Index: modules/block/block.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/block/block.module,v
retrieving revision 1.315
diff -u -r1.315 block.module
--- modules/block/block.module	15 Nov 2008 08:23:07 -0000	1.315
+++ modules/block/block.module	15 Nov 2008 13:07:55 -0000
@@ -190,7 +190,7 @@
       $blocks = array();
 
       $result = db_query('SELECT bid, info FROM {box} ORDER BY info');
-      while ($block = db_fetch_object($result)) {
+      foreach ($result as $block) {
         $blocks[$block->bid]['info'] = $block->info;
         // Not worth caching.
         $blocks[$block->bid]['cache'] = BLOCK_NO_CACHE;
@@ -212,7 +212,7 @@
       break;
 
     case 'view':
-      $block = db_fetch_object(db_query('SELECT body, format FROM {box} WHERE bid = %d', $delta));
+      $block = db_query('SELECT body, format FROM {box} WHERE bid = :bid', array(':bid' => $delta))->fetch();
       $data['content'] = check_markup($block->body, $block->format, '', FALSE);
       return $data;
   }
@@ -229,9 +229,9 @@
 
   init_theme();
 
-  $result = db_query("SELECT * FROM {block} WHERE theme = '%s'", $theme_key);
+  $result = db_query("SELECT * FROM {block} WHERE theme = :theme", array(':theme' => $theme_key), array('fetch' => PDO::FETCH_ASSOC));
   $old_blocks = array();
-  while ($old_block = db_fetch_array($result)) {
+  foreach ($result as $old_block) {
     $old_blocks[$old_block['module']][$old_block['delta']] = $old_block;
   }
 
@@ -289,14 +289,18 @@
   // Remove blocks that are no longer defined by the code from the database.
   foreach ($old_blocks as $module => $old_module_blocks) {
     foreach ($old_module_blocks as $delta => $block) {
-      db_query("DELETE FROM {block} WHERE module = '%s' AND delta = '%s' AND theme = '%s'", $module, $delta, $theme_key);
+      db_delete('block')
+      	->condition('module', $module)
+      	->condition('delta', $delta)
+      	->condition('theme', $theme_key)
+      	->execute();
     }
   }
   return $blocks;
 }
 
 function block_box_get($bid) {
-  return db_fetch_array(db_query("SELECT * FROM {box} WHERE bid = %d", $bid));
+  return db_query("SELECT * FROM {box} WHERE bid = :bid", array(':bid' => $bid), array('fetch' => PDO::FETCH_ASSOC))->fetch();
 }
 
 /**
@@ -335,8 +339,13 @@
     $edit['body_format'] = FILTER_FORMAT_DEFAULT;
   }
 
-  db_query("UPDATE {box} SET body = '%s', info = '%s', format = %d WHERE bid = %d", $edit['body'], $edit['info'], $edit['body_format'], $delta);
-
+  db_update('box')->fields(array(
+      'body' => $edit['body'],
+      'info' => $edit['info'],
+      'format' => $edit['body_format'],
+    ))
+    ->condition('bid', $delta)->execute();
+  
   return TRUE;
 }
 
@@ -346,7 +355,11 @@
 function block_user_form(&$edit, &$account, $category = NULL) {
   if ($category == 'account') {
     $rids = array_keys($account->roles);
+    // TODO: rewrite this as a dynamic query:
     $result = db_query("SELECT DISTINCT b.* FROM {block} b LEFT JOIN {block_role} r ON b.module = r.module AND b.delta = r.delta WHERE b.status = 1 AND b.custom != 0 AND (r.rid IN (" . db_placeholders($rids) . ") OR r.rid IS NULL) ORDER BY b.weight, b.module", $rids);
+    //$query = db_select('block');
+    //$query->addField('b.*');
+    // ...
     $form['block'] = array('#type' => 'fieldset', '#title' => t('Block configuration'), '#weight' => 3, '#collapsible' => TRUE, '#tree' => TRUE);
     while ($block = db_fetch_object($result)) {
       $data = module_invoke($block->module, 'block', 'list');
@@ -413,7 +426,11 @@
 
