Changeset 6191

Timestamp:

12/28/2016 04:24:52 AM (9 years ago)

Author:

johnjamesjacoby

Message:

Audit direct query and prepare() usages, and more tightly adhere to best practices.

• No quotes around directives
• Avoid concatenation, prefer variable parsing in double-quoted strings
• Covers converters, helper functions, and tools

Location:

trunk/src/includes

Files:

• admin/converter.php (modified) (23 diffs)
• admin/converters/e107v1.php (modified) (1 diff)
• admin/tools.php (modified) (55 diffs)
• common/functions.php (modified) (1 diff)
• topics/functions.php (modified) (3 diffs)
• users/capabilities.php (modified) (2 diffs)
• users/functions.php (modified) (2 diffs)

trunk/src/includes/admin/converter.php

@@ -664 +664 @@
                     KEY value_id (value_id),
                     KEY meta_join (meta_key({$max_index_length}), meta_value({$max_index_length}))
-                ) {$charset_collate};";
+                ) {$charset_collate}";
 
         dbDelta( $sql );
@@ -1016 +1016 @@
             // Get some data from the old forums
             $field_list  = array_unique( $field_list );
-            $forum_query = 'SELECT ' . implode( ',', $field_list ) . ' FROM ' . $this->opdb->prefix . $from_tablename . ' LIMIT ' . $start . ', ' . $this->max_rows;
+            $fields      = implode( ',', $field_list );
+            $forum_query = "SELECT {$fields} FROM {$this->opdb->prefix}{$from_tablename} LIMIT {$start}, {$this->max_rows}";
             $forum_array = $this->opdb->get_results( $forum_query, ARRAY_A );
 
@@ -1254 +1255 @@
 
         if ( ! empty( $this->sync_table ) ) {
-            $query = 'SELECT value_id, meta_value FROM '            . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_forum_parent_id" AND meta_value > 0 LIMIT ' . $start . ', ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value > 0 LIMIT {$start}, {$this->max_rows}", '_bbp_old_forum_parent_id' );
         } else {
-            $query = 'SELECT post_id AS value_id, meta_value FROM ' . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_forum_parent_id" AND meta_value > 0 LIMIT ' . $start . ', ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT post_id AS value_id, meta_value FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value > 0 LIMIT {$start}, {$this->max_rows}", '_bbp_old_forum_parent_id' );
         }
 
@@ -1265 +1266 @@
         foreach ( (array) $forum_array as $row ) {
             $parent_id = $this->callback_forumid( $row->meta_value );
-            $this->wpdb->query( 'UPDATE ' . $this->wpdb->posts . ' SET post_parent = "' . $parent_id . '" WHERE ID = "' . $row->value_id . '" LIMIT 1' );
+            $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->posts} SET post_parent = %d WHERE ID = %d LIMIT 1", $parent_id, $row->value_id ) );
             $has_update = true;
         }
@@ -1286 +1287 @@
 
         if ( ! empty( $this->sync_table ) ) {
-            $query = 'SELECT value_id, meta_value FROM '            . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_sticky_status_id" AND meta_value = "sticky" LIMIT ' . $start . ', ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_sticky_status_id', 'sticky' );
         } else {
-            $query = 'SELECT post_id AS value_id, meta_value FROM ' . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_sticky_status_id" AND meta_value = "sticky" LIMIT ' . $start . ', ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT post_id AS value_id, meta_value FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_sticky_status_id', 'sticky' );
         }
 
@@ -1317 +1318 @@
 
         if ( ! empty( $this->sync_table ) ) {
-            $query = 'SELECT value_id, meta_value FROM '            . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_sticky_status_id" AND meta_value = "super-sticky" LIMIT ' . $start . ', ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_sticky_status_id', 'super-sticky' );
         } else {
-            $query = 'SELECT post_id AS value_id, meta_value FROM ' . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_sticky_status_id" AND meta_value = "super-sticky" LIMIT ' . $start . ', ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT post_id AS value_id, meta_value FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_sticky_status_id', 'super-sticky' );
         }
 
@@ -1348 +1349 @@
 
         if ( ! empty( $this->sync_table ) ) {
-            $query = 'SELECT value_id, meta_value FROM ' . $this->sync_table_name           . ' WHERE meta_key = "_bbp_old_closed_status_id" AND meta_value = "closed" LIMIT ' . $start . ', ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_closed_status_id', 'closed' );
         } else {
-            $query = 'SELECT post_id AS value_id, meta_value FROM ' . $this->wpdb->postmeta . ' WHERE meta_key = "_bbp_old_closed_status_id" AND meta_value = "closed" LIMIT ' . $start . ', ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT post_id AS value_id, meta_value FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_closed_status_id', 'closed' );
         }
 
@@ -1375 +1376 @@
 
         if ( ! empty( $this->sync_table ) ) {
-            $query = 'SELECT value_id, meta_value FROM ' . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_reply_to_id" AND meta_value > 0 LIMIT ' . $start . ', ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value > 0 LIMIT {$start}, {$this->max_rows}", '_bbp_old_reply_to_id' );
         } else {
-            $query = 'SELECT post_id AS value_id, meta_value FROM ' . $this->wpdb->postmeta . ' WHERE meta_key = "_bbp_old_reply_to_id" AND meta_value > 0 LIMIT ' . $start . ', ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT post_id AS value_id, meta_value FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value > 0 LIMIT {$start}, {$this->max_rows}", '_bbp_old_reply_to_id' );
         }
 
@@ -1386 +1387 @@
         foreach ( (array) $reply_to_array as $row ) {
             $reply_to = $this->callback_reply_to( $row->meta_value );
-            $this->wpdb->query( 'UPDATE ' . $this->wpdb->postmeta . ' SET meta_value = "' . $reply_to . '" WHERE meta_key = "_bbp_reply_to" AND post_id = "' . $row->value_id . '" LIMIT 1' );
+            $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->postmeta} SET meta_value = %s WHERE meta_key = %s AND post_id = %d LIMIT 1", $reply_to, '_bbp_reply_to', $row->value_id ) );
             $has_update = true;
         }
@@ -1405 +1406 @@
 
