From 87bb8cd69cc593fe6bed330fb1791eac9df87167 Mon Sep 17 00:00:00 2001 From: donncha Date: Tue, 23 Oct 2007 18:28:40 +0000 Subject: Merge with WordPress, rev 6285 and untested git-svn-id: http://svn.automattic.com/wordpress-mu/trunk@1125 7be80a69-a1ef-0310-a953-fb0f7c49ff36 --- wp-includes/comment-template.php | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'wp-includes/comment-template.php') diff --git a/wp-includes/comment-template.php b/wp-includes/comment-template.php index 99fecfe..1dc84c1 100644 --- a/wp-includes/comment-template.php +++ b/wp-includes/comment-template.php @@ -288,13 +288,11 @@ function comments_template( $file = '/comments.php' ) { // TODO: Use API instead of SELECTs. if ( $user_ID) { - $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post->ID' AND (comment_approved = '1' OR ( user_id = '$user_ID' AND comment_approved = '0' ) ) ORDER BY comment_date"); + $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND (comment_approved = '1' OR ( user_id = %d AND comment_approved = '0' ) ) ORDER BY comment_date", $post->ID, $user_ID)); } else if ( empty($comment_author) ) { - $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post->ID' AND comment_approved = '1' ORDER BY comment_date"); + $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '1' ORDER BY comment_date", $post->ID)); } else { - $author_db = $wpdb->escape($comment_author); - $email_db = $wpdb->escape($comment_author_email); - $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post->ID' AND ( comment_approved = '1' OR ( comment_author = '$author_db' AND comment_author_email = '$email_db' AND comment_approved = '0' ) ) ORDER BY comment_date"); + $comments = $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND ( comment_approved = '1' OR ( comment_author = %s AND comment_author_email = %s AND comment_approved = '0' ) ) ORDER BY comment_date", $post->ID, $comment_author, $comment_author_email)); } // keep $comments for legacy's sake (remember $table*? ;) ) -- cgit