Skip to:
Content

bbPress.org


Ignore:
Timestamp:
12/28/2016 04:24:52 AM (9 years ago)
Author:
johnjamesjacoby
Message:

Audit direct query and prepare() usages, and more tightly adhere to best practices.

  • No quotes around directives
  • Avoid concatenation, prefer variable parsing in double-quoted strings
  • Covers converters, helper functions, and tools
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/includes/admin/converter.php

    r6184 r6191  
    664664                    KEY value_id (value_id),
    665665                    KEY meta_join (meta_key({$max_index_length}), meta_value({$max_index_length}))
    666                 ) {$charset_collate};";
     666                ) {$charset_collate}";
    667667
    668668        dbDelta( $sql );
    … …  
    10161016            // Get some data from the old forums
    10171017            $field_list  = array_unique( $field_list );
    1018             $forum_query = 'SELECT ' . implode( ',', $field_list ) . ' FROM ' . $this->opdb->prefix . $from_tablename . ' LIMIT ' . $start . ', ' . $this->max_rows;
     1018            $fields      = implode( ',', $field_list );
     1019            $forum_query = "SELECT {$fields} FROM {$this->opdb->prefix}{$from_tablename} LIMIT {$start}, {$this->max_rows}";
    10191020            $forum_array = $this->opdb->get_results( $forum_query, ARRAY_A );
    10201021
    … …  
    12541255
    12551256        if ( ! empty( $this->sync_table ) ) {
    1256             $query = 'SELECT value_id, meta_value FROM '            . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_forum_parent_id" AND meta_value > 0 LIMIT ' . $start . ', ' . $this->max_rows;
     1257            $query = $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value > 0 LIMIT {$start}, {$this->max_rows}", '_bbp_old_forum_parent_id' );
    12571258        } else {
    1258             $query = 'SELECT post_id AS value_id, meta_value FROM ' . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_forum_parent_id" AND meta_value > 0 LIMIT ' . $start . ', ' . $this->max_rows;
     1259            $query = $this->wpdb->prepare( "SELECT post_id AS value_id, meta_value FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value > 0 LIMIT {$start}, {$this->max_rows}", '_bbp_old_forum_parent_id' );
    12591260        }
    12601261
    … …  
    12651266        foreach ( (array) $forum_array as $row ) {
    12661267            $parent_id = $this->callback_forumid( $row->meta_value );
    1267             $this->wpdb->query( 'UPDATE ' . $this->wpdb->posts . ' SET post_parent = "' . $parent_id . '" WHERE ID = "' . $row->value_id . '" LIMIT 1' );
     1268            $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->posts} SET post_parent = %d WHERE ID = %d LIMIT 1", $parent_id, $row->value_id ) );
    12681269            $has_update = true;
    12691270        }
    … …  
    12861287
    12871288        if ( ! empty( $this->sync_table ) ) {
    1288             $query = 'SELECT value_id, meta_value FROM '            . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_sticky_status_id" AND meta_value = "sticky" LIMIT ' . $start . ', ' . $this->max_rows;
     1289            $query = $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_sticky_status_id', 'sticky' );
    12891290        } else {
    1290             $query = 'SELECT post_id AS value_id, meta_value FROM ' . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_sticky_status_id" AND meta_value = "sticky" LIMIT ' . $start . ', ' . $this->max_rows;
     1291            $query = $this->wpdb->prepare( "SELECT post_id AS value_id, meta_value FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_sticky_status_id', 'sticky' );
    12911292        }
    12921293
    … …  
    13171318
    13181319        if ( ! empty( $this->sync_table ) ) {
    1319             $query = 'SELECT value_id, meta_value FROM '            . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_sticky_status_id" AND meta_value = "super-sticky" LIMIT ' . $start . ', ' . $this->max_rows;
     1320            $query = $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_sticky_status_id', 'super-sticky' );
    13201321        } else {
    1321             $query = 'SELECT post_id AS value_id, meta_value FROM ' . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_sticky_status_id" AND meta_value = "super-sticky" LIMIT ' . $start . ', ' . $this->max_rows;
     1322            $query = $this->wpdb->prepare( "SELECT post_id AS value_id, meta_value FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_sticky_status_id', 'super-sticky' );
    13221323        }
    13231324
    … …  
    13481349
    13491350        if ( ! empty( $this->sync_table ) ) {