   $blocks = array();
   $rids = array_keys($user->roles);
+  // TODO: rewrite this as a dynamic query:
   $result = db_query(db_rewrite_sql("SELECT DISTINCT b.* FROM {block} b LEFT JOIN {block_role} r ON b.module = r.module AND b.delta = r.delta WHERE b.theme = '%s' AND b.status = 1 AND (r.rid IN (" . db_placeholders($rids) . ") OR r.rid IS NULL) ORDER BY b.region, b.weight, b.module", 'b', 'bid'), array_merge(array($theme_key), $rids));
+  //$query = db_select('block');
+  //$query->addField('b.*');
+  // ...
   while ($block = db_fetch_object($result)) {
     if (!isset($blocks[$block->region])) {
       $blocks[$block->region] = array();
Index: modules/block/block.admin.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/block/block.admin.inc,v
retrieving revision 1.28
diff -u -r1.28 block.admin.inc
--- modules/block/block.admin.inc	15 Nov 2008 08:23:07 -0000	1.28
+++ modules/block/block.admin.inc	15 Nov 2008 13:07:54 -0000
@@ -95,7 +95,15 @@
   foreach ($form_state['values'] as $block) {
     $block['status'] = $block['region'] != BLOCK_REGION_NONE;
     $block['region'] = $block['status'] ? $block['region'] : '';
-    db_query("UPDATE {block} SET status = %d, weight = %d, region = '%s' WHERE module = '%s' AND delta = '%s' AND theme = '%s'", $block['status'], $block['weight'], $block['region'], $block['module'], $block['delta'], $block['theme']);
+    db_update('block')->fields(array(
+        'status' => (int) $block['status'],
+        'weight' => $block['weight'],
+        'region' => $block['region'],
+      ))
+      ->condition('module', $block['module'])
+      ->condition('delta', $block['delta'])
+      ->condition('theme', $block['theme'])
+      ->execute();
   }
   drupal_set_message(t('The block settings have been updated.'));
   cache_clear_all();
@@ -148,7 +156,7 @@
     '#value' => $delta,
   );
 
-  $edit = db_fetch_array(db_query("SELECT pages, visibility, custom, title FROM {block} WHERE module = '%s' AND delta = '%s'", $module, $delta));
+  $edit = db_query("SELECT pages, visibility, custom, title FROM {block} WHERE module = :module AND delta = :delta", array(':module' => $module, ':delta' => $delta), array('fetch' => PDO::FETCH_ASSOC))->fetch();
 
   $form['block_settings'] = array(
     '#type' => 'fieldset',
@@ -197,13 +205,13 @@
 
   // Role-based visibility settings.
   $default_role_options = array();
-  $result = db_query("SELECT rid FROM {block_role} WHERE module = '%s' AND delta = '%s'", $module, $delta);
-  while ($role = db_fetch_object($result)) {
+  $result = db_query("SELECT rid FROM {block_role} WHERE module = :module AND delta = :delta", array(':module' => $module, ':delta' => $delta));
+  foreach ($result as $role) {
     $default_role_options[] = $role->rid;
   }
   $result = db_query('SELECT rid, name FROM {role} ORDER BY name');
   $role_options = array();
-  while ($role = db_fetch_object($result)) {
+  foreach ($result as $role) {
     $role_options[$role->rid] = $role->name;
   }
   $form['role_vis_settings'] = array(
@@ -263,7 +271,7 @@
 
 function block_admin_configure_validate($form, &$form_state) {
   if ($form_state['values']['module'] == 'block') {
-    if (empty($form_state['values']['info']) || db_result(db_query("SELECT COUNT(*) FROM {box} WHERE bid != %d AND info = '%s'", $form_state['values']['delta'], $form_state['values']['info']))) {
+    if (empty($form_state['values']['info']) || db_query("SELECT COUNT(*) FROM {box} WHERE bid != :bid AND info = :info", array(':bid' => $form_state['values']['delta'], ':info' => $form_state['values']['info']))->fetchField()) {
       form_set_error('info', t('Please ensure that each block description is unique.'));
     }
   }
@@ -271,10 +279,26 @@
 