         if ( ! empty( $this->sync_table ) ) {
-            $query = 'SELECT sync_table1.value_id AS topic_id, sync_table1.meta_value AS topic_is_anonymous, sync_table2.meta_value AS topic_author
-                            FROM       ' . $this->sync_table_name . ' AS sync_table1
-                            INNER JOIN ' . $this->sync_table_name . ' AS sync_table2
+            $query = $this->wpdb->prepare( "SELECT sync_table1.value_id AS topic_id, sync_table1.meta_value AS topic_is_anonymous, sync_table2.meta_value AS topic_author
+                            FROM {$this->sync_table_name} AS sync_table1
+                            INNER JOIN {$this->sync_table_name} AS sync_table2
                             ON ( sync_table1.value_id = sync_table2.value_id )
-                            WHERE sync_table1.meta_value =  "true"
-                            AND sync_table2.meta_key =  "_bbp_old_topic_author_name_id"
-                            LIMIT ' . $start . ', ' . $this->max_rows;
+                            WHERE sync_table1.meta_value = %s
+                            AND sync_table2.meta_key = %s
+                            LIMIT {$start}, {$this->max_rows}", 'true', '_bbp_old_topic_author_name_id' );
         } else {
-            $query = 'SELECT wp_postmeta1.post_id AS topic_id, wp_postmeta1.meta_value AS topic_is_anonymous, wp_postmeta2.meta_value AS topic_author
-                            FROM       ' . $this->wpdb->postmeta . ' AS wp_postmeta1
-                            INNER JOIN ' . $this->wpdb->postmeta . ' AS wp_postmeta2
+            $query = $this->wpdb->prepare( "SELECT wp_postmeta1.post_id AS topic_id, wp_postmeta1.meta_value AS topic_is_anonymous, wp_postmeta2.meta_value AS topic_author
+                            FROM {$this->wpdb->postmeta} AS wp_postmeta1
+                            INNER JOIN {$this->wpdb->postmeta} AS wp_postmeta2
                             ON ( wp_postmeta1.post_id = wp_postmeta2.post_id )
-                            WHERE wp_postmeta1.meta_value =  "true"
-                            AND wp_postmeta2.meta_key =  "_bbp_old_topic_author_name_id"
-                            LIMIT ' . $start . ', ' . $this->max_rows;
+                            WHERE wp_postmeta1.meta_value = %s
+                            AND wp_postmeta2.meta_key = %s
+                            LIMIT {$start}, {$this->max_rows}", 'true', '_bbp_old_topic_author_name_id' );
 
         }
@@ -1429 +1430 @@
         foreach ( (array) $anonymous_topics as $row ) {
             $anonymous_topic_author_id = 0;
-            $this->wpdb->query( 'UPDATE ' . $this->wpdb->posts . ' SET post_author = "' . $anonymous_topic_author_id . '" WHERE ID = "' . $row->topic_id . '" LIMIT 1' );
+            $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->posts} SET post_author = %d WHERE ID = %d LIMIT 1", $anonymous_topic_author_id, $row->topic_id ) );
 
             add_post_meta( $row->topic_id, '_bbp_anonymous_name', $row->topic_author );
@@ -1451 +1452 @@
 
         if ( ! empty( $this->sync_table ) ) {
-            $query = 'SELECT sync_table1.value_id AS reply_id, sync_table1.meta_value AS reply_is_anonymous, sync_table2.meta_value AS reply_author
-                            FROM       ' . $this->sync_table_name . ' AS sync_table1
-                            INNER JOIN ' . $this->sync_table_name . ' AS sync_table2
+            $query = $this->wpdb->prepare( "SELECT sync_table1.value_id AS reply_id, sync_table1.meta_value AS reply_is_anonymous, sync_table2.meta_value AS reply_author
+                            FROM {$this->sync_table_name} AS sync_table1
+                            INNER JOIN {$this->sync_table_name} AS sync_table2
                             ON ( sync_table1.value_id = sync_table2.value_id )
-                            WHERE sync_table1.meta_value =  "true"
-                            AND sync_table2.meta_key =  "_bbp_old_reply_author_name_id"
-                            LIMIT ' . $start . ', ' . $this->max_rows;
+                            WHERE sync_table1.meta_value = %s
+                            AND sync_table2.meta_key = %s
+                            LIMIT {$start}, {$this->max_rows}", 'true', '_bbp_old_reply_author_name_id' );
         } else {
-            $query = 'SELECT wp_postmeta1.post_id AS reply_id, wp_postmeta1.meta_value AS reply_is_anonymous, wp_postmeta2.meta_value AS reply_author
-                            FROM       ' . $this->wpdb->postmeta . ' AS wp_postmeta1
-                            INNER JOIN ' . $this->wpdb->postmeta . ' AS wp_postmeta2
+            $query = $this->wpdb->prepare( "SELECT wp_postmeta1.post_id AS reply_id, wp_postmeta1.meta_value AS reply_is_anonymous, wp_postmeta2.meta_value AS reply_author
+                            FROM {$this->wpdb->postmeta} AS wp_postmeta1
+                            INNER JOIN {$this->wpdb->postmeta} AS wp_postmeta2
                             ON ( wp_postmeta1.post_id = wp_postmeta2.post_id )
-                            WHERE wp_postmeta1.meta_value =  "true"
-                            AND wp_postmeta2.meta_key =  "_bbp_old_reply_author_name_id"
-                            LIMIT ' . $start . ', ' . $this->max_rows;
+                            WHERE wp_postmeta1.meta_value = %s
+                            AND wp_postmeta2.meta_key = %s
+                            LIMIT {$start}, {$this->max_rows}", 'true', '_bbp_old_reply_author_name_id' );
 
         }
@@ -1475 +1476 @@
         foreach ( (array) $anonymous_replies as $row ) {
             $anonymous_reply_author_id = 0;
-            $this->wpdb->query( 'UPDATE ' . $this->wpdb->posts . ' SET post_author = "' . $anonymous_reply_author_id . '" WHERE ID = "' . $row->reply_id . '" LIMIT 1' );
+            $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->posts} SET post_author = %d WHERE ID = %d LIMIT 1", $anonymous_reply_author_id, $row->reply_id ) );
 
             add_post_meta( $row->reply_id, '_bbp_anonymous_name', $row->reply_author );
@@ -1496 +1497 @@
 
         if ( true === $this->sync_table ) {
-            $query = 'SELECT value_id FROM ' . $this->sync_table_name . ' INNER JOIN ' . $this->wpdb->posts . ' ON(value_id = ID) WHERE meta_key LIKE "_bbp_%" AND value_type = "post" GROUP BY value_id ORDER BY value_id DESC LIMIT ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT value_id FROM {$this->sync_table_name} INNER JOIN {$this->wpdb->posts} ON(value_id = ID) WHERE meta_key LIKE '_bbp_%' AND value_type = %s GROUP BY value_id ORDER BY value_id DESC LIMIT {$this->max_rows}", 'post' );
         } else {
-            $query = 'SELECT post_id AS value_id FROM ' . $this->wpdb->postmeta . ' WHERE meta_key LIKE "_bbp_%" GROUP BY post_id ORDER BY post_id DESC LIMIT ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT post_id AS value_id FROM {$this->wpdb->postmeta} WHERE meta_key LIKE '_bbp_%' GROUP BY post_id ORDER BY post_id DESC LIMIT {$this->max_rows}" );
         }
 
@@ -1515 +1516 @@
 
         if ( true === $this->sync_table ) {
-            $query = 'SELECT value_id FROM ' . $this->sync_table_name . ' INNER JOIN ' . $this->wpdb->users . ' ON(value_id = ID) WHERE meta_key = "_bbp_old_user_id" AND value_type = "user" LIMIT ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT value_id FROM {$this->sync_table_name} INNER JOIN {$this->wpdb->users} ON(value_id = ID) WHERE meta_key = %s AND value_type = %s LIMIT {$this->max_rows}", '_bbp_old_user_id', 'user' );
         } else {
-            $query = 'SELECT user_id AS value_id FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_old_user_id" LIMIT ' . $this->max_rows;
+            $query = $this->wpdb->prepare( "SELECT user_id AS value_id FROM {$this->wpdb->usermeta} WHERE meta_key = %s LIMIT {$this->max_rows}", '_bbp_old_user_id' );
         }
 
