Ticket #270 - Updated DB class and its usage.

inc/classes/BxDolAclQuery.php

@@ -52,32 +52,42 @@ class BxDolAclQuery extends BxDolDb implements iBxDolSingleton
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare("AND `tal`.`ID`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `tal`.`ID`=:id";
                 $sLimitClause .= "LIMIT 1";
                 break;
+
             case 'all_active':
                 $sWhereClause .= "AND `tal`.`Active`='yes'";
                 break;
+
             case 'all_active_purchasble_pair':
                 $aMethod['name'] = "getPairs";
                 $aMethod['params'][1] = 'id';
                 $aMethod['params'][2] = 'name';
                 $sWhereClause .= "AND `tal`.`Active`='yes' AND `tal`.`Purchasable`='yes'";
                 break;
+
             case 'all_active_pair':
                 $aMethod['name'] = "getPairs";
                 $aMethod['params'][1] = 'id';
                 $aMethod['params'][2] = 'name';
                 $sWhereClause .= "AND `tal`.`Active`='yes'";
                 break;
+
             case 'all_pair':
                 $aMethod['name'] = "getPairs";
                 $aMethod['params'][1] = 'id';
                 $aMethod['params'][2] = 'name';
                 break;
+
             case 'all_order_id':
                 $sOrderClause = "ORDER BY `tal`.`ID` ASC";
                 break;
+
             case 'all':
                 break;
         }
@@ -112,25 +122,43 @@ class BxDolAclQuery extends BxDolDb implements iBxDolSingleton
         if(!isset($aParams['order']) || empty($aParams['order']))
            $sOrderClause = "ORDER BY `taa`.`Title` ASC";
 
+           
         switch($aParams['type']) {
             case 'by_names_and_module':
-                $sWhereClause .= " AND `taa`.`Name` IN(" . $this->implode_escape($aParams['value']) . ") " . $this->prepare(" AND `taa`.`Module` = ? ", $aParams['module']);
+            	$aMethod['params'][1] = array(
+                	'module' => $aParams['module']
+                );
+
+                $sWhereClause .= " AND `taa`.`Name` IN(" . $this->implode_escape($aParams['value']) . ") AND `taa`.`Module` = :module ";
                 break;
+
             case 'by_names':
                 $sWhereClause .= " AND `taa`.`Name` IN(" . $this->implode_escape($aParams['value']) . ")";
                 break;
+
             case 'by_level_id':
+            	$aMethod['params'][1] = array(
+                	'level_id' => $aParams['value'],
+                	'level_code' => pow(2, ($aParams['value'] - 1))
+                );
+
                 $sSelectClause .= ", `tam`.`AllowedCount` AS `allowed_count`, `tam`.`AllowedPeriodLen` AS `allowed_period_len` ";
                 $sJoinClause .= "LEFT JOIN `sys_acl_matrix` AS `tam` ON `taa`.`ID`=`tam`.`IDAction` ";
-                $sWhereClause .= $this->prepare("AND `tam`.`IDLevel`=? AND (`taa`.`DisabledForLevels`='0' OR `taa`.`DisabledForLevels`&?=0)", $aParams['value'], pow(2, ($aParams['value'] - 1)));
+                $sWhereClause .= "AND `tam`.`IDLevel`=:level_id AND (`taa`.`DisabledForLevels`='0' OR `taa`.`DisabledForLevels`&:level_code=0)";
                 break;
+
             case 'by_level_id_key_id':
                 $aMethod['name'] = 'getAllWithKey';
                 $aMethod['params'][1] = 'id';
+                $aMethod['params'][2] = array(
+                	'level_id' => $aParams['value']
+                );
+
                 $sSelectClause .= ", `tam`.`AllowedCount` AS `allowed_count`, `tam`.`AllowedPeriodLen` AS `allowed_period_len` ";
                 $sJoinClause .= "LEFT JOIN `sys_acl_matrix` AS `tam` ON `taa`.`ID`=`tam`.`IDAction` ";
-                $sWhereClause .= $this->prepare("AND `tam`.`IDLevel`=?", $aParams['value']);
+                $sWhereClause .= "AND `tam`.`IDLevel`=:level_id";
                 break;
+
             case 'counter_by_modules':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'module';
@@ -138,6 +166,7 @@ class BxDolAclQuery extends BxDolDb implements iBxDolSingleton
                 $sSelectClause = ", COUNT(*) AS `counter`";
                 $sGroupClause = "GROUP BY `taa`.`Module`";
                 break;
+
             case 'counter_by_levels':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'level_id';

inc/classes/BxDolConnectionQuery.php

@@ -38,11 +38,11 @@ class BxDolConnectionQuery extends BxDolDb
 
     public function getCommonContentSQLParts ($sContentTable, $sContentField, $iInitiator1, $iInitiator2, $isMutual = false)
     {
-        $sWhereJoin1 = $this->prepare(" AND `c`.`initiator` = ?", $iInitiator1);
-        $sWhereJoin2 = $this->prepare(" AND `c2`.`initiator` = ?", $iInitiator2);
+        $sWhereJoin1 = $this->prepareAsString(" AND `c`.`initiator` = ?", $iInitiator1);
+        $sWhereJoin2 = $this->prepareAsString(" AND `c2`.`initiator` = ?", $iInitiator2);
         if (false !== $isMutual) {
-            $sWhereJoin1 .= $this->prepare(" AND `c`.`mutual` = ?", $isMutual);
-            $sWhereJoin2 .= $this->prepare(" AND `c2`.`mutual` = ?", $isMutual);
+            $sWhereJoin1 .= $this->prepareAsString(" AND `c`.`mutual` = ?", $isMutual);
+            $sWhereJoin2 .= $this->prepareAsString(" AND `c2`.`mutual` = ?", $isMutual);
         }
         return array(
             'join' => "
@@ -53,9 +53,9 @@ class BxDolConnectionQuery extends BxDolDb
 