 function block_admin_configure_submit($form, &$form_state) {
   if (!form_get_errors()) {
-    db_query("UPDATE {block} SET visibility = %d, pages = '%s', custom = %d, title = '%s' WHERE module = '%s' AND delta = '%s'", $form_state['values']['visibility'], trim($form_state['values']['pages']), $form_state['values']['custom'], $form_state['values']['title'], $form_state['values']['module'], $form_state['values']['delta']);
-    db_query("DELETE FROM {block_role} WHERE module = '%s' AND delta = '%s'", $form_state['values']['module'], $form_state['values']['delta']);
+    db_update('block')->fields(array(
+        'visibility' => $form_state['values']['visibility'],
+        'pages' => trim($form_state['values']['pages']),
+        'custom' => $form_state['values']['custom'],
+        'title' => $form_state['values']['title'],
+      ))
+      ->condition('module', $form_state['values']['module'])
+      ->condition('delta', $form_state['values']['delta'])
+      ->execute();
+    db_delete('block_role')
+      ->condition('module', $form_state['values']['module'])
+      ->condition('delta', $form_state['values']['delta'])
+      ->execute();
     foreach (array_filter($form_state['values']['roles']) as $rid) {
-      db_query("INSERT INTO {block_role} (rid, module, delta) VALUES (%d, '%s', '%s')", $rid, $form_state['values']['module'], $form_state['values']['delta']);
+      db_insert('block_role')->fields(array(
+          'rid' => $rid,
+          'module' => $form_state['values']['module'],
+          'delta' => $form_state['values']['delta'],
+        ))
+        ->execute();
     }
     module_invoke($form_state['values']['module'], 'block', 'save', $form_state['values']['delta'], $form_state['values']);
     drupal_set_message(t('The block configuration has been saved.'));
@@ -292,7 +316,7 @@
 }
 
 function block_add_block_form_validate($form, &$form_state) {
-  if (empty($form_state['values']['info']) || db_result(db_query("SELECT COUNT(*) FROM {box} WHERE info = '%s'", $form_state['values']['info']))) {
+  if (empty($form_state['values']['info']) || db_query("SELECT COUNT(*) FROM {box} WHERE info = :info", array(':info' => $form_state['values']['info']))->fetchField()) {
     form_set_error('info', t('Please ensure that each block description is unique.'));
   }
 }
@@ -301,17 +325,39 @@
  * Save the new custom block.
  */
 function block_add_block_form_submit($form, &$form_state) {
-  db_query("INSERT INTO {box} (body, info, format) VALUES ('%s', '%s', %d)", $form_state['values']['body'], $form_state['values']['info'], $form_state['values']['body_format']);
-  $delta = db_last_insert_id('box', 'bid');
+  db_insert('box')->fields(array(
+      'body' => $form_state['values']['body'],
+      'info' => $form_state['values']['info'],
+      'format' => $form_state['values']['body_format'],
+    ))
+    ->execute();
+    $delta = db_last_insert_id('box', 'bid');
 
   foreach (list_themes() as $key => $theme) {
     if ($theme->status) {
-      db_query("INSERT INTO {block} (visibility, pages, custom, title, module, theme, status, weight, delta, cache) VALUES(%d, '%s', %d, '%s', '%s', '%s', %d, %d, '%s', %d)", $form_state['values']['visibility'], trim($form_state['values']['pages']), $form_state['values']['custom'], $form_state['values']['title'], $form_state['values']['module'], $theme->name, 0, 0, $delta, BLOCK_NO_CACHE);
+      db_insert('block')->fields(array(
+          'visibility' => (int) $form_state['values']['visibility'],
+          'pages' => trim($form_state['values']['pages']),
+          'custom' => (int) $form_state['values']['custom'],
+          'title' => $form_state['values']['title'],
+          'module' => $form_state['values']['module'],
+          'theme' => $theme->name,
+          'status' => 0,
+          'weight' => 0,
+          'delta' => $delta,
+          'cache' => BLOCK_NO_CACHE,
+        ))
+        ->execute();
     }
   }
 
   foreach (array_filter($form_state['values']['roles']) as $rid) {
-    db_query("INSERT INTO {block_role} (rid, module, delta) VALUES (%d, '%s', '%s')", $rid, $form_state['values']['module'], $delta);
+    db_insert('block_role')->fields(array(
+        'rid' => $rid,
+        'module' => $form_state['values']['module'],
+        'delta' => $delta,
+      ))
+      ->execute();
   }
 
   drupal_set_message(t('The block has been created.'));
@@ -335,8 +381,13 @@
  * Deletion of custom blocks.
  */
 function block_box_delete_submit($form, &$form_state) {
-  db_query('DELETE FROM {box} WHERE bid = %d', $form_state['values']['bid']);
-  db_query("DELETE FROM {block} WHERE module = 'block' AND delta = '%s'", $form_state['values']['bid']);
+  db_delete('box')
+    ->condition('bid', $form_state['values']['bid'])
+    ->execute();
+  db_delete('block')
+    ->condition('module', 'block')
+    ->condition('delta', $form_state['values']['bid'])
+    ->execute();
   drupal_set_message(t('The block %name has been removed.', array('%name' => $form_state['values']['info'])));
   cache_clear_all();
   $form_state['redirect'] = 'admin/build/block';