@@ -1548 +1549 @@
         /** Delete bbconverter passwords **************************************/
 
-        $query       = 'SELECT user_id, meta_value FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_password" LIMIT ' . $start . ', ' . $this->max_rows;
+        $query       = $this->wpdb->prepare( "SELECT user_id, meta_value FROM {$this->wpdb->usermeta} WHERE meta_key = %s LIMIT {$start}, {$this->max_rows}", '_bbp_password' );
         update_option( '_bbp_converter_query', $query );
 
@@ -1557 +1558 @@
             foreach ( $bbconverter as $value ) {
                 if ( is_serialized( $value['meta_value'] ) ) {
-                    $this->wpdb->query( 'UPDATE ' . $this->wpdb->users . ' ' . 'SET user_pass = "" ' . 'WHERE ID = "' . $value['user_id'] . '"' );
-                } else {
-                    $this->wpdb->query( 'UPDATE ' . $this->wpdb->users . ' ' . 'SET user_pass = "' . $value['meta_value'] . '" ' . 'WHERE ID = "' . $value['user_id'] . '"' );
-                    $this->wpdb->query( 'DELETE FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_password" AND user_id = "' . $value['user_id'] . '"' );
+                    $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->users} SET user_pass = '' WHERE ID = %d", $value['user_id'] ) );
+                } else {
+                    $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->users} SET user_pass = %s WHERE ID = %d", $value['meta_value'], $value['user_id'] ) );
+                    $this->wpdb->query( $this->wpdb->prepare( "DELETE FROM {$this->wpdb->usermeta} WHERE meta_key = %s AND user_id = %d", '_bbp_password', $value['user_id'] ) );
                 }
             }
@@ -1613 +1614 @@
      */
     public function callback_pass( $username, $password ) {
-        $user = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT * FROM ' . $this->wpdb->users . ' WHERE user_login = "%s" AND user_pass = "" LIMIT 1', $username ) );
+        $user = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT * FROM {$this->wpdb->users} WHERE user_login = %s AND user_pass = '' LIMIT 1", $username ) );
         if ( ! empty( $user ) ) {
-            $usermeta = $this->wpdb->get_row( 'SELECT * FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_password" AND user_id = "' . $user->ID . '" LIMIT 1' );
+            $usermeta = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT * FROM {$this->wpdb->usermeta} WHERE meta_key = %s AND user_id = %d LIMIT 1", '_bbp_password', $user->ID ) );
 
             if ( ! empty( $usermeta ) ) {
                 if ( $this->authenticate_pass( $password, $usermeta->meta_value ) ) {
-                    $this->wpdb->query( 'UPDATE ' . $this->wpdb->users . ' ' . 'SET user_pass = "' . wp_hash_password( $password ) . '" ' . 'WHERE ID = "' . $user->ID . '"' );
-                    $this->wpdb->query( 'DELETE FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_password" AND user_id = "' . $user->ID . '"' );
+                    $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->users} SET user_pass = %s WHERE ID = %d", wp_hash_password( $password ), $user->ID ) );
+                    $this->wpdb->query( $this->wpdb->prepare( "DELETE FROM {$this->wpdb->usermeta} WHERE meta_key = %s AND user_id = %d", '_bbp_password', $user->ID ) );
                 }
             }
@@ -1635 +1636 @@
         if ( ! isset( $this->map_forumid[ $field ] ) ) {
             if ( ! empty( $this->sync_table ) ) {
-                $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT value_id, meta_value FROM ' . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_forum_id" AND meta_value = "%s" LIMIT 1', $field ) );
+                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_forum_id', $field ) );
             } else {
-                $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT post_id AS value_id FROM '  . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_forum_id" AND meta_value = "%s" LIMIT 1', $field ) );
+                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT post_id AS value_id FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_forum_id', $field ) );
             }
 
@@ -1658 +1659 @@
         if ( ! isset( $this->map_topicid[ $field ] ) ) {
             if ( ! empty( $this->sync_table ) ) {
-                $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT value_id, meta_value FROM ' . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_topic_id" AND meta_value = "%s" LIMIT 1', $field ) );
+                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_topic_id', $field ) );
             } else {
-                $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT post_id AS value_id FROM '  . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_topic_id" AND meta_value = "%s" LIMIT 1', $field ) );
+                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT post_id AS value_id FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_topic_id', $field ) );
             }
 
@@ -1683 +1684 @@
         if ( ! isset( $this->map_reply_to[ $field ] ) ) {
             if ( ! empty( $this->sync_table ) ) {
-                $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT value_id, meta_value FROM ' . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_reply_id" AND meta_value = "%s" LIMIT 1', $field ) );
+                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_reply_id', $field ) );
             } else {
-                $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT post_id AS value_id FROM '  . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_reply_id" AND meta_value = "%s" LIMIT 1', $field ) );
+                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT post_id AS value_id FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_reply_id', $field ) );
             }
 
@@ -1706 +1707 @@
         if ( ! isset( $this->map_userid[ $field ] ) ) {
             if ( ! empty( $this->sync_table ) ) {
-                $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT value_id, meta_value FROM ' . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_user_id" AND meta_value = "%s" LIMIT 1', $field ) );
+                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_user_id', $field ) );
             } else {
-                $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT user_id AS value_id FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_old_user_id" AND meta_value = "%s" LIMIT 1', $field ) );
+                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT user_id AS value_id FROM {$this->wpdb->usermeta} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_user_id', $field ) );
             }
 
@@ -1754 +1755 @@
             $this->map_topicid_to_forumid[ $topicid ] = 0;
         } elseif ( ! isset( $this->map_topicid_to_forumid[ $topicid ] ) ) {
-            $row = $this->wpdb->get_row( 'SELECT post_parent FROM ' . $this->wpdb->posts . ' WHERE ID = "' . $topicid . '" LIMIT 1' );
+            $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT post_parent FROM {$this->wpdb->posts} WHERE ID = %d LIMIT 1", $topicid ) );
 
             if ( !is_null( $row ) ) {

trunk/src/includes/admin/converters/e107v1.php

@@ -577 +577 @@
         if ( ! isset( $this->map_userid[ $field ] ) ) {
             if ( ! empty( $this->sync_table ) ) {
-                $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT value_id, meta_value FROM ' . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_user_id" AND meta_value = "%s" LIMIT 1', $field ) );
+                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_user_id', $field ) );
             } else {
-                $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT user_id AS value_id FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_old_user_id" AND meta_value = "%s" LIMIT 1', $field ) );
+                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT user_id AS value_id FROM {$this->wpdb->usermeta} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_user_id', $field ) );
             }
 

trunk/src/includes/admin/tools.php

@@ -1090 +1090 @@
                 WHERE `topics`.`post_type` = '{$tpt}'
                     AND `topics`.`post_status` IN ( '{$pps}', '{$cps}' )
-                GROUP BY `topics`.`ID`);";
+                GROUP BY `topics`.`ID`)";
 
     if ( is_wp_error( $bbp_db->query( $sql ) ) ) {
@@ -1119 +1119 @@
     $result    = __( 'Failed!', 'bbpress' );
 