     public function getConnectedContentSQLParts ($sContentTable, $sContentField, $iInitiator, $isMutual = false)
     {
-        $sWhere = $this->prepare(" AND `c`.`initiator` = ?", $iInitiator);
+        $sWhere = $this->prepareAsString(" AND `c`.`initiator` = ?", $iInitiator);
         if (false !== $isMutual)
-            $sWhere .= $this->prepare(" AND `c`.`mutual` = ?", $isMutual);
+            $sWhere .= $this->prepareAsString(" AND `c`.`mutual` = ?", $isMutual);
         return array(
             'join' => "INNER JOIN `{$this->_sTable}` AS `c` ON (`c`.`content` = `$sContentTable`.`$sContentField` $sWhere)",
         );
@@ -63,9 +63,9 @@ class BxDolConnectionQuery extends BxDolDb
 
     public function getConnectedInitiatorsSQLParts ($sContentTable, $sContentField, $iInitiator, $isMutual = false)
     {
-        $sWhere = $this->prepare(" AND `c`.`content` = ?", $iInitiator);
+        $sWhere = $this->prepareAsString(" AND `c`.`content` = ?", $iInitiator);
         if (false !== $isMutual)
-            $sWhere .= $this->prepare(" AND `c`.`mutual` = ?", $isMutual);
+            $sWhere .= $this->prepareAsString(" AND `c`.`mutual` = ?", $isMutual);
         return array(
             'join' => "INNER JOIN `{$this->_sTable}` AS `c` ON (`c`.`initiator` = `$sContentTable`.`$sContentField` $sWhere)",
         );
@@ -73,36 +73,49 @@ class BxDolConnectionQuery extends BxDolDb
 
     public function getCommonContent($iInitiator1, $iInitiator2, $isMutual, $iStart, $iLimit, $iOrder)
     {
-        $sWhereJoin = (false !== $isMutual) ? $this->prepare(" AND `c2`.`mutual` = ?", $isMutual) : '';
-        $sJoin = $this->prepare("INNER JOIN `" . $this->_sTable . "` AS `c2` ON (`c2`.`initiator` = ? AND `c`.`content` = `c2`.`content` $sWhereJoin)", $iInitiator2);
+        $sWhereJoin = (false !== $isMutual) ? " AND `c2`.`mutual` = :mutual" : "";
+        $sJoin = "INNER JOIN `" . $this->_sTable . "` AS `c2` ON (`c2`.`initiator` = :initiator2 AND `c`.`content` = `c2`.`content` $sWhereJoin)";
 
-        $sWhere = $this->prepare(" AND `c`.`initiator` = ?", $iInitiator1);
+        $sWhere = " AND `c`.`initiator` = :initiator1";
         $sQuery = $this->_getConnectionsQuery($sWhere, $sJoin, '`c`.`content`', $isMutual, $iStart, $iLimit, $iOrder);
 
-        return $this->getColumn($sQuery);
+        $sQuery = $this->prepare($sQuery);
+        return $this->getColumn($sQuery, array(
+    		'mutual' => $isMutual,
+    		'initiator1' => $iInitiator1,
+    		'initiator2' => $iInitiator2,  
+    	));
     }
 
     public function getConnectedContent ($iInitiator, $isMutual = false, $iStart = 0, $iLimit = BX_CONNECTIONS_LIST_LIMIT, $iOrder = BX_CONNECTIONS_ORDER_NONE)
     {
-        $sWhere = $this->prepare(" AND `c`.`initiator` = ?", $iInitiator);
+        $sWhere = " AND `c`.`initiator` = :initiator";
         $sQuery = $this->_getConnectionsQuery($sWhere, '', '`c`.`content`', $isMutual, $iStart, $iLimit, $iOrder);
-        return $this->getColumn($sQuery);
+
+        $sQuery = $this->prepare($sQuery);
+        return $this->getColumn($sQuery, array(
+        	'initiator' => $iInitiator
+        ));
     }
 
     public function getConnectedInitiators ($iContent, $isMutual = false, $iStart = 0, $iLimit = BX_CONNECTIONS_LIST_LIMIT, $iOrder = BX_CONNECTIONS_ORDER_NONE)
     {
-        $sWhere = $this->prepare(" AND `c`.`content` = ?", $iContent);
+        $sWhere = " AND `c`.`content` = :content";
         $sQuery = $this->_getConnectionsQuery($sWhere, '', '`c`.`initiator`', $isMutual, $iStart, $iLimit, $iOrder);
-        return $this->getColumn($sQuery);
+
+        $sQuery = $this->prepare($sQuery);
+        return $this->getColumn($sQuery, array(
+        	'content' => $iContent
+        ));
     }
 
     protected function _getConnectionsQuery ($sWhere, $sJoin = '', $sFields = '*', $isMutual = false, $iStart = 0, $iLimit = BX_CONNECTIONS_LIST_LIMIT, $iOrder = BX_CONNECTIONS_ORDER_NONE)
     {
         $sOrder = $this->_getOrderClause($iOrder);
 
-        $sWhere .= (false !== $isMutual) ? $this->prepare(" AND `c`.`mutual` = ?", $isMutual) : '';
+        $sWhere .= (false !== $isMutual) ? $this->prepareAsString(" AND `c`.`mutual` = ?", $isMutual) : '';
 
-        return $this->prepare("SELECT $sFields FROM `" . $this->_sTable . "` AS `c` $sJoin WHERE 1 $sWhere $sOrder LIMIT ?, ?", $iStart, $iLimit);
+        return $this->prepareAsString("SELECT $sFields FROM `" . $this->_sTable . "` AS `c` $sJoin WHERE 1 $sWhere $sOrder LIMIT ?, ?", $iStart, $iLimit);
     }
 
     protected function _getOrderClause ($iOrder = BX_CONNECTIONS_ORDER_NONE, $sTable = '')
@@ -132,17 +145,20 @@ class BxDolConnectionQuery extends BxDolDb
         if ($this->getConnection($iInitiator, $iContent)) // connection already exists
             return false;
 
