description, link_visible, link_owner, link_rating, link_rel, link_notes, link_rss) VALUES('$link_url','$link_name', '$link_image', '$link_target', '$link_description', '$link_visible', '$link_owner', '$link_rating', '$link_rel', '$link_notes', '$link_rss')");
+        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->links (link_url, link_name, link_image, link_target, link_description, link_visible, link_owner, link_rating, link_rel, link_notes, link_rss) VALUES(%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)", 
+        $link_url,$link_name, $link_image, $link_target, $link_description, $link_visible, $link_owner, $link_rating, $link_rel, $link_notes, $link_rss) );
         $link_id = (int) $wpdb->insert_id;
     }

trunk/wp-admin/includes/comment.php

@@ -4 +4 @@
     global $wpdb;
 
-    return $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments
-            WHERE comment_author = '$comment_author' AND comment_date = '$comment_date'");
+    return $wpdb->get_var( $wpdb->prepare("SELECT comment_post_ID FROM $wpdb->comments
+            WHERE comment_author = %s AND comment_date = %s", $comment_author, $comment_date) );
 }
 
@@ -68 +68 @@
     global $wpdb;
     $post_id = (int) $post_id;
-    $pending = $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = $post_id AND comment_approved = '0'" );
+    $pending = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '0'", $post_id) );
     return $pending;
 }

trunk/wp-admin/includes/export.php

@@ -18 +18 @@
 if ( $author and $author != 'all' ) {
     $author_id = (int) $author;
-    $where = " WHERE post_author = '$author_id' ";
+    $where = $wpdb->prepare(" WHERE post_author = %d ", $author_id);
 }
 
@@ -218 +218 @@
 <?php } ?>
 <?php
-$postmeta = $wpdb->get_results("SELECT * FROM $wpdb->postmeta WHERE post_id = $post->ID");
+$postmeta = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->postmeta WHERE post_id = %d", $post->ID) );
 if ( $postmeta ) {
 ?>
@@ -229 +229 @@
 <?php } ?>
 <?php
-$comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $post->ID");
+$comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d", $post->ID) );
 if ( $comments ) { foreach ( $comments as $c ) { ?>
 <wp:comment>

trunk/wp-admin/includes/post.php

@@ -195 +195 @@
 
     if (!empty ($post_date))
-        $post_date = "AND post_date = '$post_date'";
+        $post_date = $wpdb->prepare("AND post_date = %s", $post_date);
 
     if (!empty ($title))
-        return $wpdb->get_var("SELECT ID FROM $wpdb->posts WHERE post_title = '$title' $post_date");
+        return $wpdb->get_var( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title = %s $post_date", $title) );
     else
         if (!empty ($content))
-            return $wpdb->get_var("SELECT ID FROM $wpdb->posts WHERE post_content = '$content' $post_date");
+            return $wpdb->get_var( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_content = %s $post_date", $content) );
 
     return 0;
@@ -381 +381 @@
         wp_cache_delete($post_ID, 'post_meta');
 
-        $wpdb->query( "
-                INSERT INTO $wpdb->postmeta
-                (post_id,meta_key,meta_value )
-                VALUES ('$post_ID','$metakey','$metavalue' )
-            " );
+        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->postmeta 
+            (post_id,meta_key,meta_value ) VALUES (%s, %s, %s)",
+            $post_ID, $metakey, $metavalue) );
         return $wpdb->insert_id;
     }
@@ -395 +393 @@
     $mid = (int) $mid;
 
-    $post_id = $wpdb->get_var("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = '$mid'");
+    $post_id = $wpdb->get_var( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
     wp_cache_delete($post_id, 'post_meta');
 
-    return $wpdb->query( "DELETE FROM $wpdb->postmeta WHERE meta_id = '$mid'" );
+    return $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
 }
 
@@ -418 +416 @@
     $mid = (int) $mid;
 
-    $meta = $wpdb->get_row( "SELECT * FROM $wpdb->postmeta WHERE meta_id = '$mid'" );
+    $meta = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
     if ( is_serialized_string( $meta->meta_value ) )
         $meta->meta_value = maybe_unserialize( $meta->meta_value );
@@ -428 +426 @@
     global $wpdb;
 
-    return $wpdb->get_results( "
-            SELECT meta_key, meta_value, meta_id, post_id
-            FROM $wpdb->postmeta
-            WHERE post_id = '$postid'
-            ORDER BY meta_key,meta_id", ARRAY_A );
+    return $wpdb->get_results( $wpdb->prepare("SELECT meta_key, meta_value, meta_id, post_id
+            FROM $wpdb->postmeta WHERE post_id = %d
+            ORDER BY meta_key,meta_id", $postid), ARRAY_A );
 
 }
@@ -444 +440 @@
         return false;
 
-    $post_id = $wpdb->get_var("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = '$mid'");
+    $post_id = $wpdb->get_var( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = %d", $mid) );
     wp_cache_delete($post_id, 'post_meta');
 
@@ -450 +446 @@
     $mvalue = $wpdb->escape( $mvalue );
     $mid = (int) $mid;
-    return $wpdb->query( "UPDATE $wpdb->postmeta SET meta_key = '$mkey', meta_value = '$mvalue' WHERE meta_id = '$mid'" );
+    return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->postmeta SET meta_key = %s, meta_value = %s WHERE meta_id = %d", $mkey, $mvalue, $mid) );
 }
 