    1350             $query = 'SELECT value_id, meta_value FROM ' . $this->sync_table_name           . ' WHERE meta_key = "_bbp_old_closed_status_id" AND meta_value = "closed" LIMIT ' . $start . ', ' . $this->max_rows;
     1351            $query = $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_closed_status_id', 'closed' );
    13511352        } else {
    1352             $query = 'SELECT post_id AS value_id, meta_value FROM ' . $this->wpdb->postmeta . ' WHERE meta_key = "_bbp_old_closed_status_id" AND meta_value = "closed" LIMIT ' . $start . ', ' . $this->max_rows;
     1353            $query = $this->wpdb->prepare( "SELECT post_id AS value_id, meta_value FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT {$start}, {$this->max_rows}", '_bbp_old_closed_status_id', 'closed' );
    13531354        }
    13541355
    … …  
    13751376
    13761377        if ( ! empty( $this->sync_table ) ) {
    1377             $query = 'SELECT value_id, meta_value FROM ' . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_reply_to_id" AND meta_value > 0 LIMIT ' . $start . ', ' . $this->max_rows;
     1378            $query = $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value > 0 LIMIT {$start}, {$this->max_rows}", '_bbp_old_reply_to_id' );
    13781379        } else {
    1379             $query = 'SELECT post_id AS value_id, meta_value FROM ' . $this->wpdb->postmeta . ' WHERE meta_key = "_bbp_old_reply_to_id" AND meta_value > 0 LIMIT ' . $start . ', ' . $this->max_rows;
     1380            $query = $this->wpdb->prepare( "SELECT post_id AS value_id, meta_value FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value > 0 LIMIT {$start}, {$this->max_rows}", '_bbp_old_reply_to_id' );
    13801381        }
    13811382
    … …  
    13861387        foreach ( (array) $reply_to_array as $row ) {
    13871388            $reply_to = $this->callback_reply_to( $row->meta_value );
    1388             $this->wpdb->query( 'UPDATE ' . $this->wpdb->postmeta . ' SET meta_value = "' . $reply_to . '" WHERE meta_key = "_bbp_reply_to" AND post_id = "' . $row->value_id . '" LIMIT 1' );
     1389            $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->postmeta} SET meta_value = %s WHERE meta_key = %s AND post_id = %d LIMIT 1", $reply_to, '_bbp_reply_to', $row->value_id ) );
    13891390            $has_update = true;
    13901391        }
    … …  
    14051406
    14061407        if ( ! empty( $this->sync_table ) ) {
    1407             $query = 'SELECT sync_table1.value_id AS topic_id, sync_table1.meta_value AS topic_is_anonymous, sync_table2.meta_value AS topic_author
    1408                             FROM       ' . $this->sync_table_name . ' AS sync_table1
    1409                             INNER JOIN ' . $this->sync_table_name . ' AS sync_table2
     1408            $query = $this->wpdb->prepare( "SELECT sync_table1.value_id AS topic_id, sync_table1.meta_value AS topic_is_anonymous, sync_table2.meta_value AS topic_author
     1409                            FROM {$this->sync_table_name} AS sync_table1
     1410                            INNER JOIN {$this->sync_table_name} AS sync_table2
    14101411                            ON ( sync_table1.value_id = sync_table2.value_id )
    1411                             WHERE sync_table1.meta_value =  "true"
    1412                             AND sync_table2.meta_key =  "_bbp_old_topic_author_name_id"
    1413                             LIMIT ' . $start . ', ' . $this->max_rows;
     1412                            WHERE sync_table1.meta_value = %s
     1413                            AND sync_table2.meta_key = %s
     1414                            LIMIT {$start}, {$this->max_rows}", 'true', '_bbp_old_topic_author_name_id' );
    14141415        } else {
    1415             $query = 'SELECT wp_postmeta1.post_id AS topic_id, wp_postmeta1.meta_value AS topic_is_anonymous, wp_postmeta2.meta_value AS topic_author
    1416                             FROM       ' . $this->wpdb->postmeta . ' AS wp_postmeta1
    1417                             INNER JOIN ' . $this->wpdb->postmeta . ' AS wp_postmeta2
     1416            $query = $this->wpdb->prepare( "SELECT wp_postmeta1.post_id AS topic_id, wp_postmeta1.meta_value AS topic_is_anonymous, wp_postmeta2.meta_value AS topic_author
     1417                            FROM {$this->wpdb->postmeta} AS wp_postmeta1
     1418                            INNER JOIN {$this->wpdb->postmeta} AS wp_postmeta2
    14181419                            ON ( wp_postmeta1.post_id = wp_postmeta2.post_id )
    1419                             WHERE wp_postmeta1.meta_value =  "true"
    1420                             AND wp_postmeta2.meta_key =  "_bbp_old_topic_author_name_id"
    1421                             LIMIT ' . $start . ', ' . $this->max_rows;
