Index: src/wp-includes/meta.php
===================================================================
--- src/wp-includes/meta.php	(revision 29343)
+++ src/wp-includes/meta.php	(working copy)
@@ -27,17 +27,22 @@
  * @return int|bool The meta ID on success, false on failure.
  */
 function add_metadata($meta_type, $object_id, $meta_key, $meta_value, $unique = false) {
-	if ( !$meta_type || !$meta_key )
+	global $wpdb;
+
+	if ( ! $meta_type || ! $meta_key || ! is_numeric( $object_id ) ) {
 		return false;
+	}
 
-	if ( !$object_id = absint($object_id) )
+	$object_id = absint( $object_id );
+	if ( ! $object_id ) {
 		return false;
+	}
 
-	if ( ! $table = _get_meta_table($meta_type) )
+	$table = _get_meta_table( $meta_type );
+	if ( ! $table ) {
 		return false;
+	}
 
-	global $wpdb;
-
 	$column = sanitize_key($meta_type . '_id');
 
 	// expected_slashed ($meta_key)
@@ -134,18 +139,22 @@
  * @return int|bool Meta ID if the key didn't exist, true on successful update, false on failure.
  */
 function update_metadata($meta_type, $object_id, $meta_key, $meta_value, $prev_value = '') {
-	if ( !$meta_type || !$meta_key )
+	global $wpdb;
+
+	if ( ! $meta_type || ! $meta_key || ! is_numeric( $object_id ) ) {
 		return false;
+	}
 
-	if ( ! is_numeric( $object_id ) || ! $object_id = absint( $object_id ) ) {
+	$object_id = absint( $object_id );
+	if ( ! $object_id ) {
 		return false;
 	}
 
-	if ( ! $table = _get_meta_table($meta_type) )
+	$table = _get_meta_table( $meta_type );
+	if ( ! $table ) {
 		return false;
+	}
 
-	global $wpdb;
-
 	$column = sanitize_key($meta_type . '_id');
 	$id_column = 'user' == $meta_type ? 'umeta_id' : 'meta_id';
 
@@ -282,17 +291,22 @@
  * @return bool True on successful delete, false on failure.
  */
 function delete_metadata($meta_type, $object_id, $meta_key, $meta_value = '', $delete_all = false) {
-	if ( !$meta_type || !$meta_key )
+	global $wpdb;
+
+	if ( ! $meta_type || ! $meta_key || ! is_numeric( $object_id ) && ! $delete_all ) {
 		return false;
+	}
 
-	if ( (!$object_id = absint($object_id)) && !$delete_all )
+	$object_id = absint( $object_id );
+	if ( ! $object_id && ! $delete_all ) {
 		return false;
+	}
 
-	if ( ! $table = _get_meta_table($meta_type) )
+	$table = _get_meta_table( $meta_type );
+	if ( ! $table ) {
 		return false;
+	}
 
-	global $wpdb;
-
 	$type_column = sanitize_key($meta_type . '_id');
 	$id_column = 'user' == $meta_type ? 'umeta_id' : 'meta_id';
 	// expected_slashed ($meta_key)
@@ -424,11 +438,14 @@
  * @return string|array Single metadata value, or array of values
  */
 function get_metadata($meta_type, $object_id, $meta_key = '', $single = false) {
-	if ( !$meta_type )
+	if ( ! $meta_type || ! is_numeric( $object_id ) ) {
 		return false;
+	}
 
-	if ( !$object_id = absint($object_id) )
+	$object_id = absint( $object_id );
+	if ( ! $object_id ) {
 		return false;
+	}
 
 	/**
 	 * Filter whether to retrieve metadata of a specific type.
@@ -488,11 +505,14 @@
  * @return boolean true of the key is set, false if not.
  */
 function metadata_exists( $meta_type, $object_id, $meta_key ) {
-	if ( ! $meta_type )
+	if ( ! $meta_type || ! is_numeric( $object_id ) ) {
 		return false;
+	}
 
-	if ( ! $object_id = absint( $object_id ) )
+	$object_id = absint( $object_id );
+	if ( ! $object_id ) {
 		return false;
+	}
 
 	/** This filter is documented in wp-includes/meta.php */
 	$check = apply_filters( "get_{$meta_type}_metadata", null, $object_id, $meta_key, true );
@@ -524,14 +544,19 @@
 function get_metadata_by_mid( $meta_type, $meta_id ) {
 	global $wpdb;
 
