Index: modules/blog/blog.pages.inc =================================================================== RCS file: /cvs/drupal/drupal/modules/blog/blog.pages.inc,v retrieving revision 1.1 diff -u -r1.1 blog.pages.inc --- modules/blog/blog.pages.inc 22 Jul 2007 06:48:25 -0000 1.1 +++ modules/blog/blog.pages.inc 5 Oct 2007 07:23:46 -0000 @@ -31,7 +31,7 @@ $output = ''; } - $result = pager_query(db_rewrite_sql("SELECT n.nid, n.sticky, n.created FROM {node} n WHERE n.type = 'blog' AND n.uid = %d AND n.status = 1 ORDER BY n.sticky DESC, n.created DESC"), variable_get('default_nodes_main', 10), 0, NULL, $account->uid); + $result = pager_query(db_rewrite_sql("SELECT n.nid, n.sticky, n.created FROM {node} n WHERE n.type = 'blog' AND n.uid = ? AND n.status = 1 ORDER BY n.sticky DESC, n.created DESC"), variable_get('default_nodes_main', 10), 0, NULL, $account->uid); while ($node = db_fetch_object($result)) { $output .= node_view(node_load($node->nid), 1); } @@ -77,7 +77,7 @@ $account = $user; } - $result = db_query_range(db_rewrite_sql("SELECT n.nid, n.created FROM {node} n WHERE n.type = 'blog' AND n.uid = %d AND n.status = 1 ORDER BY n.created DESC"), $uid, 0, variable_get('feed_default_items', 10)); + $result = db_query_range(db_rewrite_sql("SELECT n.nid, n.created FROM {node} n WHERE n.type = 'blog' AND n.uid = ? AND n.status = 1 ORDER BY n.created DESC"), $uid, 0, variable_get('feed_default_items', 10)); $channel['title'] = $account->name ."'s blog"; $channel['link'] = url("blog/$uid", array('absolute' => TRUE)); Index: modules/blog/blog.module =================================================================== RCS file: /cvs/drupal/drupal/modules/blog/blog.module,v retrieving revision 1.285 diff -u -r1.285 blog.module --- modules/blog/blog.module 12 Aug 2007 15:55:35 -0000 1.285 +++ modules/blog/blog.module 5 Oct 2007 07:23:46 -0000 @@ -90,7 +90,7 @@ $node->body = ''. $blog->body .' ['. l($blog->name, "node/$nid") .']'; } - if ($iid && $item = db_fetch_object(db_query('SELECT i.*, f.title as ftitle, f.link as flink FROM {aggregator_item} i, {aggregator_feed} f WHERE i.iid = %d AND i.fid = f.fid', $iid))) { + if ($iid && $item = db_fetch_object(db_query('SELECT i.*, f.title as ftitle, f.link as flink FROM {aggregator_item} i, {aggregator_feed} f WHERE i.iid = ? AND i.fid = f.fid', $iid))) { $node->title = $item->title; // Note: $item->description has been validated on aggregation. $node->body = ''. check_plain($item->title) .' - '. $item->description .' ['. check_plain($item->ftitle) ."]\n"; Index: modules/book/book.pages.inc =================================================================== RCS file: /cvs/drupal/drupal/modules/book/book.pages.inc,v retrieving revision 1.1 diff -u -r1.1 book.pages.inc --- modules/book/book.pages.inc 11 Sep 2007 17:35:58 -0000 1.1 +++ modules/book/book.pages.inc 5 Oct 2007 07:23:46 -0000 @@ -237,7 +237,7 @@ if ($node->nid != $node->book['bid']) { // Only allowed when this is not a book (top-level page). menu_link_delete($node->book['mlid']); - db_query('DELETE FROM {book} WHERE nid = %d', $node->nid); + db_query('DELETE FROM {book} WHERE nid = ?', $node->nid); drupal_set_message(t('The post has been removed from the book.')); } $form_state['redirect'] = 'node/'. $node->nid; Index: modules/book/book.install =================================================================== RCS file: /cvs/drupal/drupal/modules/book/book.install,v retrieving revision 1.9 diff -u -r1.9 book.install --- modules/book/book.install 26 Aug 2007 07:20:07 -0000 1.9 +++ modules/book/book.install 5 Oct 2007 07:23:46 -0000 @@ -155,7 +155,7 @@ while ($book = db_fetch_array($result)) { $has_rows = TRUE; // Orphans are defined as nodes whose parent does not exist in the table. - if ($book['parent'] && !db_result(db_query("SELECT COUNT(*) FROM {book_temp} WHERE nid = %d", $book['parent']))) { + if ($book['parent'] && !db_result(db_query("SELECT COUNT(*) FROM {book_temp} WHERE nid = ?", $book['parent']))) { if (empty($_SESSION['book_update_6000_orphans']['book'])) { // The first orphan becomes the parent for all other orphans. $book['parent'] = 0; @@ -192,14 +192,14 @@ $book = array_pop($_SESSION['book_update_6000']); // Add all of this node's children to the stack - $result = db_query("SELECT * FROM {book_temp} WHERE parent = %d", $book['nid']); + $result = db_query("SELECT * FROM {book_temp} WHERE parent = ?", $book['nid']); while ($a = db_fetch_array($result)) { $_SESSION['book_update_6000'][] = $a; } if ($book['parent']) { // If its not a top level page, get its parent's mlid. - $parent = db_fetch_array(db_query("SELECT b.mlid AS plid, b.bid FROM {book} b WHERE b.nid = %d", $book['parent'])); + $parent = db_fetch_array(db_query("SELECT b.mlid AS plid, b.bid FROM {book} b WHERE b.nid = ?", $book['parent'])); $book = array_merge($book, $parent); } else { @@ -214,18 +214,18 @@ 'router_path' => 'node/%', 'menu_name' => book_menu_name($book['bid']), ); - $book = array_merge($book, db_fetch_array(db_query("SELECT title AS link_title FROM {node} WHERE nid = %d", $book['nid']))); + $book = array_merge($book, db_fetch_array(db_query("SELECT title AS link_title FROM {node} WHERE nid = ?", $book['nid']))); // Items with depth > MENU_MAX_DEPTH cannot be saved. if (menu_link_save($book)) { - db_query("INSERT INTO {book} (mlid, nid, bid) VALUES (%d, %d, %d)", $book['mlid'], $book['nid'], $book['bid']); + db_query("INSERT INTO {book} (mlid, nid, bid) VALUES (?, ?, ?)", $book['mlid'], $book['nid'], $book['bid']); } else { // The depth was greater then MENU_MAX_DEPTH, so attach it to the // closest valid