Ticket #2952: bp.2952.diff

bp-core/bp-core-classes.php

@@ -148 +148 @@
                         $sql['where_active'] = $wpdb->prepare( "AND um.meta_key = %s", bp_get_user_meta_key( 'last_activity' ) );
 
                 if ( 'popular' == $type )
-                        $sql['where_popular'] = "AND um.meta_key = 'total_friend_count'";
+                        $sql['where_popular'] = $wpdb->prepare( "AND um.meta_key = %s", bp_get_user_meta_key( 'total_friend_count' ) );
 
                 if ( 'online' == $type )
                         $sql['where_online'] = "AND DATE_ADD( um.meta_value, INTERVAL 5 MINUTE ) >= UTC_TIMESTAMP()";
@@ -389 +389 @@
 
                 // Fetch the user's total friend count
                 if ( 'popular' != $type ) {
-                        $friend_count = $wpdb->get_results( "SELECT user_id as id, meta_value as total_friend_count FROM " . CUSTOM_USER_META_TABLE . " WHERE meta_key = 'total_friend_count' AND user_id IN ( {$user_ids} )" );
+                        $friend_count = $wpdb->get_results( $wpdb->prepare( "SELECT user_id as id, meta_value as total_friend_count FROM " . CUSTOM_USER_META_TABLE . " WHERE meta_key = %s AND user_id IN ( {$user_ids} )", bp_get_user_meta_key('total_friend_count') ) );
                         for ( $i = 0; $i < count( $paged_users ); $i++ ) {
                                 foreach ( (array)$friend_count as $count ) {
                                         if ( $count->id == $paged_users[$i]->id )
@@ -410 +410 @@
                 }
 
                 if ( 'active' != $type ) {
-                        $user_activity = $wpdb->get_results( "SELECT user_id as id, meta_value as last_activity FROM " . CUSTOM_USER_META_TABLE . " WHERE meta_key = '" . bp_get_user_meta_key( 'last_activity' ) . "' AND user_id IN ( {$user_ids} )" );
+                        $user_activity = $wpdb->get_results( $wpdb->prepare( "SELECT user_id as id, meta_value as last_activity FROM " . CUSTOM_USER_META_TABLE . " WHERE meta_key = %s AND user_id IN ( {$user_ids} )", bp_get_user_meta_key( 'last_activity' ) ) );
                         for ( $i = 0; $i < count( $paged_users ); $i++ ) {
                                 foreach ( (array)$user_activity as $activity ) {
                                         if ( $activity->id == $paged_users[$i]->id )
@@ -421 +421 @@
 
                 // Fetch the user's last_activity
                 if ( 'active' != $type ) {
-                        $user_activity = $wpdb->get_results( "SELECT user_id as id, meta_value as last_activity FROM " . CUSTOM_USER_META_TABLE . " WHERE meta_key = '" . bp_get_user_meta_key( 'last_activity' ) . "' AND user_id IN ( {$user_ids} )" );
+                        $user_activity = $wpdb->get_results( $wpdb->prepare( "SELECT user_id as id, meta_value as last_activity FROM " . CUSTOM_USER_META_TABLE . " WHERE meta_key = %s AND user_id IN ( {$user_ids} )", bp_get_user_meta_key( 'last_activity' ) ) );
                         for ( $i = 0; $i < count( $paged_users ); $i++ ) {
                                 foreach ( (array)$user_activity as $activity ) {
                                         if ( $activity->id == $paged_users[$i]->id )
@@ -431 +431 @@
                 }
 
                 // Fetch the user's latest update
-                $user_update = $wpdb->get_results( "SELECT user_id as id, meta_value as latest_update FROM " . CUSTOM_USER_META_TABLE . " WHERE meta_key = '" . bp_get_user_meta_key( 'bp_latest_update' ) . "' AND user_id IN ( {$user_ids} )" );
+                $user_update = $wpdb->get_results( $wpdb->prepare( "SELECT user_id as id, meta_value as latest_update FROM " . CUSTOM_USER_META_TABLE . " WHERE meta_key = %s AND user_id IN ( {$user_ids} )", bp_get_user_meta_key( 'bp_latest_update' ) ) );
                 for ( $i = 0; $i < count( $paged_users ); $i++ ) {
                         foreach ( (array)$user_update as $update ) {
                                 if ( $update->id == $paged_users[$i]->id )

bp-friends/bp-friends-classes.php

@@ -201 +201 @@
         function get_bulk_last_active( $user_ids ) {
                 global $wpdb, $bp;
 
-                return $wpdb->get_results( $wpdb->prepare( "SELECT meta_value as last_activity, user_id FROM " . CUSTOM_USER_META_TABLE . " WHERE meta_key = '" . bp_get_user_meta_key( 'last_activity' ) . "' AND user_id IN ( {$user_ids} ) ORDER BY meta_value DESC" ) );
+                return $wpdb->get_results( $wpdb->prepare( "SELECT meta_value as last_activity, user_id FROM " . CUSTOM_USER_META_TABLE . " WHERE meta_key = %s AND user_id IN ( {$user_ids} ) ORDER BY meta_value DESC", bp_get_user_meta_key( 'last_activity' ) ) );
         }
 
         function accept($friendship_id) {