     1420                            WHERE wp_postmeta1.meta_value = %s
     1421                            AND wp_postmeta2.meta_key = %s
     1422                            LIMIT {$start}, {$this->max_rows}", 'true', '_bbp_old_topic_author_name_id' );
    14221423
    14231424        }
    … …  
    14291430        foreach ( (array) $anonymous_topics as $row ) {
    14301431            $anonymous_topic_author_id = 0;
    1431             $this->wpdb->query( 'UPDATE ' . $this->wpdb->posts . ' SET post_author = "' . $anonymous_topic_author_id . '" WHERE ID = "' . $row->topic_id . '" LIMIT 1' );
     1432            $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->posts} SET post_author = %d WHERE ID = %d LIMIT 1", $anonymous_topic_author_id, $row->topic_id ) );
    14321433
    14331434            add_post_meta( $row->topic_id, '_bbp_anonymous_name', $row->topic_author );
    … …  
    14511452
    14521453        if ( ! empty( $this->sync_table ) ) {
    1453             $query = 'SELECT sync_table1.value_id AS reply_id, sync_table1.meta_value AS reply_is_anonymous, sync_table2.meta_value AS reply_author
    1454                             FROM       ' . $this->sync_table_name . ' AS sync_table1
    1455                             INNER JOIN ' . $this->sync_table_name . ' AS sync_table2
     1454            $query = $this->wpdb->prepare( "SELECT sync_table1.value_id AS reply_id, sync_table1.meta_value AS reply_is_anonymous, sync_table2.meta_value AS reply_author
     1455                            FROM {$this->sync_table_name} AS sync_table1
     1456                            INNER JOIN {$this->sync_table_name} AS sync_table2
    14561457                            ON ( sync_table1.value_id = sync_table2.value_id )
    1457                             WHERE sync_table1.meta_value =  "true"
    1458                             AND sync_table2.meta_key =  "_bbp_old_reply_author_name_id"
    1459                             LIMIT ' . $start . ', ' . $this->max_rows;
     1458                            WHERE sync_table1.meta_value = %s
     1459                            AND sync_table2.meta_key = %s
     1460                            LIMIT {$start}, {$this->max_rows}", 'true', '_bbp_old_reply_author_name_id' );
    14601461        } else {
    1461             $query = 'SELECT wp_postmeta1.post_id AS reply_id, wp_postmeta1.meta_value AS reply_is_anonymous, wp_postmeta2.meta_value AS reply_author
    1462                             FROM       ' . $this->wpdb->postmeta . ' AS wp_postmeta1
    1463                             INNER JOIN ' . $this->wpdb->postmeta . ' AS wp_postmeta2
     1462            $query = $this->wpdb->prepare( "SELECT wp_postmeta1.post_id AS reply_id, wp_postmeta1.meta_value AS reply_is_anonymous, wp_postmeta2.meta_value AS reply_author
     1463                            FROM {$this->wpdb->postmeta} AS wp_postmeta1
     1464                            INNER JOIN {$this->wpdb->postmeta} AS wp_postmeta2
    14641465                            ON ( wp_postmeta1.post_id = wp_postmeta2.post_id )
    1465                             WHERE wp_postmeta1.meta_value =  "true"
    1466                             AND wp_postmeta2.meta_key =  "_bbp_old_reply_author_name_id"
    1467                             LIMIT ' . $start . ', ' . $this->max_rows;
     1466                            WHERE wp_postmeta1.meta_value = %s
     1467                            AND wp_postmeta2.meta_key = %s
     1468                            LIMIT {$start}, {$this->max_rows}", 'true', '_bbp_old_reply_author_name_id' );
    14681469
    14691470        }
    … …  
    14751476        foreach ( (array) $anonymous_replies as $row ) {
    14761477            $anonymous_reply_author_id = 0;
    1477             $this->wpdb->query( 'UPDATE ' . $this->wpdb->posts . ' SET post_author = "' . $anonymous_reply_author_id . '" WHERE ID = "' . $row->reply_id . '" LIMIT 1' );
     1478            $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->posts} SET post_author = %d WHERE ID = %d LIMIT 1", $anonymous_reply_author_id, $row->reply_id ) );
    14781479
    14791480            add_post_meta( $row->reply_id, '_bbp_anonymous_name', $row->reply_author );
    … …  
    14961497
    14971498        if ( true === $this->sync_table ) {
    1498             $query = 'SELECT value_id FROM ' . $this->sync_table_name . ' INNER JOIN ' . $this->wpdb->posts . ' ON(value_id = ID) WHERE meta_key LIKE "_bbp_%" AND value_type = "post" GROUP BY value_id ORDER BY value_id DESC LIMIT ' . $this->max_rows;
     1499            $query = $this->wpdb->prepare( "SELECT value_id FROM {$this->sync_table_name} INNER JOIN {$this->wpdb->posts} ON(value_id = ID) WHERE meta_key LIKE '_bbp_%' AND value_type = %s GROUP BY value_id ORDER BY value_id DESC LIMIT {$this->max_rows}", 'post' );