parent. - $book['plid'] = db_result(db_query("SELECT plid FROM {menu_links} WHERE mlid = %d", $book['plid'])); + $book['plid'] = db_result(db_query("SELECT plid FROM {menu_links} WHERE mlid = ?", $book['plid'])); if (menu_link_save($book)) { - db_query("INSERT INTO {book} (mlid, nid, bid) VALUES (%d, %d, %d)", $book['mlid'], $book['nid'], $book['bid']); + db_query("INSERT INTO {book} (mlid, nid, bid) VALUES (?, ?, ?)", $book['mlid'], $book['nid'], $book['bid']); } } $update_count--; Index: modules/book/book.module =================================================================== RCS file: /cvs/drupal/drupal/modules/book/book.module,v retrieving revision 1.442 diff -u -r1.442 book.module --- modules/book/book.module 11 Sep 2007 17:35:58 -0000 1.442 +++ modules/book/book.module 5 Oct 2007 07:23:46 -0000 @@ -203,7 +203,7 @@ } elseif ($current_bid) { // Only display this block when the user is browsing a book. - $title = db_result(db_query(db_rewrite_sql('SELECT n.title FROM {node} n WHERE n.nid = %d'), $node->book['bid'])); + $title = db_result(db_query(db_rewrite_sql('SELECT n.title FROM {node} n WHERE n.nid = ?'), $node->book['bid'])); // Only show the block if the user has view access for the top-level node. if ($title) { $tree = menu_tree_all_data($node->book['menu_name'], $node->book); @@ -459,20 +459,20 @@ else { // Check in case the parent is not is this book; the book takes precedence. if (!empty($node->book['plid'])) { - $parent = db_fetch_array(db_query("SELECT * FROM {book} WHERE mlid = %d", $node->book['plid'])); + $parent = db_fetch_array(db_query("SELECT * FROM {book} WHERE mlid = ?", $node->book['plid'])); } if (empty($node->book['plid']) || !$parent || $parent['bid'] != $node->book['bid']) { - $node->book['plid'] = db_result(db_query("SELECT mlid FROM {book} WHERE nid = %d", $node->book['bid'])); + $node->book['plid'] = db_result(db_query("SELECT mlid FROM {book} WHERE nid = ?", $node->book['bid'])); $node->book['parent_mismatch'] = TRUE; // Likely when JS is disabled. } } if (menu_link_save($node->book)) { if ($new) { // Insert new. - db_query("INSERT INTO {book} (nid, mlid, bid) VALUES (%d, %d, %d)", $node->nid, $node->book['mlid'], $node->book['bid']); + db_query("INSERT INTO {book} (nid, mlid, bid) VALUES (?, ?, ?)", $node->nid, $node->book['mlid'], $node->book['bid']); } else { - if ($node->book['bid'] != db_result(db_query("SELECT bid FROM {book} WHERE nid = %d", $node->nid))) { + if ($node->book['bid'] != db_result(db_query("SELECT bid FROM {book} WHERE nid = ?", $node->nid))) { // Update the bid for this page and all children. book_update_bid($node->book); } @@ -492,7 +492,7 @@ function book_update_bid($book_link) { for ($i = 1; $i <= MENU_MAX_DEPTH && $book_link["p$i"]; $i++) { - $match[] = "p$i = %d"; + $match[] = "p$i = ?"; $args[] = $book_link["p$i"]; } $result = db_query("SELECT mlid FROM {menu_links} WHERE ". implode(' AND ', $match), $args); @@ -502,7 +502,7 @@ $mlids[] = $a['mlid']; } if ($mlids) { - db_query("UPDATE {book} SET bid = %d WHERE mlid IN (". implode(',', $mlids) .")", $book_link['bid']); + db_query("UPDATE {book} SET bid = ? WHERE mlid IN (". implode(',', $mlids) .")", $book_link['bid']); } } @@ -660,7 +660,7 @@ switch ($op) { case 'load': // Note - we cannot use book_link_load() because it will call node_load() - $info['book'] = db_fetch_array(db_query('SELECT * FROM {book} b INNER JOIN {menu_links} ml ON b.mlid = ml.mlid WHERE b.nid = %d', $node->nid)); + $info['book'] = db_fetch_array(db_query('SELECT * FROM {book} b INNER JOIN {menu_links} ml ON b.mlid = ml.mlid WHERE b.nid = ?', $node->nid)); if ($info['book']) { $info['book']['href'] = $info['book']['link_path']; $info['book']['title'] = $info['book']['link_title']; @@ -706,7 +706,7 @@ if (!empty($node->book['bid'])) { if ($node->nid == $node->book['bid']) { // Handle deletion of a top-level post. - $result = db_query("SELECT b.nid FROM {menu_links} ml INNER JOIN {book} b on b.mlid = ml.mlid WHERE ml.plid = %d", $node->book['mlid']); + $result = db_query("SELECT b.nid FROM {menu_links} ml INNER JOIN {book} b on b.mlid = ml.mlid WHERE ml.plid = ?", $node->book['mlid']); while ($child = db_fetch_array($result)) { $child_node = node_load($child['nid']); $child_node->book['bid'] = $child_node->nid; @@ -714,7 +714,7 @@ } } menu_link_delete($node->book['mlid']); - db_query('DELETE FROM {book} WHERE mlid = %d', $node->book['mlid']); + db_query('DELETE FROM {book} WHERE mlid = ?', $node->book['mlid']); } break; case 'prepare': @@ -1016,7 +1016,7 @@ * Do not call when loading a node, since this function may call node_load(). */ function book_link_load($mlid) { - if ($item = db_fetch_array(db_query("SELECT * FROM {menu_links} ml INNER JOIN {book} b ON b.mlid = ml.mlid LEFT JOIN {menu_router} m ON m.path = ml.router_path WHERE ml.mlid = %d", $mlid))) { + if ($item = db_fetch_array(db_query("SELECT * FROM {menu_links} ml INNER JOIN {book} b ON b.mlid = ml.mlid LEFT JOIN {menu_router} m ON m.path = ml.router_path WHERE ml.mlid = ?", $mlid))) { _menu_link_translate($item); return $item; } @@ -1045,11 +1045,11 @@ $data = $cache->data; } else { - $match = array("menu_name = '%s'"); + $match = array("menu_name = ?"); $args = array($item['menu_name']); $i = 1; while ($i <= MENU_MAX_DEPTH && $item["p$i"]) { - $match[] = "p$i = %d"; + $match[] = "p$i = ?"; $args[] = $item["p$i"]; $i++; } Index: modules/book/book.admin.inc =================================================================== RCS file: /cvs/drupal/drupal/modules/book/book.admin.inc,v retrieving revision 1.3 diff -u -r1.3 book.admin.inc --- modules/book/book.admin.inc 28 Sep 2007 15:44:13 -0000 