Index: wp-admin/update-links.php
===================================================================
--- wp-admin/update-links.php	(revision 7627)
+++ wp-admin/update-links.php	(working copy)
@@ -36,9 +36,9 @@
 	$returns = explode("\n", $body);
 
 	foreach ($returns as $return) :
-		$time = $wpdb->escape( substr($return, 0, 19) );
-		$uri = $wpdb->escape( preg_replace('/(.*?) | (.*?)/', '$2', $return) );
-		$wpdb->query("UPDATE $wpdb->links SET link_updated = '$time' WHERE link_url = '$uri'");
+		$time = substr($return, 0, 19);
+		$uri = preg_replace('/(.*?) | (.*?)/', '$2', $return);
+		$wpdb->query( $wpdb->prepare("UPDATE $wpdb->links SET link_updated = %s WHERE link_url = %s", $time, $uri) );
 	endforeach;
 }
 ?>
Index: wp-admin/edit-comments.php
===================================================================
--- wp-admin/edit-comments.php	(revision 7627)
+++ wp-admin/edit-comments.php	(working copy)
@@ -12,8 +12,7 @@
 	$comments_deleted = $comments_approved = $comments_unapproved = $comments_spammed = 0;
 	foreach ($_REQUEST['delete_comments'] as $comment) : // Check the permissions on each
 		$comment = (int) $comment;
-		$post_id = (int) $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = $comment");
-		// $authordata = get_userdata( $wpdb->get_var("SELECT post_author FROM $wpdb->posts WHERE ID = $post_id") );
+		$post_id = (int) $wpdb->get_var( $wpdb->prepare( "SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = %d", $comment) );
 		if ( !current_user_can('edit_post', $post_id) )
 			continue;
 		if ( !empty( $_REQUEST['spamit'] ) ) {
Index: wp-admin/admin-ajax.php
===================================================================
--- wp-admin/admin-ajax.php	(revision 7627)
+++ wp-admin/admin-ajax.php	(working copy)
@@ -15,7 +15,7 @@
 
 	if ( strstr( $s, ',' ) )
 		die; // it's a multiple tag insert, we won't find anything
-	$results = $wpdb->get_col( "SELECT name FROM $wpdb->terms WHERE name LIKE ('%$s%')" );
+	$results = $wpdb->get_col( $wpdb->prepare("SELECT name FROM $wpdb->terms WHERE name LIKE (%s)", '%' . $s . '%') );
 	echo join( $results, "\n" );
 	die;
 }
Index: wp-admin/includes/comment.php
===================================================================
--- wp-admin/includes/comment.php	(revision 7627)
+++ wp-admin/includes/comment.php	(working copy)
@@ -3,8 +3,8 @@
 function comment_exists($comment_author, $comment_date) {
 	global $wpdb;
 
-	return $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments
-			WHERE comment_author = '$comment_author' AND comment_date = '$comment_date'");
+	return $wpdb->get_var( $wpdb->prepare("SELECT comment_post_ID FROM $wpdb->comments
+			WHERE comment_author = %s AND comment_date = %s", $comment_author, $comment_date) );
 }
 
 function edit_comment() {
@@ -67,7 +67,7 @@
 function get_pending_comments_num( $post_id ) {
 	global $wpdb;
 	$post_id = (int) $post_id;
-	$pending = $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = $post_id AND comment_approved = '0'" );
+	$pending = $wpdb->get_var( $wpdb->prepare("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '0'", $post_id) );
 	return $pending;
 }