@@ -503 +499 @@
     $old_ID = (int) $old_ID;
     $new_ID = (int) $new_ID;
-    return $wpdb->query( "UPDATE $wpdb->posts SET post_parent = $new_ID WHERE post_parent = $old_ID" );
+    return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_parent = %d WHERE post_parent = %d", $new_ID, $old_ID) );
 }
 

trunk/wp-admin/includes/template.php

@@ -893 +893 @@
 function parent_dropdown( $default = 0, $parent = 0, $level = 0 ) {
     global $wpdb, $post_ID;
-    $items = $wpdb->get_results( "SELECT ID, post_parent, post_title FROM $wpdb->posts WHERE post_parent = $parent AND post_type = 'page' ORDER BY menu_order" );
+    $items = $wpdb->get_results( $wpdb->prepare("SELECT ID, post_parent, post_title FROM $wpdb->posts WHERE post_parent = %d AND post_type = 'page' ORDER BY menu_order", $parent) );
 
     if ( $items ) {

trunk/wp-admin/includes/upgrade.php

@@ -219 +219 @@
             if ('' == $post->post_name) {
                 $newtitle = sanitize_title($post->post_title);
-                $wpdb->query("UPDATE $wpdb->posts SET post_name = '$newtitle' WHERE ID = '$post->ID'");
+                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_name = %s WHERE ID = %d", $newtitle, $post->ID) );
             }
         }
@@ -228 +228 @@
         if ('' == $category->category_nicename) {
             $newtitle = sanitize_title($category->cat_name);
-            $wpdb->query("UPDATE $wpdb->categories SET category_nicename = '$newtitle' WHERE cat_ID = '$category->cat_ID'");
+            $wpdb->query( $wpdb->prepare("UPDATE $wpdb->categories SET category_nicename = %s WHERE cat_ID = %d", $newtitle, $category->cat_ID) );
         }
     }
@@ -251 +251 @@
         foreach ($allposts as $post) {
             // Check to see if it's already been imported
-            $cat = $wpdb->get_row("SELECT * FROM $wpdb->post2cat WHERE post_id = $post->ID AND category_id = $post->post_category");
+            $cat = $wpdb->get_row( $wpdb->("SELECT * FROM $wpdb->post2cat WHERE post_id = %d AND category_id = %d", $post->ID, $post->post_category) );
             if (!$cat && 0 != $post->post_category) { // If there's no result
-                $wpdb->query("
-                    INSERT INTO $wpdb->post2cat
+                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->post2cat
                     (post_id, category_id)
-                    VALUES
-                    ('$post->ID', '$post->post_category')
-                    ");
+                    VALUES (%s, %s)
+                    ", $post->ID, $post->post_category) );
             }
         }
@@ -286 +284 @@
         if ('' == $user->user_nicename) {
             $newname = sanitize_title($user->user_nickname);
-            $wpdb->query("UPDATE $wpdb->users SET user_nicename = '$newname' WHERE ID = '$user->ID'");
+            $wpdb->query( $wpdb->prepare("UPDATE $wpdb->users SET user_nicename = %s WHERE ID = %d", $newname, $user->ID) );
         }
     }
@@ -402 +400 @@
         if ( 1 != $option->dupes ) { // Could this be done in the query?
             $limit = $option->dupes - 1;
-            $dupe_ids = $wpdb->get_col("SELECT option_id FROM $wpdb->options WHERE option_name = '$option->option_name' LIMIT $limit");
+            $dupe_ids = $wpdb->get_col( $wpdb->prepare("SELECT option_id FROM $wpdb->options WHERE option_name = %s LIMIT %d", $option->option_name, $limit) );
             $dupe_ids = join($dupe_ids, ',');
             $wpdb->query("DELETE FROM $wpdb->options WHERE option_id IN ($dupe_ids)");
@@ -446 +444 @@
             if ($idmode == 'namelf') $id = $user->user_lastname.' '.$user->user_firstname;
             if (!$idmode) $id = $user->user_nickname;
-            $id = $wpdb->escape( $id );
-            $wpdb->query("UPDATE $wpdb->users SET display_name = '$id' WHERE ID = '$user->ID'");
+            $wpdb->query( $wpdb->prepare("UPDATE $wpdb->users SET display_name = %s WHERE ID = %d", $id, $user->ID) );
         endif;
 
@@ -469 +466 @@
     if( is_array( $comments ) ) {
         foreach ($comments as $comment) {
-            $wpdb->query( "UPDATE $wpdb->posts SET comment_count = $comment->c WHERE ID = '$comment->comment_post_ID'" );
+            $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET comment_count = %d WHERE ID = %d", $comment->c, $comment->comment_post_ID) );
         }
     }
@@ -478 +475 @@
         $objects = $wpdb->get_results("SELECT ID, post_type FROM $wpdb->posts WHERE post_status = 'object'");
         foreach ($objects as $object) {
-            $wpdb->query("UPDATE $wpdb->posts SET post_status = 'attachment',
-            post_mime_type = '$object->post_type',
+            $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_status = 'attachment',
+            post_mime_type = %s,
             post_type = ''
-            WHERE ID = $object->ID");
+            WHERE ID = %d", $object->post_type, $object->ID) );
 