1.3 +++ modules/book/book.admin.inc 5 Oct 2007 07:23:46 -0000 @@ -113,7 +113,7 @@ } } // Insure we have the current title - it may have been changed in the form. - $title = db_result(db_query("SELECT title FROM {node} WHERE nid = %d", $form['#node']->nid)); + $title = db_result(db_query("SELECT title FROM {node} WHERE nid = ?", $form['#node']->nid)); drupal_set_message(t('Updated book %title.', array('%title' => $title))); } Index: modules/comment/comment.install =================================================================== RCS file: /cvs/drupal/drupal/modules/comment/comment.install,v retrieving revision 1.4 diff -u -r1.4 comment.install --- modules/comment/comment.install 30 Jul 2007 21:27:34 -0000 1.4 +++ modules/comment/comment.install 5 Oct 2007 07:23:46 -0000 @@ -16,7 +16,7 @@ */ function comment_update_1() { // Change any future last comment timestamps to now. - db_query('UPDATE {node_comment_statistics} SET last_comment_timestamp = %d WHERE last_comment_timestamp > %d', time(), time()); + db_query('UPDATE {node_comment_statistics} SET last_comment_timestamp = ? WHERE last_comment_timestamp > ?', time(), time()); // Unstuck node indexing timestamp if needed. if (($last = variable_get('node_cron_last', FALSE)) !== FALSE) { Index: modules/comment/comment.module =================================================================== RCS file: /cvs/drupal/drupal/modules/comment/comment.module,v retrieving revision 1.586 diff -u -r1.586 comment.module --- modules/comment/comment.module 3 Oct 2007 17:59:50 -0000 1.586 +++ modules/comment/comment.module 5 Oct 2007 07:23:48 -0000 @@ -307,7 +307,7 @@ if (!empty($nids)) { // From among the comments on the nodes selected in the first query, // find the $number most recent comments. - $result = db_query_range('SELECT c.nid, c.subject, c.cid, c.timestamp FROM {comments} c INNER JOIN {node} n ON n.nid = c.nid WHERE c.nid IN ('. implode(',', $nids) .') AND n.status = 1 AND c.status = %d ORDER BY c.timestamp DESC', COMMENT_PUBLISHED, 0, $number); + $result = db_query_range('SELECT c.nid, c.subject, c.cid, c.timestamp FROM {comments} c INNER JOIN {node} n ON n.nid = c.nid WHERE c.nid IN ('. implode(',', $nids) .') AND n.status = 1 AND c.status = ? ORDER BY c.timestamp DESC', COMMENT_PUBLISHED, 0, $number); while ($comment = db_fetch_object($result)) { $comments[] = $comment; } @@ -339,15 +339,15 @@ // Threaded comments. See the documentation for comment_render(). if ($order == COMMENT_ORDER_NEWEST_FIRST) { // Newest first: find the last thread with new comment - $result = db_query('(SELECT thread FROM {comments} WHERE nid = %d AND status = 0 ORDER BY timestamp DESC LIMIT %d) ORDER BY thread DESC LIMIT 1', $nid, $new_replies); + $result = db_query('(SELECT thread FROM {comments} WHERE nid = ? AND status = 0 ORDER BY timestamp DESC LIMIT ?) ORDER BY thread DESC LIMIT 1', $nid, $new_replies); $thread = db_result($result); - $result_count = db_query("SELECT COUNT(*) FROM {comments} WHERE nid = %d AND status = 0 AND thread > '". $thread ."'", $nid); + $result_count = db_query("SELECT COUNT(*) FROM {comments} WHERE nid = ? AND status = 0 AND thread > '". $thread ."'", $nid); } else { // Oldest first: find the first thread with new comment - $result = db_query('(SELECT thread FROM {comments} WHERE nid = %d AND status = 0 ORDER BY timestamp DESC LIMIT %d) ORDER BY SUBSTRING(thread, 1, (LENGTH(thread) - 1)) LIMIT 1', $nid, $new_replies); + $result = db_query('(SELECT thread FROM {comments} WHERE nid = ? AND status = 0 ORDER BY timestamp DESC LIMIT ?) ORDER BY SUBSTRING(thread, 1, (LENGTH(thread) - 1)) LIMIT 1', $nid, $new_replies); $thread = substr(db_result($result), 0, -1); - $result_count = db_query("SELECT COUNT(*) FROM {comments} WHERE nid = %d AND status = 0 AND SUBSTRING(thread, 1, (LENGTH(thread) - 1)) < '". $thread ."'", $nid); + $result_count = db_query("SELECT COUNT(*) FROM {comments} WHERE nid = ? AND status = 0 AND SUBSTRING(thread, 1, (LENGTH(thread) - 1)) < '". $thread ."'", $nid); } $count = db_result($result_count); } @@ -496,7 +496,7 @@ function comment_nodeapi(&$node, $op, $arg = 0) { switch ($op) { case 'load': - return db_fetch_array(db_query("SELECT last_comment_timestamp, last_comment_name, comment_count FROM {node_comment_statistics} WHERE nid = %d", $node->nid)); + return db_fetch_array(db_query("SELECT last_comment_timestamp, last_comment_name, comment_count FROM {node_comment_statistics} WHERE nid = ?", $node->nid)); break; case 'prepare': @@ -506,24 +506,24 @@ break; case 'insert': - db_query('INSERT INTO {node_comment_statistics} (nid, last_comment_timestamp, last_comment_name, last_comment_uid, comment_count) VALUES (%d, %d, NULL, %d, 0)', $node->nid, $node->changed, $node->uid); + db_query('INSERT INTO {node_comment_statistics} (nid, last_comment_timestamp, last_comment_name, last_comment_uid, comment_count) VALUES (?, ?, NULL, ?, 0)', $node->nid, $node->changed, $node->uid); break; case 'delete': - db_query('DELETE FROM {comments} WHERE nid = %d', $node->nid); - db_query('DELETE FROM {node_comment_statistics} WHERE nid = %d', $node->nid); + db_query('DELETE FROM {comments} WHERE nid = ?', $node->nid); + db_query('DELETE FROM {node_comment_statistics} WHERE nid = ?', $node->nid); break; case 'update index': $text = ''; - $comments = db_query('SELECT subject, comment, format FROM {comments} WHERE nid = %d AND status = %d', $node->nid, COMMENT_PUBLISHED); + $comments = db_query('SELECT subject, comment, format FROM {comments} WHERE nid = ? AND status = ?', $node->nid, COMMENT_PUBLISHED); while ($comment = db_fetch_object($comments)) { $text .= '