+		$aBindings = array();
+
         $iMutual = 0;
         $sMutualField = '';
         if (BX_CONNECTIONS_TYPE_MUTUAL == $this->_sType) {
             $aConnectionMutual = $this->getConnection($iContent, $iInitiator);
             $iMutual = $aConnectionMutual ? 1 : 0;
-            $sMutualField = $this->prepare(", `mutual` = ?", $iMutual);
+
+            $sMutualField = ", `mutual` = :mutual";
+            $aBindings['mutual'] = $iMutual;
         }
 
-        $sQuery = $this->prepare("INSERT INTO `" . $this->_sTable . "` SET `initiator` = ?, `content` = ?, `added` = ?", $iInitiator, $iContent, time());
-        $sQuery .= $sMutualField;
-        if (!$this->query($sQuery))
+        $sQuery = $this->prepare("INSERT INTO `" . $this->_sTable . "` SET `initiator` = :initiator, `content` = :content, `added` = :added" . $sMutualField);
+        if (!$this->query($sQuery, array_merge($aBindings, array('initiator' => $iInitiator, 'content' => $iContent, 'added' => time()))))
             return false;
 
         if ($iMutual) // in case of mutual connection update 'mutual' field
@@ -193,7 +209,7 @@ class BxDolConnectionQuery extends BxDolDb
 
     protected function onModuleDeleteCustom ($sTable, $sFieldId, $sField = 'initiator', $sWhere = '')
     {
-        $sQuery = "DELETE `" . $this->_sTable . "` FROM `" . $this->_sTable . "` INNER JOIN `{$sTable}` WHERE `" . $this->_sTable . "`.`$sField` = `{$sTable}`.`{$sFieldId}` " . $sWhere;
+        $sQuery = $this->prepare("DELETE `" . $this->_sTable . "` FROM `" . $this->_sTable . "` INNER JOIN `{$sTable}` WHERE `" . $this->_sTable . "`.`$sField` = `{$sTable}`.`{$sFieldId}` " . $sWhere);
         return $this->query($sQuery);
     }
 

inc/classes/BxDolGrid.php

@@ -464,7 +464,7 @@ class BxDolGrid extends BxDol implements iBxDolFactoryObject, iBxDolReplaceable
         $sQuery .= $this->_getDataSqlOrderClause ($sOrderByFilter, $sOrderField, $sOrderDir);
 
 
-        $sQuery = $sQuery . $oDb->prepare(' LIMIT ?, ?', $iStart, $iPerPage);
+        $sQuery = $sQuery . $oDb->prepareAsString(' LIMIT ?, ?', $iStart, $iPerPage);
         return $oDb->getAll($sQuery);
     }
 
@@ -481,7 +481,7 @@ class BxDolGrid extends BxDol implements iBxDolFactoryObject, iBxDolReplaceable
                 // translatable fields
                 $iLang = BxDolLanguages::getInstance()->getCurrentLangId();
                 $oDb = BxDolDb::getInstance();
-                $sOrderClause = $oDb->prepare("ORDER BY (SELECT `s`.`string` FROM `sys_localization_strings` AS `s` INNER JOIN `sys_localization_keys` AS `k` ON (`k`.`ID` = `s`.`IDKey`) WHERE `k`.`KEY` = `$sOrderField` AND `s`.`IDLanguage` = ? LIMIT 1) ", $iLang) . $sDir;
+                $sOrderClause = $oDb->prepareAsString("ORDER BY (SELECT `s`.`string` FROM `sys_localization_strings` AS `s` INNER JOIN `sys_localization_keys` AS `k` ON (`k`.`ID` = `s`.`IDKey`) WHERE `k`.`KEY` = `$sOrderField` AND `s`.`IDLanguage` = ? LIMIT 1) ", $iLang) . $sDir;
 
             } else {
 

inc/classes/BxDolLanguagesQuery.php

@@ -79,36 +79,68 @@ class BxDolLanguagesQuery extends BxDolDb implements iBxDolSingleton
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare(" AND `tl`.`ID`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause .= " AND `tl`.`ID`=:id";
                 break;
+
             case 'by_name':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare(" AND `tl`.`Name`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
+                $sWhereClause .= " AND `tl`.`Name`=:name";
                 break;
+
             case 'default':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare(" AND `tl`.`Name`=?", getParam('lang_default'));
+                $aMethod['params'][1] = array(
+                	'name' => getParam('lang_default')
+                );
+
+                $sWhereClause .= " AND `tl`.`Name`=:name";
                 break;
+
             case 'active':
                 $sWhereClause = " AND `tl`.`Enabled`='1'";
                 break;
+
             case 'all':
                 $sOrderClause = " `tl`.`Name` ASC ";
                 break;
+
             case 'all_by_id':
-                $sWhereClause .= $this->prepare(" AND `tl`.`ID`=?", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause .= " AND `tl`.`ID`=:id";
                 $sOrderClause = " `tl`.`Name` ASC ";
                 break;
+
 			case 'all_by_name':
-                $sWhereClause .= $this->prepare(" AND `tl`.`Name`=?", $aParams['value']);
+				$aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
+                $sWhereClause .= " AND `tl`.`Name`=:name";
                 $sOrderClause = " `tl`.`Name` ASC ";
                 break;
+
             case 'all_key_id':
                 $aMethod['name'] = 'getAllWithKey';
                 $aMethod['params'][1] = 'id';
 