             $meta = get_post_meta($object->ID, 'imagedata', true);
@@ -509 +506 @@
             }
 
-            $wpdb->query("UPDATE $wpdb->posts SET post_status = '$status', post_type = '$type' WHERE ID = '$post->ID'");
+            $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_status = %s, post_type = %s WHERE ID = %d", $status, $type, $post->ID) );
         }
     }
@@ -542 +539 @@
     foreach ($categories as $category) {
         $term_id = (int) $category->cat_ID;
-        $name = $wpdb->escape($category->cat_name);
-        $description = $wpdb->escape($category->category_description);
-        $slug = $wpdb->escape($category->category_nicename);
-        $parent = $wpdb->escape($category->category_parent);
         $term_group = 0;
 
         // Associate terms with the same slug in a term group and make slugs unique.
-        if ( $exists = $wpdb->get_results("SELECT term_id, term_group FROM $wpdb->terms WHERE slug = '$slug'") ) {
+        if ( $exists = $wpdb->get_results( $wpdb->prepare("SELECT term_id, term_group FROM $wpdb->terms WHERE slug = %s", $slug) ) ) {
             $term_group = $exists[0]->term_group;
             $id = $exists[0]->term_id;
@@ -556 +549 @@
                 $alt_slug = $slug . "-$num";
                 $num++;
-                $slug_check = $wpdb->get_var("SELECT slug FROM $wpdb->terms WHERE slug = '$alt_slug'");
+                $slug_check = $wpdb->get_var( $wpdb->prepare("SELECT slug FROM $wpdb->terms WHERE slug = %s", $alt_slug) );
             } while ( $slug_check );
 
@@ -563 +556 @@
             if ( empty( $term_group ) ) {
                 $term_group = $wpdb->get_var("SELECT MAX(term_group) FROM $wpdb->terms GROUP BY term_group") + 1;
-                $wpdb->query("UPDATE $wpdb->terms SET term_group = '$term_group' WHERE term_id = '$id'");
+                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->terms SET term_group = %d WHERE term_id = %d", $term_group, $id) );
             }
         }
 
-        $wpdb->query("INSERT INTO $wpdb->terms (term_id, name, slug, term_group) VALUES ('$term_id', '$name', '$slug', '$term_group')");
+        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->terms (term_id, name, slug, term_group) VALUES 
+        (%d, %s, %s, %d)", $term_id, $name, $slug, $term_group) );
 
         $count = 0;
@@ -573 +567 @@
             $count = (int) $category->category_count;
             $taxonomy = 'category';
-            $wpdb->query("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')");
+            $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
             $tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
         }
@@ -580 +574 @@
             $count = (int) $category->link_count;
             $taxonomy = 'link_category';
-            $wpdb->query("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')");
+            $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
             $tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
         }
@@ -588 +582 @@
             $count = (int) $category->tag_count;
             $taxonomy = 'post_tag';
-            $wpdb->query("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')");
+            $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
             $tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
         }
@@ -595 +589 @@
             $count = 0;
             $taxonomy = 'category';
-            $wpdb->query("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', '$taxonomy', '$description', '$parent', '$count')");
+            $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ( %d, %s, %s, %d, %d)", $term_id, $taxonomy, $description, $parent, $count) );
             $tt_ids[$term_id][$taxonomy] = (int) $wpdb->insert_id;
         }
@@ -615 +609 @@
             continue;
 
-        $wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ('$post_id', '$tt_id')");
+        $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ( %d, %d)", $post_id, $tt_id) );
     }
 
@@ -634 +628 @@
 
             // Associate terms with the same slug in a term group and make slugs unique.
-            if ( $exists = $wpdb->get_results("SELECT term_id, term_group FROM $wpdb->terms WHERE slug = '$slug'") ) {
+            if ( $exists = $wpdb->get_results( $wpdb->prepare("SELECT term_id, term_group FROM $wpdb->terms WHERE slug = %s", $slug) ) ) {
                 $term_group = $exists[0]->term_group;
                 $term_id = $exists[0]->term_id;
@@ -640 +634 @@
 
             if ( empty($term_id) ) {
-                $wpdb->query("INSERT INTO $wpdb->terms (name, slug, term_group) VALUES ('$name', '$slug', '$term_group')");
+                $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->terms (name, slug, term_group) VALUES (%s, %s, %d)", $name, $slug, $term_group) );
                 $term_id = (int) $wpdb->insert_id;
             }
@@ -647 +641 @@
             $default_link_cat = $term_id;
 
-            $wpdb->query("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES ('$term_id', 'link_category', '', '0', '0')");
+            $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_taxonomy (term_id, taxonomy, description, parent, count) VALUES (%d, 'link_category', '', '0', '0')", $term_id) );
             $tt_ids[$term_id] = (int) $wpdb->insert_id;
         }
@@ -663 +657 @@
                 continue;
 
-            $wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ('$link->link_id', '$tt_id')");
+            $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ( %d, %d)", $link->link_id, $tt_id) );
         }
 
@@ -678 +672 @@
                 continue;
 