'. check_plain($comment->subject) .'

'. check_markup($comment->comment, $comment->format, FALSE); } return $text; case 'search result': - $comments = db_result(db_query('SELECT comment_count FROM {node_comment_statistics} WHERE nid = %d', $node->nid)); + $comments = db_result(db_query('SELECT comment_count FROM {node_comment_statistics} WHERE nid = ?', $node->nid)); return format_plural($comments, '1 comment', '@count comments'); case 'rss item': @@ -541,8 +541,8 @@ */ function comment_user($type, $edit, &$user, $category = NULL) { if ($type == 'delete') { - db_query('UPDATE {comments} SET uid = 0 WHERE uid = %d', $user->uid); - db_query('UPDATE {node_comment_statistics} SET last_comment_uid = 0 WHERE last_comment_uid = %d', $user->uid); + db_query('UPDATE {comments} SET uid = 0 WHERE uid = ?', $user->uid); + db_query('UPDATE {node_comment_statistics} SET last_comment_uid = 0 WHERE last_comment_uid = ?', $user->uid); } } @@ -660,7 +660,7 @@ function comment_edit($cid) { global $user; - $comment = db_fetch_object(db_query('SELECT c.*, u.uid, u.name AS registered_name, u.data FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.cid = %d', $cid)); + $comment = db_fetch_object(db_query('SELECT c.*, u.uid, u.name AS registered_name, u.data FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.cid = ?', $cid)); $comment = drupal_unpack($comment); $comment->name = $comment->uid ? $comment->registered_name : $comment->name; if (comment_access('edit', $comment)) { @@ -714,7 +714,7 @@ // $pid indicates that this is a reply to a comment. if ($pid) { // load the comment whose cid = $pid - if ($comment = db_fetch_object(db_query('SELECT c.*, u.uid, u.name AS registered_name, u.signature, u.picture, u.data FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.cid = %d AND c.status = %d', $pid, COMMENT_PUBLISHED))) { + if ($comment = db_fetch_object(db_query('SELECT c.*, u.uid, u.name AS registered_name, u.signature, u.picture, u.data FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.cid = ? AND c.status = ?', $pid, COMMENT_PUBLISHED))) { // If that comment exists, make sure that the current comment and the parent comment both // belong to the same parent node. if ($comment->nid != $node->nid) { @@ -781,7 +781,7 @@ ); if ($edit['cid']) { // Update the comment in the database. - db_query("UPDATE {comments} SET status = %d, timestamp = %d, subject = '%s', comment = '%s', format = %d, uid = %d, name = '%s', mail = '%s', homepage = '%s' WHERE cid = %d", $edit['status'], $edit['timestamp'], $edit['subject'], $edit['comment'], $edit['format'], $edit['uid'], $edit['name'], $edit['mail'], $edit['homepage'], $edit['cid']); + db_query("UPDATE {comments} SET status = ?, timestamp = ?, subject = ?, comment = ?, format = ?, uid = ?, name = ?, mail = ?, homepage = ? WHERE cid = ?", $edit['status'], $edit['timestamp'], $edit['subject'], $edit['comment'], $edit['format'], $edit['uid'], $edit['name'], $edit['mail'], $edit['homepage'], $edit['cid']); // Allow modules to respond to the updating of a comment. comment_invoke_comment($edit, 'update'); @@ -796,7 +796,7 @@ if ($edit['pid'] == 0) { // This is a comment with no parent comment (depth 0): we start // by retrieving the maximum thread level. - $max = db_result(db_query('SELECT MAX(thread) FROM {comments} WHERE nid = %d', $edit['nid'])); + $max = db_result(db_query('SELECT MAX(thread) FROM {comments} WHERE nid = ?', $edit['nid'])); // Strip the "/" from the end of the thread. $max = rtrim($max, '/'); @@ -815,7 +815,7 @@ $parent->thread = (string) rtrim((string) $parent->thread, '/'); // Get the max value in _this_ thread. - $max = db_result(db_query("SELECT MAX(thread) FROM {comments} WHERE thread LIKE '%s.%%' AND nid = %d", $parent->thread, $edit['nid'])); + $max = db_result(db_query("SELECT MAX(thread) FROM {comments} WHERE thread LIKE '%s.%%' AND nid = ?", $parent->thread, $edit['nid'])); if ($max == '') { // First child of this parent. @@ -841,7 +841,7 @@ $edit['name'] = $user->name; } - db_query("INSERT INTO {comments} (nid, pid, uid, subject, comment, format, hostname, timestamp, status, thread, name, mail, homepage) VALUES (%d, %d, %d, '%s', '%s', %d, '%s', %d, %d, '%s', '%s', '%s', '%s')", $edit['nid'], $edit['pid'], $edit['uid'], $edit['subject'], $edit['comment'], $edit['format'], ip_address(), $edit['timestamp'], $edit['status'], $thread, $edit['name'], $edit['mail'], $edit['homepage']); + db_query("INSERT INTO {comments} (nid, pid, uid, subject, comment, format, hostname, timestamp, status, thread, name, mail, homepage) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", $edit['nid'], $edit['pid'], $edit['uid'], $edit['subject'], $edit['comment'], $edit['format'], ip_address(), $edit['timestamp'], $edit['status'], $thread, $edit['name'], $edit['mail'], $edit['homepage']); $edit['cid'] = db_last_insert_id('comments', 'cid'); // Tell the other modules a new comment has been submitted. @@ -1005,10 +1005,10 @@ if ($cid && is_numeric($cid)) { // Single comment view. - $query = 'SELECT c.cid, c.pid, c.nid, c.subject, c.comment, c.format, c.timestamp, c.name, c.mail, c.homepage, u.uid, u.name AS registered_name, u.signature, u.picture, u.data, c.status FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.cid = %d'; + $query = 'SELECT c.cid, c.pid, c.nid, c.subject, c.comment, c.format, c.timestamp, c.name, c.mail, c.homepage, u.uid, u.name AS registered_name, u.signature, u.picture, u.data, c.status FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.cid = ?'; $query_args = array($cid); if (!user_access('administer comments')) { - $query .= ' AND c.status = %d'; + $query .= ' AND c.status = ?'; $query_args[] = COMMENT_PUBLISHED; } @@ -1025,13 +1025,13 @@ } else { // Multiple comment view - $query_count = 'SELECT COUNT(*) FROM {comments} WHERE nid = %d'; - $query = 'SELECT c.cid as cid, c.pid, c.nid, c.subject, c.comment, c.format, c.timestamp, c.name, c.mail, c.homepage, u.uid, u.name AS registered_name, u.signature, u.picture, u.data, c.thread, c.status FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.nid = %d'; + $query_count = 'SELECT COUNT(*) FROM {comments} WHERE nid = ?'; + $query = 'SELECT c.cid as cid, c.pid, c.nid, c.subject, c.comment, c.format, c.timestamp, c.name, c.mail, c.homepage, u.uid, u.name AS registered_name, u.signature, u.picture, u.data, c.thread, c.status FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.nid = ?'; $query_args = array($nid); if (!user_access('administer comments')) { - $query .