    14991500        } else {
    1500             $query = 'SELECT post_id AS value_id FROM ' . $this->wpdb->postmeta . ' WHERE meta_key LIKE "_bbp_%" GROUP BY post_id ORDER BY post_id DESC LIMIT ' . $this->max_rows;
     1501            $query = $this->wpdb->prepare( "SELECT post_id AS value_id FROM {$this->wpdb->postmeta} WHERE meta_key LIKE '_bbp_%' GROUP BY post_id ORDER BY post_id DESC LIMIT {$this->max_rows}" );
    15011502        }
    15021503
    … …  
    15151516
    15161517        if ( true === $this->sync_table ) {
    1517             $query = 'SELECT value_id FROM ' . $this->sync_table_name . ' INNER JOIN ' . $this->wpdb->users . ' ON(value_id = ID) WHERE meta_key = "_bbp_old_user_id" AND value_type = "user" LIMIT ' . $this->max_rows;
     1518            $query = $this->wpdb->prepare( "SELECT value_id FROM {$this->sync_table_name} INNER JOIN {$this->wpdb->users} ON(value_id = ID) WHERE meta_key = %s AND value_type = %s LIMIT {$this->max_rows}", '_bbp_old_user_id', 'user' );
    15181519        } else {
    1519             $query = 'SELECT user_id AS value_id FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_old_user_id" LIMIT ' . $this->max_rows;
     1520            $query = $this->wpdb->prepare( "SELECT user_id AS value_id FROM {$this->wpdb->usermeta} WHERE meta_key = %s LIMIT {$this->max_rows}", '_bbp_old_user_id' );
    15201521        }
    15211522
    … …  
    15481549        /** Delete bbconverter passwords **************************************/
    15491550
    1550         $query       = 'SELECT user_id, meta_value FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_password" LIMIT ' . $start . ', ' . $this->max_rows;
     1551        $query       = $this->wpdb->prepare( "SELECT user_id, meta_value FROM {$this->wpdb->usermeta} WHERE meta_key = %s LIMIT {$start}, {$this->max_rows}", '_bbp_password' );
    15511552        update_option( '_bbp_converter_query', $query );
    15521553
    … …  
    15571558            foreach ( $bbconverter as $value ) {
    15581559                if ( is_serialized( $value['meta_value'] ) ) {
    1559                     $this->wpdb->query( 'UPDATE ' . $this->wpdb->users . ' ' . 'SET user_pass = "" ' . 'WHERE ID = "' . $value['user_id'] . '"' );
    1560                 } else {
    1561                     $this->wpdb->query( 'UPDATE ' . $this->wpdb->users . ' ' . 'SET user_pass = "' . $value['meta_value'] . '" ' . 'WHERE ID = "' . $value['user_id'] . '"' );
    1562                     $this->wpdb->query( 'DELETE FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_password" AND user_id = "' . $value['user_id'] . '"' );
     1560                    $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->users} SET user_pass = '' WHERE ID = %d", $value['user_id'] ) );
     1561                } else {
     1562                    $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->users} SET user_pass = %s WHERE ID = %d", $value['meta_value'], $value['user_id'] ) );
     1563                    $this->wpdb->query( $this->wpdb->prepare( "DELETE FROM {$this->wpdb->usermeta} WHERE meta_key = %s AND user_id = %d", '_bbp_password', $value['user_id'] ) );
    15631564                }
    15641565            }
    … …  
    16131614     */
    16141615    public function callback_pass( $username, $password ) {
    1615         $user = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT * FROM ' . $this->wpdb->users . ' WHERE user_login = "%s" AND user_pass = "" LIMIT 1', $username ) );
     1616        $user = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT * FROM {$this->wpdb->users} WHERE user_login = %s AND user_pass = '' LIMIT 1", $username ) );
    16161617        if ( ! empty( $user ) ) {
    1617             $usermeta = $this->wpdb->get_row( 'SELECT * FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_password" AND user_id = "' . $user->ID . '" LIMIT 1' );
     1618            $usermeta = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT * FROM {$this->wpdb->usermeta} WHERE meta_key = %s AND user_id = %d LIMIT 1", '_bbp_password', $user->ID ) );
    16181619
    16191620            if ( ! empty( $usermeta ) ) {
    16201621                if ( $this->authenticate_pass( $password, $usermeta->meta_value ) ) {
    1621                     $this->wpdb->query( 'UPDATE ' . $this->wpdb->users . ' ' . 'SET user_pass = "' . wp_hash_password( $password ) . '" ' . 'WHERE ID = "' . $user->ID . '"' );
    1622                     $this->wpdb->query( 'DELETE FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_password" AND user_id = "' . $user->ID . '"' );
     1622                    $this->wpdb->query( $this->wpdb->prepare( "UPDATE {$this->wpdb->users} SET user_pass = %s WHERE ID = %d", wp_hash_password( $password ), $user->ID ) );