-                if(isset($aParams['language']) && (int)$aParams['language'] != 0)
-                    $sWhereClause .= $this->prepare(" AND `tl`.`ID`=?", $aParams['language']);
+                if(isset($aParams['language']) && (int)$aParams['language'] != 0) {
+                	$aMethod['params'][2] = array(
+	                	'id' => $aParams['language']
+	                );
+
+                    $sWhereClause .= " AND `tl`.`ID`=:id";
+                }
                 break;
         }
 
@@ -151,47 +183,73 @@ class BxDolLanguagesQuery extends BxDolDb implements iBxDolSingleton
                 $sJoinClause = " LEFT JOIN `sys_localization_categories` AS `tc` ON `tk`.`IDCategory`=`tc`.`ID` LEFT JOIN `sys_localization_strings` AS `ts` ON `tk`.`ID`=`ts`.`IDKey` LEFT JOIN `sys_localization_languages` AS `tl` ON `ts`.`IDLanguage`=`tl`.`ID` ";
                 $sWhereClause .= " AND `tk`.`ID` IN ('" . implode("','", $aParams['value']) . "')";
 
-                if(isset($aParams['language']) && (int)$aParams['language'] != 0)
-                    $sWhereClause .= $this->prepare(" AND `tl`.`ID`=?", $aParams['language']);
+                if(isset($aParams['language']) && (int)$aParams['language'] != 0) {
+                	$aMethod['params'][1] = array(
+	                	'id' => $aParams['language']
+	                );
+
+                    $sWhereClause .= " AND `tl`.`ID`=:id";
+                }
                 break;
 
             case 'by_name':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tk`.`Key`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'key' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tk`.`Key`=:key ";
                 break;
 
 			case 'by_language_name_key_key':
             	$aMethod['name'] = 'getAllWithKey';
             	$aMethod['params'][1] = 'key';
+            	$aMethod['params'][2] = array(
+                	'name' => $aParams['value']
+                );
 
                 $sSelectClause .= ", `ts`.`String` AS `string` ";
                 $sJoinClause = " LEFT JOIN `sys_localization_strings` AS `ts` ON `tk`.`ID`=`ts`.`IDKey` LEFT JOIN `sys_localization_languages` AS `tl` ON `ts`.`IDLanguage`=`tl`.`ID` ";
-                $sWhereClause = $this->prepare(" AND `tl`.`Name`=? ", $aParams['value']);
+                $sWhereClause = " AND `tl`.`Name`=:name ";
                 break;
 
             case 'by_language_id_key_key':
             	$aMethod['name'] = 'getAllWithKey';
             	$aMethod['params'][1] = 'key';
+            	$aMethod['params'][2] = array(
+                	'language_id' => (int)$aParams['value']
+                );
 
                 $sSelectClause .= ", `ts`.`String` AS `string` ";
                 $sJoinClause = " LEFT JOIN `sys_localization_strings` AS `ts` ON `tk`.`ID`=`ts`.`IDKey` ";
-                $sWhereClause = $this->prepare(" AND `ts`.`IDLanguage`=? ", (int)$aParams['value']);
+                $sWhereClause = " AND `ts`.`IDLanguage`=:language_id ";
                 break;
 
             case 'search':
                 $aMethod['name'] = 'getColumn';
+                $aMethod['params'][1] = array();
 
                 $sSelectClause = "DISTINCT `tk`.`ID` AS `id`";
                 $sJoinClause = " LEFT JOIN `sys_localization_categories` AS `tc` ON `tk`.`IDCategory`=`tc`.`ID` LEFT JOIN `sys_localization_strings` AS `ts` ON `tk`.`ID`=`ts`.`IDKey` LEFT JOIN `sys_localization_languages` AS `tl` ON `ts`.`IDLanguage`=`tl`.`ID` ";
 
-                if(isset($aParams['category']) && (int)$aParams['category'] != 0)
-                    $sWhereClause .= $this->prepare(" AND `tc`.`ID`=?", $aParams['category']);
+                if(isset($aParams['category']) && (int)$aParams['category'] != 0) {
+                	$aMethod['params'][1]['category_id'] = $aParams['category'];
+
+                    $sWhereClause .= " AND `tc`.`ID`=:category_id";
+                }
+
+                if(isset($aParams['language']) && (int)$aParams['language'] != 0) {
+                	$aMethod['params'][1]['language_id'] = $aParams['language'];
 
-                if(isset($aParams['language']) && (int)$aParams['language'] != 0)
-                    $sWhereClause .= $this->prepare(" AND `tl`.`ID`=?", $aParams['language']);
+                    $sWhereClause .= " AND `tl`.`ID`=:language_id";
+                }
 
-                if(isset($aParams['keyword']) && $aParams['keyword'] != '' && $aParams['keyword'] != _t('_adm_pgt_txt_keyword'))
-                    $sWhereClause .= $this->prepare(" AND (`tk`.`Key` LIKE ? OR `ts`.`String` LIKE ?)", '%' . $aParams['keyword'] . '%', '%' . $aParams['keyword'] . '%');
+                if(isset($aParams['keyword']) && $aParams['keyword'] != '' && $aParams['keyword'] != _t('_adm_pgt_txt_keyword')) {
+                	$aMethod['params'][1]['key'] = '%' . $aParams['keyword'] . '%';
+                	$aMethod['params'][1]['string'] = '%' . $aParams['keyword'] . '%';
+
+                    $sWhereClause .= " AND (`tk`.`Key` LIKE :key OR `ts`.`String` LIKE :string)";
+                }
 
                 $iStart = 0;
                 if(isset($aParams['start']) && (int)$aParams['start'] != 0)
@@ -201,7 +259,9 @@ class BxDolLanguagesQuery extends BxDolDb implements iBxDolSingleton
                 if(isset($aParams['length']) && (int)$aParams['length'] != 0)
                     $iLength = $aParams['length'];
 