= ' AND c.status = %d'; - $query_count .= ' AND status = %d'; + $query .= ' AND c.status = ?'; + $query_count .= ' AND status = ?'; $query_args[] = COMMENT_PUBLISHED; } @@ -1136,7 +1136,7 @@ * Menu callback; delete a comment. */ function comment_delete($cid = NULL) { - $comment = db_fetch_object(db_query('SELECT c.*, u.name AS registered_name, u.uid FROM {comments} c INNER JOIN {users} u ON u.uid = c.uid WHERE c.cid = %d', $cid)); + $comment = db_fetch_object(db_query('SELECT c.*, u.name AS registered_name, u.uid FROM {comments} c INNER JOIN {users} u ON u.uid = c.uid WHERE c.cid = ?', $cid)); $comment->name = $comment->uid ? $comment->registered_name : $comment->name; $output = ''; @@ -1188,20 +1188,20 @@ function comment_operations($action = NULL) { if ($action == 'publish') { $operations = array( - 'publish' => array(t('Publish the selected comments'), 'UPDATE {comments} SET status = '. COMMENT_PUBLISHED .' WHERE cid = %d'), + 'publish' => array(t('Publish the selected comments'), 'UPDATE {comments} SET status = '. COMMENT_PUBLISHED .' WHERE cid = ?'), 'delete' => array(t('Delete the selected comments'), '') ); } else if ($action == 'unpublish') { $operations = array( - 'unpublish' => array(t('Unpublish the selected comments'), 'UPDATE {comments} SET status = '. COMMENT_NOT_PUBLISHED .' WHERE cid = %d'), + 'unpublish' => array(t('Unpublish the selected comments'), 'UPDATE {comments} SET status = '. COMMENT_NOT_PUBLISHED .' WHERE cid = ?'), 'delete' => array(t('Delete the selected comments'), '') ); } else { $operations = array( - 'publish' => array(t('Publish the selected comments'), 'UPDATE {comments} SET status = '. COMMENT_PUBLISHED .' WHERE cid = %d'), - 'unpublish' => array(t('Unpublish the selected comments'), 'UPDATE {comments} SET status = '. COMMENT_NOT_PUBLISHED .' WHERE cid = %d'), + 'publish' => array(t('Publish the selected comments'), 'UPDATE {comments} SET status = '. COMMENT_PUBLISHED .' WHERE cid = ?'), + 'unpublish' => array(t('Unpublish the selected comments'), 'UPDATE {comments} SET status = '. COMMENT_NOT_PUBLISHED .' WHERE cid = ?'), 'delete' => array(t('Delete the selected comments'), '') ); } @@ -1244,7 +1244,7 @@ array('data' => t('Time'), 'field' => 'timestamp', 'sort' => 'desc'), array('data' => t('Operations')) )); - $result = pager_query('SELECT c.subject, c.nid, c.cid, c.comment, c.timestamp, c.status, c.name, c.homepage, u.name AS registered_name, u.uid FROM {comments} c INNER JOIN {users} u ON u.uid = c.uid WHERE c.status = %d'. tablesort_sql($form['header']['#value']), 50, 0, NULL, $status); + $result = pager_query('SELECT c.subject, c.nid, c.cid, c.comment, c.timestamp, c.status, c.name, c.homepage, u.name AS registered_name, u.uid FROM {comments} c INNER JOIN {users} u ON u.uid = c.uid WHERE c.status = ?'. tablesort_sql($form['header']['#value']), 50, 0, NULL, $status); // build a table listing the appropriate comments $destination = drupal_get_destination(); @@ -1339,7 +1339,7 @@ foreach (array_filter($edit['comments']) as $cid => $value) { $comment = _comment_load($cid); if (is_object($comment) && is_numeric($comment->cid)) { - $subject = db_result(db_query('SELECT subject FROM {comments} WHERE cid = %d', $cid)); + $subject = db_result(db_query('SELECT subject FROM {comments} WHERE cid = ?', $cid)); $form['comments'][$cid] = array('#type' => 'hidden', '#value' => $cid, '#prefix' => '
  • ', '#suffix' => check_plain($subject) .'
    • '); $comment_counter++; } @@ -1382,14 +1382,14 @@ * Load the entire comment by cid. */ function _comment_load($cid) { - return db_fetch_object(db_query('SELECT * FROM {comments} WHERE cid = %d', $cid)); + return db_fetch_object(db_query('SELECT * FROM {comments} WHERE cid = ?', $cid)); } function comment_num_all($nid) { static $cache; if (!isset($cache[$nid])) { - $cache[$nid] = db_result(db_query('SELECT comment_count FROM {node_comment_statistics} WHERE nid = %d', $nid)); + $cache[$nid] = db_result(db_query('SELECT comment_count FROM {node_comment_statistics} WHERE nid = ?', $nid)); } return $cache[$nid]; } @@ -1398,7 +1398,7 @@ static $cache; if (!isset($cache[$pid])) { - $cache[$pid] = db_result(db_query('SELECT COUNT(cid) FROM {comments} WHERE pid = %d AND status = %d', $pid, COMMENT_PUBLISHED)); + $cache[$pid] = db_result(db_query('SELECT COUNT(cid) FROM {comments} WHERE pid = ? AND status = ?', $pid, COMMENT_PUBLISHED)); } return $cache[$pid]; @@ -1423,7 +1423,7 @@ $timestamp = ($timestamp > NODE_NEW_LIMIT ? $timestamp : NODE_NEW_LIMIT); // Use the timestamp to retrieve the number of new comments. - $result = db_result(db_query('SELECT COUNT(c.cid) FROM {node} n INNER JOIN {comments} c ON n.nid = c.nid WHERE n.nid = %d AND timestamp > %d AND c.status = %d', $nid, $timestamp, COMMENT_PUBLISHED)); + $result = db_result(db_query('SELECT COUNT(c.cid) FROM {node} n INNER JOIN {comments} c ON n.nid = c.nid WHERE n.nid = ? AND timestamp > ? AND c.status = ?', $nid, $timestamp, COMMENT_PUBLISHED)); return $result; } @@ -1453,7 +1453,7 @@ if (!$user->uid || isset($edit['is_anonymous'])) { if (variable_get('comment_anonymous', COMMENT_ANONYMOUS_MAYNOT_CONTACT) > COMMENT_ANONYMOUS_MAYNOT_CONTACT) { if ($edit['name']) { - $taken = db_result(db_query("SELECT COUNT(uid) FROM {users} WHERE LOWER(name) = '%s'", $edit['name'])); + $taken = db_result(db_query("SELECT COUNT(uid) FROM {users} WHERE LOWER(name) = ?", $edit['name'])); if ($taken != 0) { form_set_error('name', t('The name you used belongs to a registered user.')); @@ -1704,7 +1704,7 @@ $output = ''; if ($edit['pid']) { - $comment = db_fetch_object(db_query('SELECT c.*, u.uid, u.name AS registered_name, u.signature, u.picture, u.data FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.cid = %d AND c.status = %d', $edit['pid'], COMMENT_PUBLISHED)); + $comment = db_fetch_object(db_query('SELECT c.*, u.uid, u.name AS registered_name, u.signature, u.picture, u.data FROM {comments} c INNER JOIN {users} u ON c.uid = u.uid WHERE c.cid = ? AND c.status = ?', $edit['pid'], COMMENT_PUBLISHED)); $comment = drupal_unpack($comment); $comment->name = $comment->uid ? $comment->registered_name : $comment->name; $output .= theme('comment_view', $comment, $node); @@ -1970,13 +1970,13 @@ } // Delete the comment: - db_query('DELETE FROM {comments} WHERE cid = %d', $comment->cid); + db_query('DELETE FROM {comments} WHERE cid = ?', $comment->cid); watchdog('content', 'Comment: deleted %subject.', array('%subject' => $comment->subject)); comment_invoke_comment($comment, 'delete'); // Delete the comment's replies - $result = db_query('SELECT c.