-	if ( ! $meta_type )
+	if ( ! $meta_type || ! is_numeric( $meta_id ) ) {
 		return false;
+	}
 
-	if ( !$meta_id = absint( $meta_id ) )
+	$meta_id = absint( $meta_id );
+	if ( ! $meta_id ) {
 		return false;
+	}
 
-	if ( ! $table = _get_meta_table($meta_type) )
+	$table = _get_meta_table( $meta_type );
+	if ( ! $table ) {
 		return false;
+	}
 
 	$id_column = ( 'user' == $meta_type ) ? 'umeta_id' : 'meta_id';
 
@@ -564,14 +589,19 @@
 	global $wpdb;
 
 	// Make sure everything is valid.
-	if ( ! $meta_type )
+	if ( ! $meta_type || ! is_numeric( $meta_id ) ) {
 		return false;
+	}
 
-	if ( ! $meta_id = absint( $meta_id ) )
+	$meta_id = absint( $meta_id );
+	if ( ! $meta_id ) {
 		return false;
+	}
 
-	if ( ! $table = _get_meta_table( $meta_type ) )
+	$table = _get_meta_table( $meta_type );
+	if ( ! $table ) {
 		return false;
+	}
 
 	$column = sanitize_key($meta_type . '_id');
 	$id_column = 'user' == $meta_type ? 'umeta_id' : 'meta_id';
@@ -651,14 +681,19 @@
 	global $wpdb;
 
 	// Make sure everything is valid.
-	if ( ! $meta_type )
+	if ( ! $meta_type || ! is_numeric( $meta_id ) ) {
 		return false;
+	}
 
-	if ( ! $meta_id = absint( $meta_id ) )
+	$meta_id = absint( $meta_id );
+	if ( ! $meta_id ) {
 		return false;
+	}
 
-	if ( ! $table = _get_meta_table( $meta_type ) )
+	$table = _get_meta_table( $meta_type );
+	if ( ! $table ) {
 		return false;
+	}
 
 	// object and id columns
 	$column = sanitize_key($meta_type . '_id');
@@ -729,16 +764,19 @@
  * @return mixed Metadata cache for the specified objects, or false on failure.
  */
 function update_meta_cache($meta_type, $object_ids) {
-	if ( empty( $meta_type ) || empty( $object_ids ) )
+	global $wpdb;
+
+	if ( ! $meta_type || ! $object_ids ) {
 		return false;
+	}
 
-	if ( ! $table = _get_meta_table($meta_type) )
+	$table = _get_meta_table( $meta_type );
+	if ( ! $table ) {
 		return false;
+	}
 
 	$column = sanitize_key($meta_type . '_id');
 
-	global $wpdb;
-
 	if ( !is_array($object_ids) ) {
 		$object_ids = preg_replace('|[^0-9,]|', '', $object_ids);
 		$object_ids = explode(',', $object_ids);
Index: tests/phpunit/tests/meta.php
===================================================================
--- tests/phpunit/tests/meta.php	(revision 29343)
+++ tests/phpunit/tests/meta.php	(working copy)
@@ -236,4 +236,24 @@
 
 		$this->assertEquals( wp_list_pluck( $posts, 'post_title' ), wp_list_pluck( $posts2, 'post_title' ) );
 	}
+
+	/**
+	 * @ticket 28315
+	 */
+	function test_non_numeric_object_id() {
+		$this->assertFalse( add_metadata( 'user', array( 1 ), 'meta_key', 'meta_value' ) );
+		$this->assertFalse( update_metadata( 'user', array( 1 ), 'meta_key', 'meta_new_value' ) );
+		$this->assertFalse( delete_metadata( 'user', array( 1 ), 'meta_key' ) );
+		$this->assertFalse( get_metadata( 'user', array( 1 ) ) );
+		$this->assertFalse( metadata_exists( 'user', array( 1 ), 'meta_key' ) );
+	}
+
+	/**
+	 * @ticket 28315
+	 */
+	function test_non_numeric_meta_id() {
+		$this->assertFalse( get_metadata_by_mid( 'user', array( 1 ) ) );
+		$this->assertFalse( update_metadata_by_mid( 'user', array( 1 ), 'meta_new_value' ) );
+		$this->assertFalse( delete_metadata_by_mid( 'user', array( 1 ) ) );
+	}
 }