-                $sLimitClause .= $this->prepare(" LIMIT ?, ?", $iStart, $iLength);
+				$aMethod['params'][1]['start'] = $iStart;
+				$aMethod['params'][1]['length'] = $iLength;
+                $sLimitClause .= " LIMIT :start, :length";
                 break;
 
             case 'counter_by_category':
@@ -241,13 +301,22 @@ class BxDolLanguagesQuery extends BxDolDb implements iBxDolSingleton
         switch($aParams['type']) {
             case 'id_by_name':
                 $aMethod['name'] = 'getOne';
+                $aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
                 $sSelectClause = "`tc`.`ID` AS `id`";
-                $sWhereClause = $this->prepare(" AND `tc`.`Name`=?", $aParams['value']);
+                $sWhereClause = " AND `tc`.`Name`=:name";
                 break;
             case 'by_name':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tc`.`Name`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tc`.`Name`=:name";
                 break;
+
             case 'all':
                 $sOrderClause = " `tc`.`Name` ASC ";
                 break;
@@ -277,16 +346,24 @@ class BxDolLanguagesQuery extends BxDolDb implements iBxDolSingleton
         switch($aParams['type']) {
             case 'by_key_language_id':
                 $aMethod['name'] = 'getRow';
+                $aMethod['params'][1] = array(
+                	'key' => $aParams['key'],
+                	'language_id' => $aParams['language_id']
+                );
+
                 $sJoinClause = "LEFT JOIN `sys_localization_keys` AS `tk` ON `ts`.`IDKey`=`tk`.`ID`";
-                $sWhereClause .= $this->prepare("AND `tk`.`Key`=? AND `ts`.`IDLanguage`=?", $aParams['key'], $aParams['language_id']);
+                $sWhereClause .= "AND `tk`.`Key`=:key AND `ts`.`IDLanguage`=:language_id";
                 break;
 
             case 'all_by_key_key_language_id':
                 $aMethod['name'] = 'getAllWithKey';
                 $aMethod['params'][1] = 'language_id';
+                $aMethod['params'][2] = array(
+                	'key' => $aParams['value']
+                );
 
                 $sJoinClause = "LEFT JOIN `sys_localization_keys` AS `tk` ON `ts`.`IDKey`=`tk`.`ID`";
-                $sWhereClause .= $this->prepare("AND `tk`.`Key`=?", $aParams['value']);
+                $sWhereClause .= "AND `tk`.`Key`=:key";
                 break;
         }
 

inc/classes/BxDolModuleQuery.php

@@ -105,25 +105,47 @@ class BxDolModuleQuery extends BxDolDb implements iBxDolSingleton
         switch($aParams['type']) {
             case 'modules':
                 $sPostfix .= '_modules';
-                $sWhereClause .= $this->prepare(" AND `type`=?", BX_DOL_MODULE_TYPE_MODULE);
+                $aMethod['params'][1] = array(
+                	'type' => BX_DOL_MODULE_TYPE_MODULE
+                );
+
+                $sWhereClause .= " AND `type`=:type";
                 break;
+
             case 'languages':
                 $sPostfix .= '_languages';
-                $sWhereClause .= $this->prepare(" AND `type`=?", BX_DOL_MODULE_TYPE_LANGUAGE);
+                $aMethod['params'][1] = array(
+                	'type' => BX_DOL_MODULE_TYPE_LANGUAGE
+                );
+
+                $sWhereClause .= " AND `type`=:type";
                 break;
+
             case 'templates':
                 $sPostfix .= '_templates';
-                $sWhereClause .= $this->prepare(" AND `type`=?", BX_DOL_MODULE_TYPE_TEMPLATE);
+                $aMethod['params'][1] = array(
+                	'type' => BX_DOL_MODULE_TYPE_TEMPLATE
+                );
+
+                $sWhereClause .= " AND `type`=?";
                 break;
+
             case 'path_and_uri':
             	$aMethod['name'] = 'getRow';
-            	$sWhereClause .= $this->prepare(" AND `path`=? AND `uri`=?", $aParams['path'], $aParams['uri']);
+            	$aMethod['params'][1] = array(
+                	'path' => $aParams['path'],
+            		'uri' => $aParams['uri']
+                );
+
+            	$sWhereClause .= " AND `path`=:path AND `uri`=:uri";
             	break;
         }
 
         if(isset($aParams['active'])) {
             $sPostfix .= "_active";
-            $sWhereClause .= $this->prepare(" AND `enabled`=?", (int)$aParams['active']);
+            $aMethod['params'][1]['enabled'] = (int)$aParams['active'];
+
+            $sWhereClause .= " AND `enabled`=:enabled";
         }
 
         $sOrderByClause = " ORDER BY " . (isset($aParams['order_by']) ? $aParams['order_by'] : '`title`');

inc/classes/BxDolPrivacyQuery.php

@@ -76,7 +76,7 @@ class BxDolPrivacyQuery extends BxDolDb
                 $sCacheFunction = 'fromCache';
                 $sCacheName = $this->_sCacheGroup . $aParams['id'];
                 $sMethod = 'getRow';
-                $sWhereClause = $this->prepare("`id`=?", (int)$aParams['id']);
+                $sWhereClause = $this->prepareAsString("`id`=?", (int)$aParams['id']);
                 break;
 
             case 'active':
@@ -159,7 +159,7 @@ class BxDolPrivacyQuery extends BxDolDb
         if(is_array($mixedGroupId))
             $sWhere = " AND `" . $this->_sTable . "`.`" . $sField . "` IN (" . $this->implode_escape($mixedGroupId) . ")";
         else
-            $sWhere = $this->prepare(" AND `" . $this->_sTable . "`.`" . $sField . "` = ?", $mixedGroupId);
+            $sWhere = $this->prepareAsString(" AND `" . $this->_sTable . "`.`" . $sField . "` = ?", $mixedGroupId);
 
