Changeset 6191 for trunk/src/includes/common/functions.php

Timestamp:

12/28/2016 04:24:52 AM (9 years ago)

Author:

johnjamesjacoby

Message:

Audit direct query and prepare() usages, and more tightly adhere to best practices.

• No quotes around directives
• Avoid concatenation, prefer variable parsing in double-quoted strings
• Covers converters, helper functions, and tools

File:

• trunk/src/includes/common/functions.php (modified) (1 diff)

trunk/src/includes/common/functions.php

@@ -1758 +1758 @@
         $post_status = "'" . implode( "', '", $post_status ) . "'";
         $bbp_db      = bbp_db();
-        $query       = $bbp_db->prepare( "SELECT ID FROM {$bbp_db->posts} WHERE post_parent = %d AND post_status IN ( {$post_status} ) AND post_type = '%s' ORDER BY ID DESC;", $parent_id, $post_type );
+        $query       = $bbp_db->prepare( "SELECT ID FROM {$bbp_db->posts} WHERE post_parent = %d AND post_status IN ( {$post_status} ) AND post_type = %s ORDER BY ID DESC", $parent_id, $post_type );
         $child_ids   = (array) $bbp_db->get_col( $query );