Changeset 7645 for trunk/xmlrpc.php

Timestamp:

04/14/2008 04:13:25 PM (18 years ago)

Author:

ryan

Message:

Prepare DB queries in more places. Props filosofo. see #6644

File:

• trunk/xmlrpc.php (modified) (5 diffs)

trunk/xmlrpc.php

@@ -1353 +1353 @@
             foreach( $attachments as $file ) {
                 if( strpos( $post_content, $file->guid ) !== false ) {
-                    $wpdb->query( "UPDATE {$wpdb->posts} SET post_parent = '$post_ID' WHERE ID = '{$file->ID}'" );
+                    $wpdb->query( $wpdb->prepare("UPDATE {$wpdb->posts} SET post_parent = %d WHERE ID = %d", $post_ID, $file->ID) );
                 }
             }
@@ -2094 +2094 @@
         }
 
-        $comments = $wpdb->get_results("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = $post_ID");
+        $comments = $wpdb->get_results( $wpdb->prepare("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
 
         if (!$comments) {
@@ -2207 +2207 @@
                 // ...or a string #title, a little more complicated
                 $title = preg_replace('/[^a-z0-9]/i', '.', $urltest['fragment']);
-                $sql = "SELECT ID FROM $wpdb->posts WHERE post_title RLIKE '$title'";
+                $sql = $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", $title);
                 if (! ($post_ID = $wpdb->get_var($sql)) ) {
                     // returning unknown error '0' is better than die()ing
@@ -2236 +2236 @@
 
         // Let's check that the remote site didn't already pingback this entry
-        $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post_ID' AND comment_author_url = '$pagelinkedfrom'");
+        $wpdb->get_results( $wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s", $post_ID, $pagelinkedfrom) );
 
         if ( $wpdb->num_rows ) // We already have a Pingback from this URL
@@ -2345 +2345 @@
         }
 
-        $comments = $wpdb->get_results("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = $post_ID");
+        $comments = $wpdb->get_results( $wpdb->prepare("SELECT comment_author_url, comment_content, comment_author_IP, comment_type FROM $wpdb->comments WHERE comment_post_ID = %d", $post_ID) );
 
         if (!$comments) {