Show
Ignore:
Timestamp:
08/25/08 16:06:29 (3 months ago)
Author:
donncha
Message:

Prepare SQL, fixes #719, props momo360modena

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved
  • trunk/wpmu-settings.php

    r1428 r1447  
    5151        $path = substr( $_SERVER[ 'REQUEST_URI' ], 0, 1 + strpos( $_SERVER[ 'REQUEST_URI' ], '/', 1 ) ); 
    5252        if( constant( 'VHOST' ) == 'yes' ) { 
    53                 $current_site = $wpdb->get_row( "SELECT * FROM $wpdb->site WHERE domain = '$domain' AND path='$path'" ); 
     53                $current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path = %s", $domain, $path) ); 
    5454                if( $current_site != null ) 
    5555                        return $current_site; 
    56                 $current_site = $wpdb->get_row( "SELECT * FROM $wpdb->site WHERE domain = '$domain' AND path='/'" ); 
     56                $current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path='/'", $domain) ); 
    5757                if( $current_site != null ) { 
    5858                        $path = '/'; 
    5959                        return $current_site; 
    6060                } 
     61 
    6162                $sitedomain = substr( $domain, 1 + strpos( $domain, '.' ) ); 
    62                 $current_site = $wpdb->get_row( "SELECT * FROM $wpdb->site WHERE domain = '$sitedomain' AND path='$path'" ); 
     63                $current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path = %s", $sitedomain, $path) ); 
    6364                if( $current_site != null ) 
    6465                        return $current_site; 
    65                 $current_site = $wpdb->get_row( "SELECT * FROM $wpdb->site WHERE domain = '$sitedomain' AND path='/'" ); 
     66                $current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path='/'", $sitedomain) ); 
    6667                if( $current_site == null && defined( "WP_INSTALLING" ) == false ) { 
    6768                        if( count( $sites ) == 1 ) { 
     
    7576                } 
    7677        } else { 
    77                 $current_site = $wpdb->get_row( "SELECT * FROM $wpdb->site WHERE domain = '$domain' AND path='$path'" ); 
     78                $current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path = %s", $domain, $path) ); 
    7879                if( $current_site != null ) 
    7980                        return $current_site; 
    80                 $current_site = $wpdb->get_row( "SELECT * FROM $wpdb->site WHERE domain = '$domain' AND path='/'" ); 
     81                $current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE domain = %s AND path='/'", $domain) ); 
    8182                if( $current_site == null && defined( "WP_INSTALLING" ) == false ) { 
    8283                        if( count( $sites ) == 1 ) { 
     
    9899        $current_blog = wp_cache_get( 'current_blog_' . $domain, 'site-options' ); 
    99100        if( !$current_blog ) { 
    100                 $current_blog = $wpdb->get_row("SELECT * FROM $wpdb->blogs WHERE domain = '$domain'"); 
     101                $current_blog = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->blogs WHERE domain = %s", $domain) ); 
    101102                if( $current_blog ) 
    102103                        wp_cache_set( 'current_blog_' . $domain, $current_blog, 'site-options' ); 
    103104        } 
    104105        if( $current_blog != null && $current_blog->site_id != $current_site->id ) { 
    105                 $current_site = $wpdb->get_row("SELECT * FROM $wpdb->site WHERE id='{$current_blog->site_id}'"); 
     106                $current_site = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->site WHERE id = %d", $current_blog->site_id) ); 
    106107        } else { 
    107108                $blogname = substr( $domain, 0, strpos( $domain, '.' ) ); 
     
    115116        $blognames = array( 'page', 'comments', 'blog', 'wp-admin', 'wp-includes', 'wp-content', 'files', 'feed' ); 
    116117        if( $blogname == '' || in_array( $blogname, $blognames ) || is_file( $blogname ) || is_blogname_page( $blogname ) ) { 
    117                 $current_blog = $wpdb->get_row("SELECT * FROM $wpdb->blogs WHERE domain = '$domain' AND path = '$path'"); 
    118         } else { 
    119                 $current_blog = $wpdb->get_row("SELECT * FROM $wpdb->blogs WHERE domain = '$domain' AND path = '{$path}{$blogname}/'"); 
     118                $current_blog = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->blogs WHERE domain = %s AND path = %s", $domain, $path) ); 
     119        } else { 
     120                $current_blog = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->blogs WHERE domain = %s AND path = %s", $domain, $path.$blogname.'/') ); 
    120121        } 
    121122} 
     
    123124if( defined( "WP_INSTALLING" ) == false ) { 
    124125        if( $current_site && $current_blog == null ) { 
    125                 $current_blog = $wpdb->get_row("SELECT * FROM {$wpdb->blogs} WHERE domain = '{$current_site->domain}' AND path = '{$current_site->path}'"); 
     126                $current_blog = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->blogs WHERE domain = %s AND path = %s", $current_site->domain, $current_site->path) ); 
    126127        } 
    127128        if( $current_blog == false || $current_site == false ) 
     
    132133        global $wpdb, $table_prefix, $domain, $path; 
    133134 
    134         $blog_id = $wpdb->get_var("SELECT blog_id FROM $wpdb->blogs WHERE domain = '$domain' AND path = '$path'"); 
     135        $blog_id = $wpdb->get_var( $wpdb->prepare("SELECT blog_id FROM $wpdb->blogs WHERE domain = %s AND path = %s", $domain, $path) ); 
    135136 
    136137        // is the request for a page of the main blog? We need to cache this information somewhere to save a request 
     
    155156 
    156157 
    157 $current_site->site_name = $wpdb->get_var( "SELECT meta_value FROM $wpdb->sitemeta WHERE site_id = '$site_id' AND meta_key = 'site_name'" ); 
     158$current_site->site_name = $wpdb->get_var( $wpdb->prepare("SELECT meta_value FROM $wpdb->sitemeta WHERE site_id = %d AND meta_key = 'site_name'", $site_id) ); 
    158159if( $current_site->site_name == null ) 
    159160        $current_site->site_name = ucfirst( $current_site->domain ); 
     
    162163    // no blog found, are we installing? Check if the table exists. 
    163164    if ( defined('WP_INSTALLING') ) { 
    164         $query = "SELECT blog_id FROM ".$wpdb->blogs." limit 0,1"; 
    165         $blog_id = $wpdb->get_var( $query ); 
     165        $blog_id = $wpdb->get_var( "SELECT blog_id FROM $wpdb->blogs LIMIT 0,1" ); 
    166166        if( $blog_id == false ) { 
    167167            // table doesn't exist. This is the first blog