-            $wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ('$link_id', '$tt_id')");
+            $wpdb->query("INSERT INTO $wpdb->term_relationships (object_id, term_taxonomy_id) VALUES ( %d, %d)", $link_id, $tt_id) );
         }
     }
@@ -691 +685 @@
     foreach ( (array) $terms as $term ) {
         if ( ('post_tag' == $term->taxonomy) || ('category' == $term->taxonomy) )
-            $count = $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->term_relationships, $wpdb->posts WHERE $wpdb->posts.ID = $wpdb->term_relationships.object_id AND post_status = 'publish' AND post_type = 'post' AND term_taxonomy_id = '$term->term_taxonomy_id'");
+            $count = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->term_relationships, $wpdb->posts WHERE $wpdb->posts.ID = $wpdb->term_relationships.object_id AND post_status = 'publish' AND post_type = 'post' AND term_taxonomy_id = %d", $term->term_taxonomy_id) );
         else
-            $count = $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->term_relationships WHERE term_taxonomy_id = '$term->term_taxonomy_id'");
-        $wpdb->query("UPDATE $wpdb->term_taxonomy SET count = '$count' WHERE term_taxonomy_id = '$term->term_taxonomy_id'");
+            $count = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->term_relationships WHERE term_taxonomy_id = %d", $term->term_taxonomy_id) );
+        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->term_taxonomy SET count = %d WHERE term_taxonomy_id = %d", $count, $term->term_taxonomy_id) );
     }
 }
@@ -824 +818 @@
     }
 
-    $option = $wpdb->get_var("SELECT option_value FROM $wpdb->options WHERE option_name = '$setting'");
+    $option = $wpdb->get_var( $wpdb->prepare("SELECT option_value FROM $wpdb->options WHERE option_name = %s", $setting) );
 
     if ( 'home' == $setting && '' == $option )

trunk/wp-admin/includes/user.php

@@ -142 +142 @@
     global $wpdb;
     $level_key = $wpdb->prefix . 'user_level';
-
-    $query = "SELECT user_id FROM $wpdb->usermeta WHERE meta_key = '$level_key' AND meta_value != '0'";
-
-    return $wpdb->get_col( $query );
+    return $wpdb->get_col( $wpdb->prepare("SELECT user_id FROM $wpdb->usermeta WHERE meta_key = %s AND meta_value != '0'", $level_key) );
 }
 
@@ -177 +174 @@
     $level_key = $wpdb->prefix . 'user_level';
 
-    $query = "SELECT user_id FROM $wpdb->usermeta WHERE meta_key = '$level_key'";
+    $query = $wpdb->prepare("SELECT user_id FROM $wpdb->usermeta WHERE meta_key = %s", $level_key);
     if ( $exclude_zeros )
         $query .= " AND meta_value != '0'";
@@ -188 +185 @@
     $level_key = $wpdb->prefix . 'user_level';
 
-    $query = "SELECT user_id FROM $wpdb->usermeta WHERE meta_key = '$level_key' AND meta_value = '0'";
-
-    return $wpdb->get_col( $query );
+    return $wpdb->get_col( $wpdb->prepare("SELECT user_id FROM $wpdb->usermeta WHERE meta_key = %s AND meta_value = '0'", $level_key) );
 }
 
@@ -209 +204 @@
     } else {
         $editable = join(',', $editable);
-        $other_unpubs = $wpdb->get_results("SELECT ID, post_title, post_author FROM $wpdb->posts WHERE post_type = 'post' AND $type_sql AND post_author IN ($editable) AND post_author != '$user_id' ORDER BY post_modified $dir");
+        $other_unpubs = $wpdb->get_results( $wpdb->prepare("SELECT ID, post_title, post_author FROM $wpdb->posts WHERE post_type = 'post' AND $type_sql AND post_author IN ($editable) AND post_author != %d ORDER BY post_modified $dir", $user_id) );
     }
 
@@ -242 +237 @@
 function get_users_drafts( $user_id ) {
     global $wpdb;
-    $user_id = (int) $user_id;
-    $query = "SELECT ID, post_title FROM $wpdb->posts WHERE post_type = 'post' AND post_status = 'draft' AND post_author = $user_id ORDER BY post_modified DESC";
+    $query = $wpdb->prepare("SELECT ID, post_title FROM $wpdb->posts WHERE post_type = 'post' AND post_status = 'draft' AND post_author = %d ORDER BY post_modified DESC", $user_id);
     $query = apply_filters('get_users_drafts', $query);
     return $wpdb->get_results( $query );
@@ -254 +248 @@
 
     if ($reassign == 'novalue') {
-        $post_ids = $wpdb->get_col("SELECT ID FROM $wpdb->posts WHERE post_author = $id");
+        $post_ids = $wpdb->get_col( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_author = %d", $id) );
 
         if ($post_ids) {
@@ -262 +256 @@
 
         // Clean links
-        $wpdb->query("DELETE FROM $wpdb->links WHERE link_owner = $id");
+        $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->links WHERE link_owner = %d", $id) );
     } else {
         $reassign = (int) $reassign;
-        $wpdb->query("UPDATE $wpdb->posts SET post_author = {$reassign} WHERE post_author = {$id}");
-        $wpdb->query("UPDATE $wpdb->links SET link_owner = {$reassign} WHERE link_owner = {$id}");
+        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET post_author = %d WHERE post_author = %d", $reassign, $id) );
+        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->links SET link_owner = %d WHERE link_owner = %d}", $reassign, $id) );
     }
 