*, u.name AS registered_name, u.uid FROM {comments} c INNER JOIN {users} u ON u.uid = c.uid WHERE pid = %d', $comment->cid); + $result = db_query('SELECT c.*, u.name AS registered_name, u.uid FROM {comments} c INNER JOIN {users} u ON u.uid = c.uid WHERE pid = ?', $comment->cid); while ($comment = db_fetch_object($result)) { $comment->name = $comment->uid ? $comment->registered_name : $comment->name; _comment_delete_thread($comment); @@ -2073,18 +2073,18 @@ * - comment_count: the total number of approved/published comments on this node. */ function _comment_update_node_statistics($nid) { - $count = db_result(db_query('SELECT COUNT(cid) FROM {comments} WHERE nid = %d AND status = %d', $nid, COMMENT_PUBLISHED)); + $count = db_result(db_query('SELECT COUNT(cid) FROM {comments} WHERE nid = ? AND status = ?', $nid, COMMENT_PUBLISHED)); // comments exist if ($count > 0) { - $last_reply = db_fetch_object(db_query_range('SELECT cid, name, timestamp, uid FROM {comments} WHERE nid = %d AND status = %d ORDER BY cid DESC', $nid, COMMENT_PUBLISHED, 0, 1)); - db_query("UPDATE {node_comment_statistics} SET comment_count = %d, last_comment_timestamp = %d, last_comment_name = '%s', last_comment_uid = %d WHERE nid = %d", $count, $last_reply->timestamp, $last_reply->uid ? '' : $last_reply->name, $last_reply->uid, $nid); + $last_reply = db_fetch_object(db_query_range('SELECT cid, name, timestamp, uid FROM {comments} WHERE nid = ? AND status = ? ORDER BY cid DESC', $nid, COMMENT_PUBLISHED, 0, 1)); + db_query("UPDATE {node_comment_statistics} SET comment_count = ?, last_comment_timestamp = ?, last_comment_name = ?, last_comment_uid = ? WHERE nid = ?", $count, $last_reply->timestamp, $last_reply->uid ? '' : $last_reply->name, $last_reply->uid, $nid); } // no comments else { - $node = db_fetch_object(db_query("SELECT uid, created FROM {node} WHERE nid = %d", $nid)); - db_query("UPDATE {node_comment_statistics} SET comment_count = 0, last_comment_timestamp = %d, last_comment_name = '', last_comment_uid = %d WHERE nid = %d", $node->created, $node->uid, $nid); + $node = db_fetch_object(db_query("SELECT uid, created FROM {node} WHERE nid = ?", $nid)); + db_query("UPDATE {node_comment_statistics} SET comment_count = 0, last_comment_timestamp = ?, last_comment_name = '', last_comment_uid = ? WHERE nid = ?", $node->created, $node->uid, $nid); } } @@ -2203,9 +2203,9 @@ } else { $cid = $context['cid']; - $subject = db_result(db_query("SELECT subject FROM {comments} WHERE cid = %d", $cid)); + $subject = db_result(db_query("SELECT subject FROM {comments} WHERE cid = ?", $cid)); } - db_query('UPDATE {comments} SET status = %d WHERE cid = %d', COMMENT_NOT_PUBLISHED, $cid); + db_query('UPDATE {comments} SET status = ? WHERE cid = ?', COMMENT_NOT_PUBLISHED, $cid); watchdog('action', 'Unpublished comment %subject.', array('%subject' => $subject)); } @@ -2237,7 +2237,7 @@ function comment_unpublish_by_keyword_action($comment, $context) { foreach ($context['keywords'] as $keyword) { if (strstr($comment->comment, $keyword) || strstr($comment->subject, $keyword)) { - db_query('UPDATE {comments} SET status = %d WHERE cid = %d', COMMENT_NOT_PUBLISHED, $comment->cid); + db_query('UPDATE {comments} SET status = ? WHERE cid = ?', COMMENT_NOT_PUBLISHED, $comment->cid); watchdog('action', 'Unpublished comment %subject.', array('%subject' => $comment->subject)); break; } Index: includes/database.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/database.inc,v retrieving revision 1.82 diff -u -r1.82 database.inc --- includes/database.inc 2 Oct 2007 16:15:56 -0000 1.82 +++ includes/database.inc 5 Oct 2007 07:23:44 -0000 @@ -51,6 +51,186 @@ */ /** + * Initialise a database connection. + */ +function db_connect($url) { + list($dsn, $user, $pass) = db_dsn($url); + + try { + $connection = new PDO($dsn, $user, $pass); + $connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); + } catch (PDOException $e) { + db_connection_error($e->getCode(), $e->getMessage()); + } + + // Set additional attributes. + if (function_exists('_db_connect')) { + _db_connect($connection); + } + + return $connection; +} + +/** + * Returns the version of the database server currently in use. + * + * @return Database server version + */ +function db_version() { + global $active_db; + list($version) = explode('-', $active_db->getAttribute(PDO::ATTR_SERVER_VERSION)); + return $version; +} + +/** + * Runs a basic query in the active database. + * + * User-supplied arguments to the query should be passed in as separate + * parameters so that they can be properly escaped to avoid SQL injection + * attacks. + * + * @param $query + * A string containing an SQL query. + * @param ... + * A variable number of arguments which are substituted into the query + * using printf() syntax. Instead of a variable number of query arguments, + * you may also pass a single array containing the query arguments. + * + * Valid %-modifiers are: %s, %d, %f, %b (binary data, do not enclose + * in '') and %%. + * + * NOTE: using this syntax will cast NULL and FALSE values to decimal 0, + * and TRUE values to decimal 1. + * + * @return + * A database query result resource, or FALSE if the query was not + * executed correctly. + */ +function db_query($query) { + $args = func_get_args(); + array_shift($args); + $query = db_prefix_tables($query); + if (isset($args[0]) and is_array($args[0])) { // 'All arguments in one array' syntax + $args = $args[0]; + } + return _db_query($query, $args); +} + +/** + * Helper function for db_query(). + */ +function _db_query($query, $args, $debug = 0) { + global $active_db, $queries; + + if (variable_get('dev_query', 0)) { + list($usec, $sec) = explode(' ', microtime()); + $timer = (float)$usec + (float)$sec; + } + + try { + //$result = $active_db->query($query, $args); + $result = $active_db->prepare($query); + $result->execute($args); + } + catch (PDOException $e) { + ${DB_ERROR} = TRUE; + trigger_error(check_plain($e->getMessage() ."\nquery: ". $query), E_USER_WARNING); + } + + if (variable_get('dev_query', 0)) { + $bt = debug_backtrace(); + $query = $bt[2]['function'] ."\n". $query; + list($usec, $sec) = explode(' ', microtime()); + $stop = (float)$usec + (float)$sec; + $diff = $stop - $timer; + $queries[] = array($query, $diff); + } + + if ($debug) { + $error = $last_result->errorInfo(); + print '