         return array(
             'where' => $sWhere

inc/classes/BxDolSearch.php

@@ -683,7 +683,7 @@ class BxDolSearchResult implements iBxDolReplaceable
                             $sqlCondition .= strtoupper($aValue['operator']) . '('.$sValuesString.')';
                             break;
                        default:
-                               $sqlCondition .= $aValue['operator'] . (isset($aValue['no_quote_value']) && $aValue['no_quote_value'] ?  $aValue['value'] : "'" . $oDb->escape($aValue['value']) . "'");
+                               $sqlCondition .= $aValue['operator'] . (isset($aValue['no_quote_value']) && $aValue['no_quote_value'] ?  $aValue['value'] : $oDb->escape($aValue['value']));
                        break;
                     }
                 }

inc/classes/BxDolSessionQuery.php

@@ -32,12 +32,13 @@ class BxDolSessionQuery extends BxDolDb
     }
     function save($sId, $aSet)
     {
-        $sSetClause = $this->prepare("`id`=?", $sId);
+        $sSetClause = "`id`=:id";
         foreach($aSet as $sKey => $sValue)
-            $sSetClause .= $this->prepare(", `" . $sKey . "`=?", $sValue);
+            $sSetClause .= ", `" . $sKey . "`=:" . $sKey;
         $sSetClause .= ", `date`=UNIX_TIMESTAMP()";
 
-        return (int)$this->query("REPLACE INTO `" . $this->sTable . "` SET " . $sSetClause) > 0;
+        $sSql = $this->prepare("REPLACE INTO `" . $this->sTable . "` SET " . $sSetClause);
+        return (int)$this->query($sSql, array_merge(array('id' => $sId), $aSet)) > 0;
     }
     function delete($sId)
     {

inc/classes/BxDolStorageQuery.php

@@ -134,13 +134,20 @@ class BxDolStorageQuery extends BxDolDb
 
     public function modifyCustomField($iFileId, $sField, $sValue, $isUpdateModifiedField = true)
     {
+    	$aBindings = array(
+    		$sField => $sValue,
+    		'id' => $iFileId
+    	);
+    	
         $sAdd = '';
         if ($isUpdateModifiedField) {
-            $iTime = time();
-            $sAdd = $this->prepare(", `modified` = ?", $iTime);
+        	$aBindings['modified'] = time();
+
+            $sAdd = ", `modified` = :modified";
         }
-        $sQuery = $this->prepare("UPDATE " . $this->_sTableFiles . " SET `{$sField}` = ? {$sAdd} WHERE `id` = ?", $sValue, $iFileId);
-        return $this->query($sQuery);
+
+        $sQuery = $this->prepare("UPDATE " . $this->_sTableFiles . " SET `{$sField}` = :{$sField} {$sAdd} WHERE `id` = :id");
+        return $this->query($sQuery, $aBindings);
     }
 
     public function deleteFile($iFileId)
@@ -218,17 +225,23 @@ class BxDolStorageQuery extends BxDolDb
 
     public function updateGhostsContentId($mixedFileIds, $iProfileId, $iContentId)
     {
-        $sQuery = $this->prepare("UPDATE `sys_storage_ghosts` SET `content_id` = ? WHERE `profile_id` = ? AND `object` = ?", $iContentId, $iProfileId, $this->_aObject['object']);
-        $sQuery .= " AND `id` IN (" . $this->implode_escape($mixedFileIds) . ")";
+        $sQuery = $this->prepare("UPDATE `sys_storage_ghosts` SET `content_id` = ? WHERE `profile_id` = ? AND `object` = ? AND `id` IN (" . $this->implode_escape($mixedFileIds) . ")", $iContentId, $iProfileId, $this->_aObject['object']);
         return $this->res($sQuery);
     }
 
     public function deleteGhosts($mixedFileIds, $iProfileId, $iContentId = false)
     {
-        $sQuery = $this->prepare("DELETE FROM `sys_storage_ghosts` WHERE `profile_id` = ? AND `object` = ? AND `id` IN (" . $this->implode_escape($mixedFileIds) . ")", $iProfileId, $this->_aObject['object']);
-        if (false !== $iContentId)
-            $sQuery .= $this->prepare(" AND `content_id` = ?", $iContentId);
-        $iCount = $this->query($sQuery);
+    	$aBindings = array(
+    		'profile_id' => $iProfileId,
+    		'object' => $this->_aObject['object']
+    	);
+        $sQuery = "DELETE FROM `sys_storage_ghosts` WHERE `profile_id` = :profile_id AND `object` = :object AND `id` IN (" . $this->implode_escape($mixedFileIds) . ")";
+        if (false !== $iContentId) {
+        	$aBindings['content_id'] = $iContentId;
+
+            $sQuery .= " AND `content_id` = :content_id";
+        }
+        $iCount = $this->query($sQuery, $aBindings);
         if ($iCount)
             $this->query("OPTIMIZE TABLE `sys_storage_ghosts`");
         return $iCount;
@@ -247,15 +260,31 @@ class BxDolStorageQuery extends BxDolDb
 