-    $sql_delete = "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` = '_bbp_voice_count';";
+    $sql_delete = "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` = '_bbp_voice_count'";
     if ( is_wp_error( $bbp_db->query( $sql_delete ) ) ) {
         return array( 1, sprintf( $statement, $result ) );
@@ -1139 +1139 @@
                     AND `posts`.`post_status` IN ( '{$pps}', '{$cps}' )
                     AND `posts`.`post_author` != '0'
-                GROUP BY `postmeta`.`meta_value`);";
+                GROUP BY `postmeta`.`meta_value`)";
 
     if ( is_wp_error( $bbp_db->query( $sql ) ) ) {
@@ -1168 +1168 @@
     $result    = __( 'Failed!', 'bbpress' );
 
-    $sql_delete = "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` = '_bbp_reply_count_hidden';";
+    $sql_delete = "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` = '_bbp_reply_count_hidden'";
     if ( is_wp_error( $bbp_db->query( $sql_delete ) ) ) {
         return array( 1, sprintf( $statement, $result ) );
@@ -1179 +1179 @@
     $pps = bbp_get_pending_status_id();
 
-    $sql = "INSERT INTO `{$bbp_db->postmeta}` (`post_id`, `meta_key`, `meta_value`) (SELECT `post_parent`, '_bbp_reply_count_hidden', COUNT(`post_status`) as `meta_value` FROM `{$bbp_db->posts}` WHERE `post_type` = '{$rpt}' AND `post_status` IN ( '{$tps}', '{$sps}', '{$pps}' ) GROUP BY `post_parent`);";
+    $sql = "INSERT INTO `{$bbp_db->postmeta}` (`post_id`, `meta_key`, `meta_value`) (SELECT `post_parent`, '_bbp_reply_count_hidden', COUNT(`post_status`) as `meta_value` FROM `{$bbp_db->posts}` WHERE `post_type` = '{$rpt}' AND `post_status` IN ( '{$tps}', '{$sps}', '{$pps}' ) GROUP BY `post_parent`)";
     if ( is_wp_error( $bbp_db->query( $sql ) ) ) {
         return array( 2, sprintf( $statement, $result ) );
@@ -1216 +1216 @@
                                         AND `forummeta`.`meta_key` = '_bbp_old_forum_id'
                                 WHERE `forum`.`post_type` = '" . bbp_get_forum_post_type() . "'
-                                GROUP BY `forum`.`ID`;" );
+                                GROUP BY `forum`.`ID`" );
 
     // Bail if forum IDs returned an error
@@ -1235 +1235 @@
 
         // Attempt to update group meta
-        $updated = $bbp_db->query( "UPDATE `{$groups_meta_table}` SET `meta_value` = '{$group_forums->ID}' WHERE `meta_key` = 'forum_id' AND `meta_value` = '{$group_forums->meta_value}';" );
+        $updated = $bbp_db->query( "UPDATE `{$groups_meta_table}` SET `meta_value` = '{$group_forums->ID}' WHERE `meta_key` = 'forum_id' AND `meta_value` = '{$group_forums->meta_value}'" );
 
         // Bump the count
@@ -1243 +1243 @@
 
         // Update group to forum relationship data
-        $group_id = (int) $bbp_db->get_var( "SELECT `group_id` FROM `{$groups_meta_table}` WHERE `meta_key` = 'forum_id' AND `meta_value` = '{$group_forums->ID}';" );
+        $group_id = (int) $bbp_db->get_var( "SELECT `group_id` FROM `{$groups_meta_table}` WHERE `meta_key` = 'forum_id' AND `meta_value` = '{$group_forums->ID}'" );
         if ( ! empty( $group_id ) ) {
 
@@ -1250 +1250 @@
 
             // Get the group status
-            $group_status = $bbp_db->get_var( "SELECT `status` FROM `{$groups_table}` WHERE `id` = '{$group_id}';" );
+            $group_status = $bbp_db->get_var( "SELECT `status` FROM `{$groups_table}` WHERE `id` = '{$group_id}'" );
 
             // Sync up forum visibility based on group status
@@ -1343 +1343 @@
     $result    = __( 'Failed!', 'bbpress' );
 
-    $sql_delete = "DELETE FROM {$bbp_db->postmeta} WHERE meta_key IN ( '_bbp_topic_count', '_bbp_total_topic_count', '_bbp_topic_count_hidden' );";
+    $sql_delete = "DELETE FROM {$bbp_db->postmeta} WHERE meta_key IN ( '_bbp_topic_count', '_bbp_total_topic_count', '_bbp_topic_count_hidden' )";
     if ( is_wp_error( $bbp_db->query( $sql_delete ) ) ) {
         return array( 1, sprintf( $statement, $result ) );
@@ -1425 +1425 @@
     $result      = __( 'Failed!', 'bbpress' );
 
-    $sql_select  = "SELECT `post_author`, COUNT(DISTINCT `ID`) as `_count` FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_topic_post_type() . "' AND `post_status` = '" . bbp_get_public_status_id() . "' GROUP BY `post_author`;";
+    $sql_select  = "SELECT `post_author`, COUNT(DISTINCT `ID`) as `_count` FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_topic_post_type() . "' AND `post_status` = '" . bbp_get_public_status_id() . "' GROUP BY `post_author`";
     $insert_rows = $bbp_db->get_results( $sql_select );
 
@@ -1442 +1442 @@
     }
 
-    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}';";
+    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}'";
     if ( is_wp_error( $bbp_db->query( $sql_delete ) ) ) {
         return array( 3, sprintf( $statement, $result ) );
@@ -1449 +1449 @@
     foreach ( array_chunk( $insert_values, 10000 ) as $chunk ) {
         $chunk = "\n" . implode( ",\n", $chunk );
-        $sql_insert = "INSERT INTO `{$bbp_db->usermeta}` (`user_id`, `meta_key`, `meta_value`) VALUES {$chunk};";
+        $sql_insert = "INSERT INTO `{$bbp_db->usermeta}` (`user_id`, `meta_key`, `meta_value`) VALUES {$chunk}";
 
         if ( is_wp_error( $bbp_db->query( $sql_insert ) ) ) {
@@ -1477 +1477 @@
     $result      = __( 'Failed!', 'bbpress' );
 
-    $sql_select  = "SELECT `post_author`, COUNT(DISTINCT `ID`) as `_count` FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_reply_post_type() . "' AND `post_status` = '" . bbp_get_public_status_id() . "' GROUP BY `post_author`;";
+    $sql_select  = "SELECT `post_author`, COUNT(DISTINCT `ID`) as `_count` FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_reply_post_type() . "' AND `post_status` = '" . bbp_get_public_status_id() . "' GROUP BY `post_author`";
     $insert_rows = $bbp_db->get_results( $sql_select );
 