    query: '. $query .'
    error:'. $error[2] .'

    '; + } + + if ($result) { + return $result; + } + else { + return FALSE; + } +} + +/** + * Fetch one result row from the previous query as an object. + * + * @param $result + * A database query result resource, as returned from db_query(). + * @return + * An object representing the next row of the result, or FALSE. The attributes + * of this object are the table fields selected by the query. + */ +function db_fetch_object($result) { + if ($result) { + return $result->fetch(PDO::FETCH_OBJ); + } +} + +/** + * Fetch one result row from the previous query as an array. + * + * @param $result + * A database query result resource, as returned from db_query(). + * @return + * An associative array representing the next row of the result, or FALSE. + * The keys of this object are the names of the table fields selected by the + * query, and the values are the field values for this result row. + */ +function db_fetch_array($result) { + if ($result) { + return $result->fetch(PDO::FETCH_ASSOC); + } +} + +/** +* Return an individual result field from the previous query. +* +* Only use this function if exactly one field is being selected; otherwise, +* use db_fetch_object() or db_fetch_array(). +* +* @param $result +* A database query result resource, as returned from db_query(). +* @return +* The resulting field or FALSE. +*/ +function db_result($result) { + if ($result) { + return $result->fetchColumn(); + } + return FALSE; +} + +/** + * Determine whether the previous query caused an error. + */ +function db_error($result) { + return $result->getErrorCode(); +} + +/** + * Determine the number of rows changed by the preceding query. + */ +function db_affected_rows($result) { + return $result->rowCount(); +} + +/** + * Prepare user input for use in a database query, preventing SQL injection attacks. + */ +function db_escape_string($text, $type = PDO::PARAM_STR) { + global $active_db; + return $active_db->quote($text, $type); +} + +/** * Perform an SQL query and return success or failure. * * @param $sql @@ -148,7 +328,7 @@ else { drupal_maintenance_theme(); drupal_set_title('Unsupported database type'); - print theme('maintenance_page', '

