diff options
| author | donncha <donncha@7be80a69-a1ef-0310-a953-fb0f7c49ff36> | 2007-10-30 16:49:38 +0000 |
|---|---|---|
| committer | donncha <donncha@7be80a69-a1ef-0310-a953-fb0f7c49ff36> | 2007-10-30 16:49:38 +0000 |
| commit | d85d717aedbc7690e2a450e40dab8fcebd94b38c (patch) | |
| tree | a7340a14bb1192e977fca4f26beef29869e17579 /wp-includes/comment-template.php | |
| parent | 9817ff2d282c68faaa09232845829b96f207e72b (diff) | |
| download | wordpress-mu-d85d717aedbc7690e2a450e40dab8fcebd94b38c.tar.gz wordpress-mu-d85d717aedbc7690e2a450e40dab8fcebd94b38c.tar.xz wordpress-mu-d85d717aedbc7690e2a450e40dab8fcebd94b38c.zip | |
Merge with WordPress 2.3.1
git-svn-id: http://svn.automattic.com/wordpress-mu/trunk@1139 7be80a69-a1ef-0310-a953-fb0f7c49ff36
Diffstat (limited to 'wp-includes/comment-template.php')
| -rw-r--r-- | wp-includes/comment-template.php | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/wp-includes/comment-template.php b/wp-includes/comment-template.php index 1dc84c1..99fecfe 100644 --- a/wp-includes/comment-template.php +++ b/wp-includes/comment-template.php @@ -288,11 +288,13 @@ function comments_template( $file = '/comments.php' ) { // TODO: Use API instead of SELECTs. if ( $user_ID) { - $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND (comment_approved = '1' OR ( user_id = %d AND comment_approved = '0' ) ) ORDER BY comment_date", $post->ID, $user_ID)); + $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post->ID' AND (comment_approved = '1' OR ( user_id = '$user_ID' AND comment_approved = '0' ) ) ORDER BY comment_date"); } else if ( empty($comment_author) ) { - $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '1' ORDER BY comment_date", $post->ID)); + $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post->ID' AND comment_approved = '1' ORDER BY comment_date"); } else { - $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND ( comment_approved = '1' OR ( comment_author = %s AND comment_author_email = %s AND comment_approved = '0' ) ) ORDER BY comment_date", $post->ID, $comment_author, $comment_author_email)); + $author_db = $wpdb->escape($comment_author); + $email_db = $wpdb->escape($comment_author_email); + $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post->ID' AND ( comment_approved = '1' OR ( comment_author = '$author_db' AND comment_author_email = '$email_db' AND comment_approved = '0' ) ) ORDER BY comment_date"); } // keep $comments for legacy's sake (remember $table*? ;) ) |