     public function getFiles($iProfileId, $isGhostsOnly = false, $iContentId = false)
     {
+        $aBindings = array();
+
         $sJoin = '';
         if ($isGhostsOnly) {
-            $sJoin .= $this->prepare(" INNER JOIN `sys_storage_ghosts` AS `g` ON (`f`.`id` = `g`.`id` AND `g`.`profile_id` = ? AND `g`.`object` = ? ", $iProfileId, $this->_aObject['object']);
-            if (false !== $iContentId)
-                $sJoin .= $this->prepare(" AND `g`.`content_id` = ?", $iContentId);
+        	$aBindings['profile_id'] = $iProfileId;
+        	$aBindings['object'] = $this->_aObject['object'];
+
+            $sJoin .= " INNER JOIN `sys_storage_ghosts` AS `g` ON (`f`.`id` = `g`.`id` AND `g`.`profile_id` = :profile_id AND `g`.`object` = :object ";
+            if (false !== $iContentId) {
+            	$aBindings['content_id'] = $iContentId;
+
+                $sJoin .= " AND `g`.`content_id` = :content_id";
+            }
             $sJoin .= ')';
         }
-        $sQuery = "SELECT `f`.* FROM " . $this->_sTableFiles . " AS `f` " . $sJoin . (false === $iProfileId ? '' : $this->prepare("WHERE `f`.`profile_id` = ?", $iProfileId));
-        return $this->getAll($sQuery);
+
+        $sWhere = '';
+        if(false !== $iProfileId) {
+        	$aBindings['profile_id'] = $iProfileId;
+
+        	$sWhere = "WHERE `f`.`profile_id` = :profile_id";
+        }
+
+        $sQuery = "SELECT `f`.* FROM " . $this->_sTableFiles . " AS `f` " . $sJoin . $sWhere;
+        return $this->getAll($sQuery, $aBindings);
     }
 
     public function getFilesAll($iStart, $iPerPage)

inc/classes/BxDolViewQuery.php

@@ -26,13 +26,21 @@ class BxDolViewQuery extends BxDolObjectQuery
     {
         $iAuthorNip = ip2long($sAuthorIp);
 
-        if($iAuthorId)
-            $sWhere = $this->prepare(" AND `viewer_id` = ? ", $iAuthorId);
-        else
+        $aBindings = array(
+        	'object_id' => $iObjectId
+        );
+        if($iAuthorId) {
+        	$aBindings['viewer_id'] = $iAuthorId;
+
+            $sWhere = " AND `viewer_id` = :viewer_id ";
+        }
+        else {
+        	$aBindings['viewer_nip'] = $iAuthorNip;
+
             $sWhere = $this->prepare(" AND `viewer_id` = '0' AND `viewer_nip` = ? ", $iAuthorNip);
+        }
 
-        $sQuery = $this->prepare("SELECT `date` FROM `{$this->_sTableTrack}` WHERE `object_id` = ? $sWhere", $iObjectId);
-        $iDate = (int)$this->getOne($sQuery);
+        $iDate = (int)$this->getOne("SELECT `date` FROM `{$this->_sTableTrack}` WHERE `object_id` = :object_id " . $sWhere, $aBindings);
         $iDateNow = time();
 
         if(!$iDate) {

modules/base/text/classes/BxBaseModTextGridAdministration.php

@@ -50,7 +50,7 @@ class BxBaseModTextGridAdministration extends BxBaseModGeneralGridAdministration
             list($this->_sFilter1Value, $sFilter) = explode($this->_sParamsDivider, $sFilter);
 
     	if(!empty($this->_sFilter1Value))
-        	$this->_aOptions['source'] .= $this->_oModule->_oDb->prepare(" AND `status`=?", $this->_sFilter1Value);
+        	$this->_aOptions['source'] .= $this->_oModule->_oDb->prepareAsString(" AND `status`=?", $this->_sFilter1Value);
 
         return parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
     }

modules/base/text/classes/BxBaseModTextGridCommon.php

@@ -20,7 +20,7 @@ class BxBaseModTextGridCommon extends BxBaseModTextGridAdministration
 
     protected function _getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage)
     {
-		$this->_aOptions['source'] .= $this->_oModule->_oDb->prepare(" AND `author`=?", bx_get_logged_profile_id());
+		$this->_aOptions['source'] .= $this->_oModule->_oDb->prepareAsString(" AND `author`=?", bx_get_logged_profile_id());
 
         return parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
     }

modules/boonex/market/classes/BxMarketDb.php

@@ -92,11 +92,19 @@ class BxMarketDb extends BxBaseModTextDb
         switch($aParams['type']) {
             case 'id':
             	$aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tl`.`id`=?", $aParams['id']);
+            	$aMethod['params'][1] = array(
+                	'id' => $aParams['id']
+                );
+
+                $sWhereClause = " AND `tl`.`id`=:id";
                 break;
 
 			case 'unused':
-                $sWhereClause = $this->prepare(" AND `tl`.`profile_id`=? AND `tl`.`domain`=''", $aParams['profile_id']);
+				$aMethod['params'][1] = array(
+                	'profile_id' => $aParams['profile_id']
+                );
+
+                $sWhereClause = " AND `tl`.`profile_id`=:profile_id AND `tl`.`domain`=''";
                 break;
         }
 
@@ -159,14 +167,19 @@ class BxMarketDb extends BxBaseModTextDb
 	protected function _deassociateAttachmentWithContent($sTable, $iContentId, $iFileId)
     {
         $sWhere = '';
-        if ($iContentId)
-            $sWhere .= $this->prepare (" AND `content_id` = ? ", $iContentId);
+        $aBindings = array();
+        if ($iContentId) {
+            $sWhere .= " AND `content_id` = :content_id ";
+            $aBindings['content_id'] = $iContentId;
+        }
 
-        if ($iFileId)
-            $sWhere .= $this->prepare (" AND `file_id` = ? ", $iFileId);
+        if ($iFileId) {
+            $sWhere .= " AND `file_id` = :file_id ";
+            $aBindings['file_id'] = $iFileId;
+        }
 