@@ -272 +266 @@
     do_action('delete_user', $id);
 
-    $wpdb->query("DELETE FROM $wpdb->users WHERE ID = $id");
-    $wpdb->query("DELETE FROM $wpdb->usermeta WHERE user_id = '$id'");
+    $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->users WHERE ID = %d", $id) );
+    $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->usermeta WHERE user_id = %d", $id) );
 
     wp_cache_delete($id, 'users');
@@ -324 +318 @@
         global $wpdb;
         $this->first_user = ($this->page - 1) * $this->users_per_page;
-        $this->query_limit = ' LIMIT ' . $this->first_user . ',' . $this->users_per_page;
+        $this->query_limit = $wpdb->prepare(" LIMIT %d, %d", $this->first_user, $this->users_per_page);
         $this->query_sort = ' ORDER BY user_login';
         $search_sql = '';
@@ -338 +332 @@
         $this->query_from_where = "FROM $wpdb->users";
         if ( $this->role )
-            $this->query_from_where .= " INNER JOIN $wpdb->usermeta ON $wpdb->users.ID = $wpdb->usermeta.user_id WHERE $wpdb->usermeta.meta_key = '{$wpdb->prefix}capabilities' AND $wpdb->usermeta.meta_value LIKE '%$this->role%'";
+            $this->query_from_where .= $wpdb->prepare(" INNER JOIN $wpdb->usermeta ON $wpdb->users.ID = $wpdb->usermeta.user_id WHERE $wpdb->usermeta.meta_key = '{$wpdb->prefix}capabilities' AND $wpdb->usermeta.meta_value LIKE %s", '%' . $this->role . '%');
         else
             $this->query_from_where .= " WHERE 1=1";

trunk/wp-admin/update-links.php

@@ -37 +37 @@
 
     foreach ($returns as $return) :
-        $time = $wpdb->escape( substr($return, 0, 19) );
-        $uri = $wpdb->escape( preg_replace('/(.*?) | (.*?)/', '$2', $return) );
-        $wpdb->query("UPDATE $wpdb->links SET link_updated = '$time' WHERE link_url = '$uri'");
+        $time = substr($return, 0, 19);
+        $uri = preg_replace('/(.*?) | (.*?)/', '$2', $return);
+        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->links SET link_updated = %s WHERE link_url = %s", $time, $uri) );
     endforeach;
 }

trunk/wp-admin/upload.php

@@ -212 +212 @@
 if ( 1 == count($posts) && is_singular() ) :
     
-    $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $id AND comment_approved != 'spam' ORDER BY comment_date");
+    $comments = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved != 'spam' ORDER BY comment_date", $id) );
     if ( $comments ) :
         // Make sure comments, post, and post_author are cached

trunk/wp-comments-post.php

@@ -12 +12 @@
 $comment_post_ID = (int) $_POST['comment_post_ID'];
 
-$status = $wpdb->get_row("SELECT post_status, comment_status FROM $wpdb->posts WHERE ID = '$comment_post_ID'");
+$status = $wpdb->get_row( $wpdb->prepare("SELECT post_status, comment_status FROM $wpdb->posts WHERE ID = %d", $comment_post_ID) );
 
 if ( empty($status->comment_status) ) {

trunk/wp-includes/comment.php

@@ -242 +242 @@
     $where = '';
     if ( $post_id > 0 ) {
-        $where = "WHERE comment_post_ID = {$post_id}";
+        $where = $wpdb->prepare("WHERE comment_post_ID = %d", $post_id);
     }
 
@@ -380 +380 @@
     if ( current_user_can( 'manage_options' ) )
         return; // don't throttle admins
-    if ( $lasttime = $wpdb->get_var("SELECT comment_date_gmt FROM $wpdb->comments WHERE comment_author_IP = '$ip' OR comment_author_email = '$email' ORDER BY comment_date DESC LIMIT 1") ) {
+    if ( $lasttime = $wpdb->get_var( $wpdb->prepare("SELECT comment_date_gmt FROM $wpdb->comments WHERE comment_author_IP = %s OR comment_author_email = %s ORDER BY comment_date DESC LIMIT 1", $ip, $email) ) ) {
         $time_lastcomment = mysql2date('U', $lasttime);
         $time_newcomment  = mysql2date('U', $date);
@@ -488 +488 @@
     $comment = get_comment($comment_id);
 
-    if ( ! $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_ID='$comment_id' LIMIT 1") )
+    if ( ! $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->comments WHERE comment_ID = %d LIMIT 1", $comment_id) ) )
         return false;
 
@@ -586 +586 @@
         $user_id = 0;
 
