Changeset 6191 for trunk/src/includes/topics/functions.php

Timestamp:

12/28/2016 04:24:52 AM (9 years ago)

Author:

johnjamesjacoby

Message:

Audit direct query and prepare() usages, and more tightly adhere to best practices.

• No quotes around directives
• Avoid concatenation, prefer variable parsing in double-quoted strings
• Covers converters, helper functions, and tools

File:

• trunk/src/includes/topics/functions.php (modified) (3 diffs)

trunk/src/includes/topics/functions.php

@@ -2795 +2795 @@
         $post_status = "'" . implode( "','", $statuses ) . "'";
         $bbp_db      = bbp_db();
-        $query       = $bbp_db->prepare( "SELECT COUNT(ID) FROM {$bbp_db->posts} WHERE post_parent = %d AND post_status IN ( {$post_status} ) AND post_type = '%s';", $topic_id, bbp_get_reply_post_type() );
+        $query       = $bbp_db->prepare( "SELECT COUNT(ID) FROM {$bbp_db->posts} WHERE post_parent = %d AND post_status IN ( {$post_status} ) AND post_type = %s", $topic_id, bbp_get_reply_post_type() );
         $reply_count = $bbp_db->get_var( $query );
     }
@@ -2970 +2970 @@
     // Query the DB to get voices in this topic
     $bbp_db = bbp_db();
-    $query  = $bbp_db->prepare( "SELECT COUNT( DISTINCT post_author ) FROM {$bbp_db->posts} WHERE ( post_parent = %d AND post_status = '%s' AND post_type = '%s' ) OR ( ID = %d AND post_type = '%s' );", $topic_id, bbp_get_public_status_id(), bbp_get_reply_post_type(), $topic_id, bbp_get_topic_post_type() );
+    $query  = $bbp_db->prepare( "SELECT COUNT( DISTINCT post_author ) FROM {$bbp_db->posts} WHERE ( post_parent = %d AND post_status = %s AND post_type = %s ) OR ( ID = %d AND post_type = %s )", $topic_id, bbp_get_public_status_id(), bbp_get_reply_post_type(), $topic_id, bbp_get_topic_post_type() );
     $voices = (int) $bbp_db->get_var( $query );
 
@@ -3011 +3011 @@
     // Query the DB to get anonymous replies in this topic
     $bbp_db  = bbp_db();
-    $query   = $bbp_db->prepare( "SELECT COUNT( ID ) FROM {$bbp_db->posts} WHERE ( post_parent = %d AND post_status = '%s' AND post_type = '%s' AND post_author = 0 ) OR ( ID = %d AND post_type = '%s' AND post_author = 0 );", $topic_id, bbp_get_public_status_id(), bbp_get_reply_post_type(), $topic_id, bbp_get_topic_post_type() );
+    $query   = $bbp_db->prepare( "SELECT COUNT( ID ) FROM {$bbp_db->posts} WHERE ( post_parent = %d AND post_status = %s AND post_type = %s AND post_author = 0 ) OR ( ID = %d AND post_type = %s AND post_author = 0 )", $topic_id, bbp_get_public_status_id(), bbp_get_reply_post_type(), $topic_id, bbp_get_topic_post_type() );
     $replies = (int) $bbp_db->get_var( $query );