@@ -1494 +1494 @@
     }
 
-    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}';";
+    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}'";
     if ( is_wp_error( $bbp_db->query( $sql_delete ) ) ) {
         return array( 3, sprintf( $statement, $result ) );
@@ -1501 +1501 @@
     foreach ( array_chunk( $insert_values, 10000 ) as $chunk ) {
         $chunk = "\n" . implode( ",\n", $chunk );
-        $sql_insert = "INSERT INTO `{$bbp_db->usermeta}` (`user_id`, `meta_key`, `meta_value`) VALUES {$chunk};";
+        $sql_insert = "INSERT INTO `{$bbp_db->usermeta}` (`user_id`, `meta_key`, `meta_value`) VALUES {$chunk}";
 
         if ( is_wp_error( $bbp_db->query( $sql_insert ) ) ) {
@@ -1530 +1530 @@
 
     $key       = $bbp_db->prefix . '_bbp_favorites';
-    $users     = $bbp_db->get_results( "SELECT `user_id`, `meta_value` AS `favorites` FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}';" );
+    $users     = $bbp_db->get_results( "SELECT `user_id`, `meta_value` AS `favorites` FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}'" );
 
     if ( is_wp_error( $users ) ) {
@@ -1536 +1536 @@
     }
 
-    $topics = $bbp_db->get_col( "SELECT `ID` FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_topic_post_type() . "' AND `post_status` = '" . bbp_get_public_status_id() . "';" );
+    $topics = $bbp_db->get_col( "SELECT `ID` FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_topic_post_type() . "' AND `post_status` = '" . bbp_get_public_status_id() . "'" );
 
     if ( is_wp_error( $topics ) ) {
@@ -1565 +1565 @@
     }
 
-    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}';";
+    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}'";
     if ( is_wp_error( $bbp_db->query( $sql_delete ) ) ) {
         return array( 4, sprintf( $statement, $result ) );
@@ -1572 +1572 @@
     foreach ( array_chunk( $values, 10000 ) as $chunk ) {
         $chunk = "\n" . implode( ",\n", $chunk );
-        $sql_insert = "INSERT INTO `{$bbp_db->usermeta}` (`user_id`, `meta_key`, `meta_value`) VALUES {$chunk};";
+        $sql_insert = "INSERT INTO `{$bbp_db->usermeta}` (`user_id`, `meta_key`, `meta_value`) VALUES {$chunk}";
         if ( is_wp_error( $bbp_db->query( $sql_insert ) ) ) {
             return array( 5, sprintf( $statement, $result ) );
@@ -1600 +1600 @@
 
     $key       = $bbp_db->prefix . '_bbp_subscriptions';
-    $users     = $bbp_db->get_results( "SELECT `user_id`, `meta_value` AS `subscriptions` FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}';" );
+    $users     = $bbp_db->get_results( "SELECT `user_id`, `meta_value` AS `subscriptions` FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}'" );
 
     if ( is_wp_error( $users ) ) {
@@ -1606 +1606 @@
     }
 
-    $topics = $bbp_db->get_col( "SELECT `ID` FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_topic_post_type() . "' AND `post_status` = '" . bbp_get_public_status_id() . "';" );
+    $topics = $bbp_db->get_col( "SELECT `ID` FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_topic_post_type() . "' AND `post_status` = '" . bbp_get_public_status_id() . "'" );
     if ( is_wp_error( $topics ) ) {
         return array( 2, sprintf( $statement, $result ) );
@@ -1634 +1634 @@
     }
 
-    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}';";
+    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}'";
     if ( is_wp_error( $bbp_db->query( $sql_delete ) ) ) {
         return array( 4, sprintf( $statement, $result ) );
@@ -1641 +1641 @@
     foreach ( array_chunk( $values, 10000 ) as $chunk ) {
         $chunk = "\n" . implode( ",\n", $chunk );
-        $sql_insert = "INSERT INTO `{$bbp_db->usermeta}` (`user_id`, `meta_key`, `meta_value`) VALUES {$chunk};";
+        $sql_insert = "INSERT INTO `{$bbp_db->usermeta}` (`user_id`, `meta_key`, `meta_value`) VALUES {$chunk}";
         if ( is_wp_error( $bbp_db->query( $sql_insert ) ) ) {
             return array( 5, sprintf( $statement, $result ) );
@@ -1669 +1669 @@
 
     $key       = $bbp_db->prefix . '_bbp_forum_subscriptions';
-    $users     = $bbp_db->get_results( "SELECT `user_id`, `meta_value` AS `subscriptions` FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}';" );
+    $users     = $bbp_db->get_results( "SELECT `user_id`, `meta_value` AS `subscriptions` FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}'" );
 
     if ( is_wp_error( $users ) ) {
@@ -1675 +1675 @@
     }
 
-    $forums = $bbp_db->get_col( "SELECT `ID` FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_forum_post_type() . "' AND `post_status` = '" . bbp_get_public_status_id() . "';" );
+    $forums = $bbp_db->get_col( "SELECT `ID` FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_forum_post_type() . "' AND `post_status` = '" . bbp_get_public_status_id() . "'" );
     if ( is_wp_error( $forums ) ) {
         return array( 2, sprintf( $statement, $result ) );
@@ -1703 +1703 @@
     }
 
-    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}';";
+    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` = '{$key}'";
     if ( is_wp_error( $bbp_db->query( $sql_delete ) ) ) {
         return array( 4, sprintf( $statement, $result ) );
@@ -1710 +1710 @@
     foreach ( array_chunk( $values, 10000 ) as $chunk ) {
         $chunk = "\n" . implode( ",\n", $chunk );
-        $sql_insert = "INSERT INTO `{$bbp_db->usermeta}` (`user_id`, `meta_key`, `meta_value`) VALUES {$chunk};";
+        $sql_insert = "INSERT INTO `{$bbp_db->usermeta}` (`user_id`, `meta_key`, `meta_value`) VALUES {$chunk}";
         if ( is_wp_error( $bbp_db->query( $sql_insert ) ) ) {
             return array( 5, sprintf( $statement, $result ) );
@@ -1801 +1801 @@
 