-    $result = $wpdb->query("INSERT INTO $wpdb->comments
+    $result = $wpdb->query( $wpdb->prepare("INSERT INTO $wpdb->comments
     (comment_post_ID, comment_author, comment_author_email, comment_author_url, comment_author_IP, comment_date, comment_date_gmt, comment_content, comment_approved, comment_agent, comment_type, comment_parent, user_id)
-    VALUES
-    ('$comment_post_ID', '$comment_author', '$comment_author_email', '$comment_author_url', '$comment_author_IP', '$comment_date', '$comment_date_gmt', '$comment_content', '$comment_approved', '$comment_agent', '$comment_type', '$comment_parent', '$user_id')
-    ");
+    VALUES (%d, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %d, %d)",
+    $comment_post_ID, $comment_author, $comment_author_email, $comment_author_url, $comment_author_IP, $comment_date, $comment_date_gmt, $comment_content, $comment_approved, $comment_agent, $comment_type, $comment_parent, $user_id) );
 
     $id = (int) $wpdb->insert_id;
@@ -715 +714 @@
     switch ( $comment_status ) {
         case 'hold':
-            $query = "UPDATE $wpdb->comments SET comment_approved='0' WHERE comment_ID='$comment_id' LIMIT 1";
+            $query = $wpdb->prepare("UPDATE $wpdb->comments SET comment_approved='0' WHERE comment_ID = %d LIMIT 1", $comment_id);
             break;
         case 'approve':
-            $query = "UPDATE $wpdb->comments SET comment_approved='1' WHERE comment_ID='$comment_id' LIMIT 1";
+            $query = $wpdb->prepare("UPDATE $wpdb->comments SET comment_approved='1' WHERE comment_ID = %d LIMIT 1", $comment_id);
             break;
         case 'spam':
-            $query = "UPDATE $wpdb->comments SET comment_approved='spam' WHERE comment_ID='$comment_id' LIMIT 1";
+            $query = $wpdb->prepare("UPDATE $wpdb->comments SET comment_approved='spam' WHERE comment_ID = %d LIMIT 1", $comment_id);
             break;
         case 'delete':
@@ -775 +774 @@
     $comment_date_gmt = get_gmt_from_date($comment_date);
 
-    $wpdb->query(
-        "UPDATE $wpdb->comments SET
-            comment_content      = '$comment_content',
-            comment_author       = '$comment_author',
-            comment_author_email = '$comment_author_email',
-            comment_approved     = '$comment_approved',
-            comment_author_url   = '$comment_author_url',
-            comment_date         = '$comment_date',
-            comment_date_gmt     = '$comment_date_gmt'
-        WHERE comment_ID = $comment_ID" );
+    $wpdb->query( $wpdb->prepare("UPDATE $wpdb->comments SET
+            comment_content      = %s,
+            comment_author       = %s,
+            comment_author_email = %s,
+            comment_approved     = %s,
+            comment_author_url   = %s,
+            comment_date         = %s,
+            comment_date_gmt     = %s
+        WHERE comment_ID = %d",
+            $comment_content,
+            $comment_author,
+            $comment_author_email,
+            $comment_approved,
+            $comment_author_url,
+            $comment_date,
+            $comment_date_gmt
+            $comment_ID) );
 
     $rval = $wpdb->rows_affected;
@@ -880 +886 @@
 
     $old = (int) $post->comment_count;
-    $new = (int) $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = '$post_id' AND comment_approved = '1'");
-    $wpdb->query("UPDATE $wpdb->posts SET comment_count = '$new' WHERE ID = '$post_id'");
+    $new = (int) $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '1'", $post_id) );
+    $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET comment_count = %d WHERE ID = %d", $new, $post_id) );
 
     if ( 'page' == $post->post_type )
@@ -1009 +1015 @@
     // Do Enclosures
     while ($enclosure = $wpdb->get_row("SELECT * FROM {$wpdb->posts}, {$wpdb->postmeta} WHERE {$wpdb->posts}.ID = {$wpdb->postmeta}.post_id AND {$wpdb->postmeta}.meta_key = '_encloseme' LIMIT 1")) {
-        $wpdb->query("DELETE FROM {$wpdb->postmeta} WHERE post_id = {$enclosure->ID} AND meta_key = '_encloseme';");
+        $wpdb->query( $wpdb->prepare("DELETE FROM {$wpdb->postmeta} WHERE post_id = %d AND meta_key = '_encloseme';", $enclosure->ID) );
         do_enclose($enclosure->post_content, $enclosure->ID);
     }
@@ -1036 +1042 @@
     global $wpdb;
 
-    $post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID = $post_id");
+    $post = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->posts WHERE ID = %d", $post_id) );
     $to_ping = get_to_ping($post_id);
     $pinged  = get_pung($post_id);
     if ( empty($to_ping) ) {
-        $wpdb->query("UPDATE $wpdb->posts SET to_ping = '' WHERE ID = '$post_id'");
+        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = '' WHERE ID = %d", $post_id) );
         return;
     }
@@ -1061 +1067 @@
                 $pinged[] = $tb_ping;
             } else {
-                $wpdb->query("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_ping', '')) WHERE ID = '$post_id'");
+                $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_ping', '')) WHERE ID = %d", $post_id) );
             }
         }
@@ -1226 +1232 @@
 