    The database type '. theme('placeholder', $db_type) .' is unsupported. Please use either mysql for MySQL 3.x & 4.0.x databases, mysqli for MySQL 4.1.x+ databases, or pgsql for PostgreSQL databases. The database information is in your settings.php file.

    + print theme('maintenance_page', '

    The database type '. theme('placeholder', $db_type) .' is unsupported. Please use either mysql for MySQL 4.1.x+ databases, or pgsql for PostgreSQL databases. The database information is in your settings.php file.

    For more help, see the Installation and upgrading handbook. If you are unsure what these terms mean you should probably contact your hosting provider.

    '); exit; } @@ -164,30 +344,6 @@ } /** - * Helper function for db_query(). - */ -function _db_query_callback($match, $init = FALSE) { - static $args = NULL; - if ($init) { - $args = $match; - return; - } - - switch ($match[1]) { - case '%d': // We must use type casting to int to convert FALSE/NULL/(TRUE?) - return (int) array_shift($args); // We don't need db_escape_string as numbers are db-safe - case '%s': - return db_escape_string(array_shift($args)); - case '%%': - return '%'; - case '%f': - return (float) array_shift($args); - case '%b': // binary data - return db_encode_blob(array_shift($args)); - } -} - -/** * Generate placeholders for an array of query arguments of a single type. * * Given a Schema API field type, return correct %-placeholders to @@ -199,16 +355,11 @@ * The Schema API type of a field (e.g. 'int', 'text', or 'varchar'). */ function db_placeholders($arguments, $type = 'int') { - $placeholder = db_type_placeholder($type); + $placeholder = '?'; return implode(',', array_fill(0, count($arguments), $placeholder)); } /** - * Indicates the place holders that should be replaced in _db_query_callback(). - */ -define('DB_QUERY_REGEXP', '/(%d|%s|%%|%f|%b)/'); - -/** * Helper function for db_rewrite_sql. * * Collects JOIN and WHERE statements via hook_db_rewrite_sql() @@ -477,48 +628,5 @@ } /** - * Given a Schema API field type, return the correct %-placeholder. - * - * Embed the placeholder in a query to be passed to db_query and and pass as an - * argument to db_query a value of the specified type. - * - * @param $type - * The Schema API type of a field. - * @return - * The placeholder string to embed in a query for that type. - */ -function db_type_placeholder($type) { - switch ($type) { - case 'varchar': - case 'text': - case 'datetime': - return '\'%s\''; - - case 'numeric': - // For 'numeric' values, we use '%s', not '\'%s\'' as with - // string types, because numeric values should not be enclosed - // in quotes in queries (though they can be, at least on mysql - // and pgsql). Numerics should only have [0-9.+-] and - // presumably no db's "escape string" function will mess with - // those characters. - return '%s'; - - case 'serial': - case 'int': - return '%d'; - - case 'float': - return '%f'; - - case 'blob': - return '%b'; - } - - // There is no safe value to return here, so return something that - // will cause the query to fail. - return 'unsupported type '. $type .'for db_type_placeholder'; -} - -/** * @} End of "defgroup schemaapi". */ Index: includes/path.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/path.inc,v retrieving revision 1.16 diff -u -r1.16 path.inc --- includes/path.inc 18 Jun 2007 06:59:11 -0000 1.16 +++ includes/path.inc 5 Oct 2007 07:23:45 -0000 @@ -65,7 +65,7 @@ return $map[$path_language][$path]; } // Get the most fitting result falling back with alias without language - $alias = db_result(db_query("SELECT dst FROM {url_alias} WHERE src = '%s' AND language IN('%s', '') ORDER BY language DESC", $path, $path_language)); + $alias = db_result(db_query("SELECT dst FROM {url_alias} WHERE src = ? AND language IN(?, '') ORDER BY language DESC", $path, $path_language)); $map[$path_language][$path] = $alias; return $alias; } @@ -76,7 +76,7 @@ $src = ''; if (!isset($map[$path_language]) || !($src = array_search($path, $map[$path_language]))) { // Get the most fitting result falling back with alias without language - if ($src = db_result(db_query("SELECT src FROM {url_alias} WHERE dst = '%s' AND language IN('%s', '') ORDER BY language DESC", $path, $path_language))) { + if ($src = db_result(db_query("SELECT src FROM {url_alias} WHERE dst = ? AND language IN(?, '') ORDER BY language DESC", $path, $path_language))) { $map[$path_language][$src] = $path; } else { Index: includes/actions.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/actions.inc,v retrieving revision 1.4 diff -u -r1.4 actions.inc --- includes/actions.inc 9 Sep 2007 20:01:39 -0000 1.4 +++ includes/actions.inc 5 Oct 2007 07:23:43 -0000 @@ -54,7 +54,7 @@ $where_values = array(); foreach ($action_ids as $action_id) { if (is_numeric($action_id)) { - $where[] = 'OR aid = %d'; + $where[] = 'OR aid = ?'; $where_values[] = $action_id; } elseif (isset($available_actions[$action_id])) { @@ -94,7 +94,7 @@ else { // If it's a configurable action, retrieve stored parameters. if (is_numeric($action_ids)) { - $action = db_fetch_object(db_query("SELECT * FROM {actions} WHERE aid = %d", $action_ids)); + $action = db_fetch_object(db_query("SELECT * FROM {actions} WHERE aid = ?", $action_ids)); $function = $action->callback; $context = array_merge($context, unserialize($action->parameters)); $result[$action_ids] = $function($object, $context, $a1, $a2); @@ -239,7 +239,7 @@ } // Must be an instance; must check database. - $aid = db_result(db_query("SELECT aid FROM {actions} WHERE MD5(aid) = '%s' AND parameters != ''", $hash)); + $aid = db_result(db_query("SELECT aid FROM {actions} WHERE MD5(aid) = ? AND parameters != ''", $hash)); return $aid; } @@ -272,7 +272,7 @@ } else { // This is a new singleton that we don't have an aid for; assign one. - db_query("INSERT INTO {actions} (aid, type, callback, parameters, description) VALUES ('%s', '%s', '%s', '%s', '%s')", $callback, $array['type'], $callback, '', $array['description']); + db_query("INSERT INTO {actions} (aid, type, callback, parameters, description) VALUES (?, ?, ?, ?, ?)", $callback, $array['type'], $callback, '', $array['description']); watchdog('actions', t("Action '%action' added.", array('%action' => filter_xss_admin($array['description'])))); } } @@ -285,7 +285,7 @@ foreach ($actions_in_db as $callback => $array) { $orphaned[] = $callback; - $placeholder[] = "'%s'"; + $placeholder[] = '?'; } $orphans = implode(', ', $orphaned); @@ -326,7 +326,7 @@ function actions_save($function, $type, $params, $desc, $aid = NULL) { $serialized = serialize($params); if ($aid) { - db_query("UPDATE {actions} SET callback = '%s', type = '%s', parameters = '%s', description = '%s' WHERE aid = %d", $function, $type, $serialized, $desc, $aid); + db_query("UPDATE {actions} SET callback = ?, type = ?, parameters = ?, description = ? WHERE aid = ?", $function, $type, $serialized, $desc, $aid); watchdog('actions', 'Action %action saved.', array('%action' => $desc)); } else { @@ -334,7 +334,7 @@ // separate table for numeric aids. db_query('INSERT INTO {actions_aid} VALUES (default)'); $aid = db_last_insert_id('actions_aid', 'aid'); - db_query("INSERT INTO {actions} (aid, callback, type, parameters, description) VALUES (%d, '%s', '%s', '%s', '%s')", $aid, $function, $type, $serialized, $desc); + db_query("INSERT INTO {actions} (aid, callback, type, parameters, description) VALUES (?, ?, ?, ?, ?)", $aid, $function, $type, $serialized, $desc); watchdog('actions', 'Action %action created.', array('%action' => $desc)); } @@ -351,7 +351,7 @@ * The appropriate action row from the database as an object. */ function actions_load($aid) { - return db_fetch_object(db_query("SELECT * FROM {actions} WHERE aid = %d", $aid)); + return db_fetch_object(db_query("SELECT * FROM {actions} WHERE aid = ?", $aid)); } /** @@ -361,6 +361,6 @@ * integer The ID of the action to delete. */ function actions_delete($aid) { - db_query("DELETE FROM {actions} WHERE aid = %d", $aid); + db_query("DELETE FROM {actions} WHERE aid = ?", $aid); module_invoke_all('actions_delete', $aid); } Index: includes/database.pgsql.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/database.pgsql.inc,v retrieving revision 1.62 diff -u -r1.62 database.pgsql.inc --- includes/database.pgsql.inc 2 Oct 2007 16:15:56 -0000 1.62 +++ includes/database.pgsql.inc 5 Oct 2007 07:23:44 -0000 @@ -33,20 +33,11 @@ } /** - * Returns the version of the database server currently in use. - * - * @return Database server version + * Build a PDO compatible DSN. */ -function db_version() { - return db_result(db_query("SHOW SERVER_VERSION")); -} - -/** - * Initialize a database connection. - */ -function db_connect($url) { - // Check if PostgreSQL support is present in PHP - if (!function_exists('pg_connect')) { +function db_dsn($url) { + // Check if PostgreSQL support is present in PDO. + if (!in_array('pgsql', PDO::getAvailableDrivers())) { drupal_maintenance_theme(); drupal_set_title('PHP PostgreSQL support not enabled'); print theme('maintenance_page', '

    We were unable to use the PostgreSQL database because the PostgreSQL extension for PHP is not installed. Check your PHP.ini to see how you can enable it.

    @@ -55,40 +46,35 @@ } $url = parse_url($url); - $conn_string = ''; // Decode url-encoded information in the db connection string - if (isset($url['user'])) { - $conn_string .= ' user='. urldecode($url['user']); - } + $url['user'] = urldecode($url['user']); + // Test if database url has a password. if (isset($url['pass'])) { - $conn_string .= ' password='. urldecode($url['pass']); + $url['pass'] = urldecode($url['pass']); } - if (isset($url['host'])) { - $conn_string .= ' host='. urldecode($url['host']); - } - if (isset($url['path'])) { - $conn_string .= ' dbname='. substr(urldecode($url['path']), 1); - } - if (isset($url['port'])) { - $conn_string .= ' port='. urldecode($url['port']); + else { + $url['pass'] = ''; } + $url['host'] = urldecode($url['host']); + $url['path'] = urldecode($url['path']); - // pg_last_error() does not return a useful error message for database - // connection errors. We must turn on error tracking to get at a good error - // message, which will be stored in $php_errormsg. - $track_errors_previous = ini_get('track_errors'); - ini_set('track_errors', 1); + $dsn = 'pgsql:host='. $url['host'] .';dbname='. substr($url['path'], 1); - $connection = @pg_connect($conn_string); - if (!$connection) { + return array($dsn, $url['user'], $url['pass']); +} + +/** + * Initialize a database connection. + */ +function db_connection_error($code, $message) { + if (!$code) { drupal_maintenance_theme(); drupal_set_header('HTTP/1.1 503 Service Unavailable'); drupal_set_title('Unable to connect to database'); print theme('maintenance_page', '

    If you still have to install Drupal, proceed to the installation page.

    If you have already finished installed Drupal, this either means that the username and password information in your settings.php file is incorrect or that we can\'t connect to the PostgreSQL database server. This could mean your hosting provider\'s database server is down.

    -

    The PostgreSQL error was: '. theme('placeholder', decode_entities($php_errormsg)) .'

    -

    Currently, the database is '. theme('placeholder', substr($url['path'], 1)) .', the username is '. theme('placeholder', $url['user']) .', and the database server is '. theme('placeholder', $url['host']) .'.

    +

    The PostgreSQL error was: '. theme('placeholder', $message) .'