     // First, delete everything.
-    if ( is_wp_error( $bbp_db->query( "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` IN ( '_bbp_last_reply_id', '_bbp_last_topic_id', '_bbp_last_active_id', '_bbp_last_active_time' );" ) ) ) {
+    if ( is_wp_error( $bbp_db->query( "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` IN ( '_bbp_last_reply_id', '_bbp_last_topic_id', '_bbp_last_active_id', '_bbp_last_active_time' )" ) ) ) {
         return array( 1, sprintf( $statement, $result ) );
     }
@@ -1816 +1816 @@
             FROM `{$bbp_db->posts}` AS `topic` INNER JOIN `{$bbp_db->posts}` AS `reply` ON `topic`.`ID` = `reply`.`post_parent`
             WHERE `reply`.`post_status` = '{$pps}' AND `topic`.`post_type` = '{$tpt}' AND `reply`.`post_type` = '{$rpt}'
-            GROUP BY `topic`.`ID` );" ) ) ) {
+            GROUP BY `topic`.`ID` )" ) ) ) {
         return array( 2, sprintf( $statement, $result ) );
     }
@@ -1825 +1825 @@
             FROM `{$bbp_db->posts}` AS `topic` LEFT JOIN `{$bbp_db->postmeta}` AS `reply`
             ON `topic`.`ID` = `reply`.`post_id` AND `reply`.`meta_key` = '_bbp_last_reply_id'
-            WHERE `reply`.`meta_id` IS NULL AND `topic`.`post_type` = '{$tpt}' );" ) ) ) {
+            WHERE `reply`.`meta_id` IS NULL AND `topic`.`post_type` = '{$tpt}' )" ) ) ) {
         return array( 3, sprintf( $statement, $result ) );
     }
@@ -1834 +1834 @@
             FROM `{$bbp_db->posts}` AS `forum` INNER JOIN `{$bbp_db->posts}` AS `topic` ON `forum`.`ID` = `topic`.`post_parent`
             WHERE `topic`.`post_status` = '{$pps}' AND `forum`.`post_type` = '{$fpt}' AND `topic`.`post_type` = '{$tpt}'
-            GROUP BY `forum`.`ID` );" ) ) ) {
+            GROUP BY `forum`.`ID` )" ) ) ) {
         return array( 4, sprintf( $statement, $result ) );
     }
@@ -1843 +1843 @@
             FROM `{$bbp_db->posts}` AS `forum` LEFT JOIN `{$bbp_db->postmeta}` AS `topic`
             ON `forum`.`ID` = `topic`.`post_id` AND `topic`.`meta_key` = '_bbp_last_topic_id'
-            WHERE `topic`.`meta_id` IS NULL AND `forum`.`post_type` = '{$fpt}' );" ) ) ) {
+            WHERE `topic`.`meta_id` IS NULL AND `forum`.`post_type` = '{$fpt}' )" ) ) ) {
         return array( 5, sprintf( $statement, $result ) );
     }
@@ -1852 +1852 @@
             FROM `{$bbp_db->posts}` AS `topic` INNER JOIN `{$bbp_db->posts}` AS `reply` ON `topic`.`ID` = `reply`.`post_parent`
             WHERE `reply`.`post_status` = '{$pps}' AND `topic`.`post_type` = '{$tpt}' AND `reply`.`post_type` = '{$rpt}'
-            GROUP BY `topic`.`ID` );" ) ) ) {
+            GROUP BY `topic`.`ID` )" ) ) ) {
         return array( 6, sprintf( $statement, $result ) );
     }
@@ -1861 +1861 @@
             FROM `{$bbp_db->posts}` AS `topic` LEFT JOIN `{$bbp_db->postmeta}` AS `reply`
             ON `topic`.`ID` = `reply`.`post_id` AND `reply`.`meta_key` = '_bbp_last_active_id'
-            WHERE `reply`.`meta_id` IS NULL AND `topic`.`post_type` = '{$tpt}' );" ) ) ) {
+            WHERE `reply`.`meta_id` IS NULL AND `topic`.`post_type` = '{$tpt}' )" ) ) ) {
         return array( 7, sprintf( $statement, $result ) );
     }
@@ -1870 +1870 @@
             FROM `{$bbp_db->posts}` AS `topic` INNER JOIN `{$bbp_db->posts}` AS `reply` ON `topic`.`ID` = `reply`.`post_parent`
             WHERE `reply`.`post_status` = '{$pps}' AND `topic`.`post_type` = '{$tpt}' AND `reply`.`post_type` = '{$rpt}'
-            GROUP BY `topic`.`ID` );" ) ) ) {
+            GROUP BY `topic`.`ID` )" ) ) ) {
         return array( 8, sprintf( $statement, $result ) );
     }
@@ -1879 +1879 @@
             FROM `{$bbp_db->posts}` AS `topic` LEFT JOIN `{$bbp_db->postmeta}` AS `reply`
             ON `topic`.`ID` = `reply`.`post_id` AND `reply`.`meta_key` = '_bbp_last_active_time'
-            WHERE `reply`.`meta_id` IS NULL AND `topic`.`post_type` = '{$tpt}' );" ) ) ) {
+            WHERE `reply`.`meta_id` IS NULL AND `topic`.`post_type` = '{$tpt}' )" ) ) ) {
         return array( 9, sprintf( $statement, $result ) );
     }
 
     // Forums need to know what their last active item is as well. Now it gets a bit more complex to do in the database.
-    $forums = $bbp_db->get_col( "SELECT `ID` FROM `{$bbp_db->posts}` WHERE `post_type` = '{$fpt}' and `post_status` != 'auto-draft';" );
+    $forums = $bbp_db->get_col( "SELECT `ID` FROM `{$bbp_db->posts}` WHERE `post_type` = '{$fpt}' and `post_status` != 'auto-draft'" );
     if ( is_wp_error( $forums ) ) {
         return array( 10, sprintf( $statement, $result ) );
@@ -1928 +1928 @@
     $result    = __( 'Failed!', 'bbpress' );
 
-    $forums    = $bbp_db->get_col( "SELECT ID FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_forum_post_type() . "';" );
+    $forums    = $bbp_db->get_col( "SELECT ID FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_forum_post_type() . "'" );
 
     // Bail if no forums found
@@ -1997 +1997 @@
     $changed       = 0;
 
-    $closed_topics = $bbp_db->get_col( "SELECT ID FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_topic_post_type() . "' AND `post_status` = 'closed';" );
+    $closed_topics = $bbp_db->get_col( "SELECT ID FROM `{$bbp_db->posts}` WHERE `post_type` = '" . bbp_get_topic_post_type() . "' AND `post_status` = 'closed'" );
 
     // Bail if no closed topics found
@@ -2066 +2066 @@
 
     // First, delete everything.
-    if ( is_wp_error( $bbp_db->query( "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` = '_bbp_forum_id';" ) ) ) {
+    if ( is_wp_error( $bbp_db->query( "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` = '_bbp_forum_id'" ) ) ) {
         return array( 1, sprintf( $statement, $result ) );
     }
@@ -2080 +2080 @@
                 AS `topic`
             WHERE `topic`.`post_type` = '{$tpt}'
-            GROUP BY `topic`.`ID` );" ) ) ) {
+            GROUP BY `topic`.`ID` )" ) ) ) {
         return array( 2, sprintf( $statement, $result ) );
     }
@@ -2094 +2094 @@
             WHERE `topic`.`post_type` = '{$tpt}'
                 AND `reply`.`post_type` = '{$rpt}'
-            GROUP BY `reply`.`ID` );" ) ) ) {
+            GROUP BY `reply`.`ID` )" ) ) ) {
         return array( 3, sprintf( $statement, $result ) );
     }
@@ -2121 +2121 @@
 