     $tb_url = addslashes( $tb_url );
-    $wpdb->query("UPDATE $wpdb->posts SET pinged = CONCAT(pinged, '\n', '$tb_url') WHERE ID = '$ID'");
-    return $wpdb->query("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_url', '')) WHERE ID = '$ID'");
+    $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET pinged = CONCAT(pinged, '\n', '$tb_url') WHERE ID = %d", $ID) );
+    return $wpdb->query( $wpdb->prepare("UPDATE $wpdb->posts SET to_ping = TRIM(REPLACE(to_ping, '$tb_url', '')) WHERE ID = %d", $ID) );
 }
 

trunk/wp-includes/post.php

@@ -475 +475 @@
     $query .= empty( $post_parent ) ? '' : $wpdb->prepare("AND $wpdb->posts.post_parent = %d ", $post_parent);
     // expected_slashed ($meta_key, $meta_value) -- Also, this looks really funky, doesn't seem like it works
-    $query .= empty( $meta_key ) | empty($meta_value)  ? '' : " AND ($wpdb->posts.ID = $wpdb->postmeta.post_id AND $wpdb->postmeta.meta_key = '$meta_key' AND $wpdb->postmeta.meta_value = '$meta_value' )";
+    $query .= empty( $meta_key ) | empty($meta_value)  ? '' : $wpdb->prepare(" AND ($wpdb->posts.ID = $wpdb->postmeta.post_id AND $wpdb->postmeta.meta_key = %s AND $wpdb->postmeta.meta_value = %s )", $meta_key, $meta_value);
     $query .= empty( $post_mime_type ) ? '' : wp_post_mime_type_where($post_mime_type);
     $query .= " GROUP BY $wpdb->posts.ID ORDER BY " . $orderby . ' ' . $order;
@@ -1961 +1961 @@
     $query .= " WHERE (post_type = 'page' AND post_status = 'publish') $exclusions $inclusions " ;
     // expected_slashed ($meta_key, $meta_value) -- also, it looks funky
-    $query .= ( empty( $meta_key ) | empty($meta_value)  ? "" : " AND ($wpdb->posts.ID = $wpdb->postmeta.post_id AND $wpdb->postmeta.meta_key = '$meta_key' AND $wpdb->postmeta.meta_value = '$meta_value' )" ) ;
+    $query .= ( empty( $meta_key ) | empty($meta_value)  ? "" : $wpdb->prepare(" AND ($wpdb->posts.ID = $wpdb->postmeta.post_id AND $wpdb->postmeta.meta_key = %s AND $wpdb->postmeta.meta_value = %s )", $meta_key, $meta_value) ) ;
     $query .= $author_query;
     $query .= " ORDER BY " . $sort_column . " " . $sort_order ;
@@ -2738 +2738 @@
     do_action('clean_page_cache', $id);
 
-    if ( $children = $wpdb->get_col( "SELECT ID FROM $wpdb->posts WHERE post_parent = '$id'" ) )
+    if ( $children = $wpdb->get_col( $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_parent = %d", $id) ) )
         foreach( $children as $cid )
             clean_post_cache( $cid );
@@ -2975 +2975 @@
 
     $id = $_post->ancestors[] = $_post->post_parent;
-    while ( $ancestor = $wpdb->get_var("SELECT `post_parent` FROM $wpdb->posts WHERE ID= '{$id}' LIMIT 1") ) {
+    while ( $ancestor = $wpdb->get_var( $wpdb->prepare("SELECT `post_parent` FROM $wpdb->posts WHERE ID = %d LIMIT 1", $id) ) ) {
         if ( $id == $ancestor )
             break;

trunk/wp-includes/taxonomy.php

@@ -750 +750 @@
 
     if ( !empty($taxonomy) )
-        return $wpdb->get_row("SELECT tt.term_id, tt.term_taxonomy_id FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy as tt ON tt.term_id = t.term_id WHERE $where AND tt.taxonomy = '$taxonomy'", ARRAY_A);
+        return $wpdb->get_row( $wpdb->prepare("SELECT tt.term_id, tt.term_taxonomy_id FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy as tt ON tt.term_id = t.term_id WHERE $where AND tt.taxonomy = %s", $taxonomy), ARRAY_A);
 
     return $wpdb->get_var("SELECT term_id FROM $wpdb->terms as t WHERE $where");
@@ -889 +889 @@
         $where = 'AND count > 0';
 
-    $taxonomy = $wpdb->escape( $taxonomy );
-    return $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->term_taxonomy WHERE taxonomy = '$taxonomy' $where");
+    return $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->term_taxonomy WHERE taxonomy = %s $where", $taxonomy) );
 }
 
@@ -919 +918 @@
         $terms = wp_get_object_terms($object_id, $taxonomy, 'fields=tt_ids');
         $in_terms = "'" . implode("', '", $terms) . "'";
-        $wpdb->query("DELETE FROM $wpdb->term_relationships WHERE object_id = '$object_id' AND term_taxonomy_id IN ($in_terms)");
+        $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->term_relationships WHERE object_id = %d AND term_taxonomy_id IN ($in_terms)", $object_id) );
         wp_update_term_count($terms, $taxonomy);
     }
@@ -1294 +1293 @@
         if ( $delete_terms ) {
             $in_delete_terms = "'" . implode("', '", $delete_terms) . "'";
-            $wpdb->query("DELETE FROM $wpdb->term_relationships WHERE object_id = '$object_id' AND term_taxonomy_id IN ($in_delete_terms)");
+            $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->term_relationships WHERE object_id = %d AND term_taxonomy_id IN ($in_delete_terms)", $object_id) );
             wp_update_term_count($delete_terms, $taxonomy);
         }

trunk/wp-includes/user.php

@@ -58 +58 @@
     if ( !$user )
         $user = $wpdb->escape($_COOKIE[USER_COOKIE]);
-    return $wpdb->get_var("SELECT $field FROM $wpdb->users WHERE user_login = '$user'");
+    return $wpdb->get_var( $wpdb->prepare("SELECT $field FROM $wpdb->users WHERE user_login = %s", $user) );
 }
 