     1623                    $this->wpdb->query( $this->wpdb->prepare( "DELETE FROM {$this->wpdb->usermeta} WHERE meta_key = %s AND user_id = %d", '_bbp_password', $user->ID ) );
    16231624                }
    16241625            }
    … …  
    16351636        if ( ! isset( $this->map_forumid[ $field ] ) ) {
    16361637            if ( ! empty( $this->sync_table ) ) {
    1637                 $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT value_id, meta_value FROM ' . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_forum_id" AND meta_value = "%s" LIMIT 1', $field ) );
     1638                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_forum_id', $field ) );
    16381639            } else {
    1639                 $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT post_id AS value_id FROM '  . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_forum_id" AND meta_value = "%s" LIMIT 1', $field ) );
     1640                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT post_id AS value_id FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_forum_id', $field ) );
    16401641            }
    16411642
    … …  
    16581659        if ( ! isset( $this->map_topicid[ $field ] ) ) {
    16591660            if ( ! empty( $this->sync_table ) ) {
    1660                 $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT value_id, meta_value FROM ' . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_topic_id" AND meta_value = "%s" LIMIT 1', $field ) );
     1661                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_topic_id', $field ) );
    16611662            } else {
    1662                 $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT post_id AS value_id FROM '  . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_topic_id" AND meta_value = "%s" LIMIT 1', $field ) );
     1663                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT post_id AS value_id FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_topic_id', $field ) );
    16631664            }
    16641665
    … …  
    16831684        if ( ! isset( $this->map_reply_to[ $field ] ) ) {
    16841685            if ( ! empty( $this->sync_table ) ) {
    1685                 $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT value_id, meta_value FROM ' . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_reply_id" AND meta_value = "%s" LIMIT 1', $field ) );
     1686                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_reply_id', $field ) );
    16861687            } else {
    1687                 $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT post_id AS value_id FROM '  . $this->wpdb->postmeta  . ' WHERE meta_key = "_bbp_old_reply_id" AND meta_value = "%s" LIMIT 1', $field ) );
     1688                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT post_id AS value_id FROM {$this->wpdb->postmeta} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_reply_id', $field ) );
    16881689            }
    16891690
    … …  
    17061707        if ( ! isset( $this->map_userid[ $field ] ) ) {
    17071708            if ( ! empty( $this->sync_table ) ) {
    1708                 $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT value_id, meta_value FROM ' . $this->sync_table_name . ' WHERE meta_key = "_bbp_old_user_id" AND meta_value = "%s" LIMIT 1', $field ) );
     1709                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT value_id, meta_value FROM {$this->sync_table_name} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_user_id', $field ) );
    17091710            } else {
    1710                 $row = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT user_id AS value_id FROM ' . $this->wpdb->usermeta . ' WHERE meta_key = "_bbp_old_user_id" AND meta_value = "%s" LIMIT 1', $field ) );
     1711                $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT user_id AS value_id FROM {$this->wpdb->usermeta} WHERE meta_key = %s AND meta_value = %s LIMIT 1", '_bbp_old_user_id', $field ) );
    17111712            }
    17121713
    … …  
    17541755            $this->map_topicid_to_forumid[ $topicid ] = 0;
    17551756        } elseif ( ! isset( $this->map_topicid_to_forumid[ $topicid ] ) ) {
    1756             $row = $this->wpdb->get_row( 'SELECT post_parent FROM ' . $this->wpdb->posts . ' WHERE ID = "' . $topicid . '" LIMIT 1' );
     1757            $row = $this->wpdb->get_row( $this->wpdb->prepare( "SELECT post_parent FROM {$this->wpdb->posts} WHERE ID = %d LIMIT 1", $topicid ) );
    17571758
    17581759            if ( !is_null( $row ) ) {
Note: See TracChangeset for help on using the changeset viewer.