     // First, delete everything.
-    if ( is_wp_error( $bbp_db->query( "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` = '_bbp_topic_id';" ) ) ) {
+    if ( is_wp_error( $bbp_db->query( "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` = '_bbp_topic_id'" ) ) ) {
         return array( 1, sprintf( $statement, $result ) );
     }
@@ -2135 +2135 @@
                 AS `topic`
             WHERE `topic`.`post_type` = '{$tpt}'
-            GROUP BY `topic`.`ID` );" ) ) ) {
+            GROUP BY `topic`.`ID` )" ) ) ) {
         return array( 3, sprintf( $statement, $result ) );
     }
@@ -2149 +2149 @@
             WHERE `topic`.`post_type` = '{$tpt}'
                 AND `reply`.`post_type` = '{$rpt}'
-            GROUP BY `reply`.`ID` );" ) ) ) {
+            GROUP BY `reply`.`ID` )" ) ) ) {
         return array( 4, sprintf( $statement, $result ) );
     }
@@ -2176 +2176 @@
 
     // Delete cases where `_bbp_reply_to` was accidentally set to itself
-    if ( is_wp_error( $bbp_db->query( "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` = '_bbp_reply_to' AND `post_id` = `meta_value`;" ) ) ) {
+    if ( is_wp_error( $bbp_db->query( "DELETE FROM `{$bbp_db->postmeta}` WHERE `meta_key` = '_bbp_reply_to' AND `post_id` = `meta_value`" ) ) ) {
         return array( 1, sprintf( $statement, $result ) );
     }
@@ -2193 +2193 @@
                                         ON `a`.`menu_order` = `b`.`menu_order`
                                         AND `a`.`post_parent` = `b`.`post_parent`
-                                        WHERE `post_type` = '{$rpt}';", OBJECT_K );
+                                        WHERE `post_type` = '{$rpt}'", OBJECT_K );
 
     // Bail if no replies returned
@@ -2229 +2229 @@
     $changed   = $total = 0;
     $key       = $bbp_db->prefix . '_bbp_favorites';
-    $favorites = $bbp_db->get_results( "SELECT * FROM {$bbp_db->usermeta} WHERE meta_key = '{$key}'" );
+    $favorites = $bbp_db->get_results( $bbp_db->prepare( "SELECT * FROM {$bbp_db->usermeta} WHERE meta_key = %s", $key ) );
 
     // Bail if no closed topics found
@@ -2292 +2292 @@
     $changed       = $total = 0;
     $key           = $bbp_db->prefix . '_bbp_subscriptions';
-    $subscriptions = $bbp_db->get_results( "SELECT * FROM {$bbp_db->usermeta} WHERE meta_key = '{$key}'" );
+    $subscriptions = $bbp_db->get_results( $bbp_db->prepare( "SELECT * FROM {$bbp_db->usermeta} WHERE meta_key = %s", $key ) );
 
     // Bail if no closed topics found
@@ -2468 +2468 @@
         $statement  = __( 'Deleting Post Meta… %s', 'bbpress' );
         $sql_meta   = implode( "', '", $sql_meta );
-        $sql_delete = "DELETE FROM `{$bbp_db->postmeta}` WHERE `post_id` IN ('{$sql_meta}');";
+        $sql_delete = "DELETE FROM `{$bbp_db->postmeta}` WHERE `post_id` IN ('{$sql_meta}')";
         $result     = is_wp_error( $bbp_db->query( $sql_delete ) ) ? $failed : $success;
         $messages[] = sprintf( $statement, $result );
@@ -2482 +2482 @@
         $statement  = __( 'Deleting Post Revisions… %s', 'bbpress' );
         $sql_meta   = implode( "', '", $sql_meta );
-        $sql_delete = "DELETE FROM `{$bbp_db->posts}` WHERE `post_parent` IN ('{$sql_meta}') AND `post_type` = 'revision';";
+        $sql_delete = "DELETE FROM `{$bbp_db->posts}` WHERE `post_parent` IN ('{$sql_meta}') AND `post_type` = 'revision'";
         $result     = is_wp_error( $bbp_db->query( $sql_delete ) ) ? $failed : $success;
         $messages[] = sprintf( $statement, $result );
@@ -2490 +2490 @@
 
     $statement  = __( 'Deleting Forum Moderators… %s', 'bbpress' );
-    $sql_delete = "DELETE a,b,c FROM `{$bbp_db->terms}` AS a LEFT JOIN `{$bbp_db->term_taxonomy}` AS c ON a.term_id = c.term_id LEFT JOIN `{$bbp_db->term_relationships}` AS b ON b.term_taxonomy_id = c.term_taxonomy_id WHERE c.taxonomy = 'forum-mod';";
+    $sql_delete = "DELETE a,b,c FROM `{$bbp_db->terms}` AS a LEFT JOIN `{$bbp_db->term_taxonomy}` AS c ON a.term_id = c.term_id LEFT JOIN `{$bbp_db->term_relationships}` AS b ON b.term_taxonomy_id = c.term_taxonomy_id WHERE c.taxonomy = 'forum-mod'";
     $result     = is_wp_error( $bbp_db->query( $sql_delete ) ) ? $failed : $success;
     $messages[] = sprintf( $statement, $result );
@@ -2497 +2497 @@
 
     $statement  = __( 'Deleting Topic Tags… %s', 'bbpress' );
-    $sql_delete = "DELETE a,b,c FROM `{$bbp_db->terms}` AS a LEFT JOIN `{$bbp_db->term_taxonomy}` AS c ON a.term_id = c.term_id LEFT JOIN `{$bbp_db->term_relationships}` AS b ON b.term_taxonomy_id = c.term_taxonomy_id WHERE c.taxonomy = 'topic-tag';";
+    $sql_delete = "DELETE a,b,c FROM `{$bbp_db->terms}` AS a LEFT JOIN `{$bbp_db->term_taxonomy}` AS c ON a.term_id = c.term_id LEFT JOIN `{$bbp_db->term_relationships}` AS b ON b.term_taxonomy_id = c.term_taxonomy_id WHERE c.taxonomy = 'topic-tag'";
     $result     = is_wp_error( $bbp_db->query( $sql_delete ) ) ? $failed : $success;
     $messages[] = sprintf( $statement, $result );
@@ -2513 +2513 @@
             $statement  = __( 'Deleting Imported Users… %s', 'bbpress' );
             $sql_meta   = implode( "', '", $sql_meta );
-            $sql_delete = "DELETE FROM `{$bbp_db->users}` WHERE `ID` IN ('{$sql_meta}');";
+            $sql_delete = "DELETE FROM `{$bbp_db->users}` WHERE `ID` IN ('{$sql_meta}')";
             $result     = is_wp_error( $bbp_db->query( $sql_delete ) ) ? $failed : $success;
             $messages[] = sprintf( $statement, $result );
             $statement  = __( 'Deleting Imported User Meta… %s', 'bbpress' );
-            $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `user_id` IN ('{$sql_meta}');";
+            $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `user_id` IN ('{$sql_meta}')";
             $result     = is_wp_error( $bbp_db->query( $sql_delete ) ) ? $failed : $success;
             $messages[] = sprintf( $statement, $result );
@@ -2525 +2525 @@
     // Next, if we still have users that were not imported delete that meta data
     $statement  = __( 'Deleting User Meta… %s', 'bbpress' );
-    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` LIKE '%%_bbp_%%';";
+    $sql_delete = "DELETE FROM `{$bbp_db->usermeta}` WHERE `meta_key` LIKE '%%_bbp_%%'";
     $result     = is_wp_error( $bbp_db->query( $sql_delete ) ) ? $failed : $success;
     $messages[] = sprintf( $statement, $result );