@@ -64 +64 @@
     global $wpdb;
     $userid = (int) $userid;
-    return $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->posts WHERE post_author = '$userid' AND post_type = 'post' AND " . get_private_posts_cap_sql('post'));
+    return $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->posts WHERE post_author = %d AND post_type = 'post' AND ", $userid) . get_private_posts_cap_sql('post'));
 }
 
@@ -131 +131 @@
 
     if ( ! empty($meta_value) )
-        $wpdb->query("DELETE FROM $wpdb->usermeta WHERE user_id = '$user_id' AND meta_key = '$meta_key' AND meta_value = '$meta_value'");
-    else
-        $wpdb->query("DELETE FROM $wpdb->usermeta WHERE user_id = '$user_id' AND meta_key = '$meta_key'");
+        $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->usermeta WHERE user_id = %d AND meta_key = %s AND meta_value = %s", $userid, $meta_key, $meta_value) );
+    else
+        $wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->usermeta WHERE user_id = %d AND meta_key = %s", $user_id, $meta_key) );
 
     wp_cache_delete($user_id, 'users');
@@ -149 +149 @@
     if ( !empty($meta_key) ) {
         $meta_key = preg_replace('|[^a-z0-9_]|i', '', $meta_key);
-        $metas = $wpdb->get_results("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = '$user_id' AND meta_key = '$meta_key'");
+        $metas = $wpdb->get_results( $wpdb->prepare("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = %d AND meta_key = %s", $user_id, $meta_key) );
     } else {
-        $metas = $wpdb->get_results("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = '$user_id'");
+        $metas = $wpdb->get_results( $wpdb->prepare("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = %d", $user_id) );
     }
 
@@ -186 +186 @@
     }
 
-    $cur = $wpdb->get_row("SELECT * FROM $wpdb->usermeta WHERE user_id = '$user_id' AND meta_key = '$meta_key'");
+    $cur = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->usermeta WHERE user_id = %d AND meta_key = %d", $user_id, $meta_key) );
     if ( !$cur ) {
         $wpdb->query("INSERT INTO $wpdb->usermeta ( user_id, meta_key, meta_value )
@@ -192 +192 @@
         ( '$user_id', '$meta_key', '$meta_value' )");
     } else if ( $cur->meta_value != $meta_value ) {
-        $wpdb->query("UPDATE $wpdb->usermeta SET meta_value = '$meta_value' WHERE user_id = '$user_id' AND meta_key = '$meta_key'");
+        $wpdb->query( $wpdb->prepare("UPDATE $wpdb->usermeta SET meta_value = %s WHERE user_id = %d AND meta_key = %s", $meta_value, $user_id, $meta_key) );
     } else {
         return false;

trunk/wp-trackback.php

@@ -87 +87 @@
     $comment_type = 'trackback';
 
-    $dupe = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND comment_author_url = '$comment_author_url'");
+    $dupe = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s", $comment_post_ID, $comment_author_url) );
     if ( $dupe )
         trackback_response(1, 'We already have a ping from that URL for this post.');

trunk/xmlrpc.php

@@ -1353 +1353 @@
             foreach( $attachments as $file ) {
                 if( strpos( $post_content, $file->guid ) !== false ) {
-                    $wpdb->query( "UPDATE {$wpdb->posts} SET post_parent = '$post_ID' WHERE ID = '{$file->ID}'" );
+                    $wpdb->query( $wpdb->prepare("UPDATE {$wpdb->posts} SET post_parent = %d WHERE ID = %d", $post_ID, $file->ID) );
                 }
             }
@@ -2094 +2094 @@
         }
 
-        $comments = $wpdb->get_results("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = $post_ID");
+        $comments = $wpdb->get_results( $wpdb->prepare("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
 
         if (!$comments) {
@@ -2207 +2207 @@
                 // ...or a string #title, a little more complicated
                 $title = preg_replace('/[^a-z0-9]/i', '.', $urltest['fragment']);
-                $sql = "SELECT ID FROM $wpdb->posts WHERE post_title RLIKE '$title'";
+                $sql = $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", $title);
                 if (! ($post_ID = $wpdb->get_var($sql)) ) {
                     // returning unknown error '0' is better than die()ing
@@ -2236 +2236 @@
 
         // Let's check that the remote site didn't already pingback this entry
-        $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post_ID' AND comment_author_url = '$pagelinkedfrom'");
+        $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s", $post_ID, $pagelinkedfrom) );
 
         if ( $wpdb->num_rows ) // We already have a Pingback from this URL
@@ -2345 +2345 @@
         }
 
-        $comments = $wpdb->get_results("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = $post_ID");
+        $comments = $wpdb->get_results( $wpdb->prepare("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
 
         if (!$comments) {