trunk/src/includes/common/functions.php

@@ -1758 +1758 @@
         $post_status = "'" . implode( "', '", $post_status ) . "'";
         $bbp_db      = bbp_db();
-        $query       = $bbp_db->prepare( "SELECT ID FROM {$bbp_db->posts} WHERE post_parent = %d AND post_status IN ( {$post_status} ) AND post_type = '%s' ORDER BY ID DESC;", $parent_id, $post_type );
+        $query       = $bbp_db->prepare( "SELECT ID FROM {$bbp_db->posts} WHERE post_parent = %d AND post_status IN ( {$post_status} ) AND post_type = %s ORDER BY ID DESC", $parent_id, $post_type );
         $child_ids   = (array) $bbp_db->get_col( $query );
 

trunk/src/includes/topics/functions.php

@@ -2795 +2795 @@
         $post_status = "'" . implode( "','", $statuses ) . "'";
         $bbp_db      = bbp_db();
-        $query       = $bbp_db->prepare( "SELECT COUNT(ID) FROM {$bbp_db->posts} WHERE post_parent = %d AND post_status IN ( {$post_status} ) AND post_type = '%s';", $topic_id, bbp_get_reply_post_type() );
+        $query       = $bbp_db->prepare( "SELECT COUNT(ID) FROM {$bbp_db->posts} WHERE post_parent = %d AND post_status IN ( {$post_status} ) AND post_type = %s", $topic_id, bbp_get_reply_post_type() );
         $reply_count = $bbp_db->get_var( $query );
     }
@@ -2970 +2970 @@
     // Query the DB to get voices in this topic
     $bbp_db = bbp_db();
-    $query  = $bbp_db->prepare( "SELECT COUNT( DISTINCT post_author ) FROM {$bbp_db->posts} WHERE ( post_parent = %d AND post_status = '%s' AND post_type = '%s' ) OR ( ID = %d AND post_type = '%s' );", $topic_id, bbp_get_public_status_id(), bbp_get_reply_post_type(), $topic_id, bbp_get_topic_post_type() );
+    $query  = $bbp_db->prepare( "SELECT COUNT( DISTINCT post_author ) FROM {$bbp_db->posts} WHERE ( post_parent = %d AND post_status = %s AND post_type = %s ) OR ( ID = %d AND post_type = %s )", $topic_id, bbp_get_public_status_id(), bbp_get_reply_post_type(), $topic_id, bbp_get_topic_post_type() );
     $voices = (int) $bbp_db->get_var( $query );
 
@@ -3011 +3011 @@
     // Query the DB to get anonymous replies in this topic
     $bbp_db  = bbp_db();
-    $query   = $bbp_db->prepare( "SELECT COUNT( ID ) FROM {$bbp_db->posts} WHERE ( post_parent = %d AND post_status = '%s' AND post_type = '%s' AND post_author = 0 ) OR ( ID = %d AND post_type = '%s' AND post_author = 0 );", $topic_id, bbp_get_public_status_id(), bbp_get_reply_post_type(), $topic_id, bbp_get_topic_post_type() );
+    $query   = $bbp_db->prepare( "SELECT COUNT( ID ) FROM {$bbp_db->posts} WHERE ( post_parent = %d AND post_status = %s AND post_type = %s AND post_author = 0 ) OR ( ID = %d AND post_type = %s AND post_author = 0 )", $topic_id, bbp_get_public_status_id(), bbp_get_reply_post_type(), $topic_id, bbp_get_topic_post_type() );
     $replies = (int) $bbp_db->get_var( $query );
 

trunk/src/includes/users/capabilities.php

@@ -505 +505 @@
 
         // Get topics and replies
-        $query = $bbp_db->prepare( "SELECT ID FROM {$bbp_db->posts} WHERE post_author = %d AND post_status = '%s' AND post_type IN ( {$post_types} )", $user_id, bbp_get_public_status_id() );
+        $query = $bbp_db->prepare( "SELECT ID FROM {$bbp_db->posts} WHERE post_author = %d AND post_status = %s AND post_type IN ( {$post_types} )", $user_id, bbp_get_public_status_id() );
         $posts = $bbp_db->get_col( $query );
 
@@ -596 +596 @@
 
         // Get topics and replies
-        $query = $bbp_db->prepare( "SELECT ID FROM {$bbp_db->posts} WHERE post_author = %d AND post_status = '%s' AND post_type IN ( {$post_types} )", $user_id, bbp_get_spam_status_id() );
+        $query = $bbp_db->prepare( "SELECT ID FROM {$bbp_db->posts} WHERE post_author = %d AND post_status = %s AND post_type IN ( {$post_types} )", $user_id, bbp_get_spam_status_id() );
         $posts = $bbp_db->get_col( $query );
 

trunk/src/includes/users/functions.php

@@ -1866 +1866 @@
 
     $bbp_db = bbp_db();
-    $count  = (int) $bbp_db->get_var( "SELECT COUNT(*)
-        FROM {$bbp_db->posts}
-        WHERE post_type = '" . bbp_get_topic_post_type() . "'
-        AND post_status = '" . bbp_get_closed_status_id() . "'
-        AND post_author = $user_id;"
-    );
+    $count  = (int) $bbp_db->get_var( $bbp_db->prepare(
+        "SELECT COUNT(*)
+            FROM {$bbp_db->posts}
+            WHERE post_type = %s
+                AND post_status = %s
+                AND post_author = %d"
+    ), bbp_get_topic_post_type(), bbp_get_closed_status_id(), $user_id );
 
     return (int) apply_filters( 'bbp_get_user_closed_topic_count', $count, $user_id );
@@ -2185 +2186 @@
     // Bail if no user password to convert
     $bbp_db = bbp_db();
-    $query  = $bbp_db->prepare( "SELECT * FROM {$bbp_db->users} INNER JOIN {$bbp_db->usermeta} ON user_id = ID WHERE meta_key = '_bbp_class' AND user_login = '%s' LIMIT 1", $username );
+    $query  = $bbp_db->prepare( "SELECT * FROM {$bbp_db->users} INNER JOIN {$bbp_db->usermeta} ON user_id = ID WHERE meta_key = %s AND user_login = %s LIMIT 1", '_bbp_class', $username );
     $row    = $bbp_db->get_row( $query );
     if ( empty( $row ) || is_wp_error( $row ) ) {