-        $sQuery = "DELETE FROM `" . $sTable . "` WHERE 1 ";
-        return $this->query($sQuery . $sWhere);
+        $sQuery = "DELETE FROM `" . $sTable . "` WHERE 1 " . $sWhere;
+        return $this->query($sQuery, $aBindings);
     }
 
 	protected function _getAttachment($sTable, $aParams = array())
@@ -176,17 +189,28 @@ class BxMarketDb extends BxBaseModTextDb
     	$sWhereClause = "";
         switch($aParams['type']) {
             case 'id':
-                $sWhereClause = $this->prepare(" AND `tfe`.`id`=?", $aParams['id']);
+            	$aMethod['params'][1] = array(
+                	'id' => $aParams['id']
+                );
+
+                $sWhereClause = " AND `tfe`.`id`=:id";
                 break;
 
 			case 'file_id':
-                $sWhereClause = $this->prepare(" AND `tfe`.`file_id`=?", $aParams['file_id']);
+				$aMethod['params'][1] = array(
+                	'file_id' => $aParams['file_id']
+                );
+
+                $sWhereClause = " AND `tfe`.`file_id`=:file_id";
                 break;
 
             case 'content_id':
             	$aMethod['name'] = 'getAll';
+            	$aMethod['params'][1] = array(
+                	'content_id' => $aParams['content_id']
+                );
 
-            	$sWhereClause = $this->prepare(" AND `tfe`.`content_id`=?", $aParams['content_id']);
+            	$sWhereClause = " AND `tfe`.`content_id`=:content_id";
             	if(!empty($aParams['except']))
             		$sWhereClause .= " AND `tfe`.`file_id` NOT IN (" . $this->implode_escape($aParams['except']) . ")";
 
@@ -195,8 +219,11 @@ class BxMarketDb extends BxBaseModTextDb
 			case 'content_id_key_file_id':
 				$aMethod['name'] = 'getAllWithKey';
 				$aMethod['params'][1] = 'file_id';
+				$aMethod['params'][2] = array(
+                	'content_id' => $aParams['content_id']
+                );
 
-                $sWhereClause = $this->prepare(" AND `tfe`.`content_id`=?", $aParams['content_id']);
+                $sWhereClause = " AND `tfe`.`content_id`=?";
                 break;
         }
 

modules/boonex/market/classes/BxMarketGridLicenses.php

@@ -84,7 +84,7 @@ class BxMarketGridLicenses extends BxTemplGrid
 		if(empty($this->_aQueryAppend['profile_id']))
 			return array();
 
-		$this->_aOptions['source'] .= $this->_oModule->_oDb->prepare(" AND `tl`.`profile_id`=?", $this->_aQueryAppend['profile_id']);
+		$this->_aOptions['source'] .= $this->_oModule->_oDb->prepareAsString(" AND `tl`.`profile_id`=?", $this->_aQueryAppend['profile_id']);
 
         return parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
     }

modules/boonex/notifications/classes/BxNtfsDb.php

@@ -33,7 +33,7 @@ class BxNtfsDb extends BxBaseModNotificationsDb
 		$sJoinClause = $sWhereClause = "";
 
 		if(isset($aParams['active']))
-			$sWhereClause .= $this->prepare("AND `{$this->_sTable}`.`active`=? ", (int)$aParams['active']);
+			$sWhereClause .= $this->prepareAsString("AND `{$this->_sTable}`.`active`=? ", (int)$aParams['active']);
 
 		//--- Apply modules or handlers filter
 		$sWhereModuleFilter = '';
@@ -53,7 +53,7 @@ class BxNtfsDb extends BxBaseModNotificationsDb
 			$sSql = $this->prepare("SELECT `event_id` FROM `" . $this->_sTableEvt2Usr . "` WHERE `user_id`=? LIMIT 1", (int)$aParams['owner_id']);
 			$iId = (int)$this->getOne($sSql);
 
-			$sWhereClause .= $this->prepare("AND `{$this->_sTable}`.`id`>? ", $iId);
+			$sWhereClause .= $this->prepareAsString("AND `{$this->_sTable}`.`id`>? ", $iId);
 		}
 
 		//--- Apply privacy filter
@@ -65,11 +65,11 @@ class BxNtfsDb extends BxBaseModNotificationsDb
 		if(!empty($aParams['owner_id']))
 			switch($aParams['type']) {
 				case BX_BASE_MOD_NTFS_TYPE_OWNER:
-					$sWhereClause .= $this->prepare("AND `{$this->_sTable}`.`owner_id`=? ", $aParams['owner_id']);
+					$sWhereClause .= $this->prepareAsString("AND `{$this->_sTable}`.`owner_id`=? ", $aParams['owner_id']);
 					break;
 
 				case BX_BASE_MOD_NTFS_TYPE_OBJECT_OWNER:
-					$sWhereClause .= $this->prepare("AND `{$this->_sTable}`.`owner_id`<>`{$this->_sTable}`.`object_owner_id` AND `{$this->_sTable}`.`object_owner_id`=? ", $aParams['owner_id']);
+					$sWhereClause .= $this->prepareAsString("AND `{$this->_sTable}`.`owner_id`<>`{$this->_sTable}`.`object_owner_id` AND `{$this->_sTable}`.`object_owner_id`=? ", $aParams['owner_id']);
 					break;
 
 				case BX_BASE_MOD_NTFS_TYPE_CONNECTIONS:

modules/boonex/timeline/classes/BxTimelineDb.php

@@ -199,15 +199,20 @@ class BxTimelineDb extends BxBaseModNotificationsDb
     //--- Link attach related methods ---//
     public function getUnusedLinks($iUserId, $iLinkId = 0)
     {
-        $sMethod = 'getAll';
+        $aMethod = array('name' => 'getAll', 'params' => array(0 => 'query'));
+        $aMethod['params'][1] = array(
+			'profile_id' => $iUserId
+		);
 
         $sWhereAddon = '';
         if(!empty($iLinkId)) {
-            $sMethod = 'getRow';
-            $sWhereAddon = $this->prepare(" AND `tl`.`id`=?", $iLinkId);
+            $aMethod['name'] = 'getRow';
+            $aMethod['params'][1]['id'] = $iLinkId;
+
+            $sWhereAddon = " AND `tl`.`id`=:id";
         }
 
-        $sQuery = $this->prepare("SELECT
+        $aMethod['params'][0] = "SELECT
                 `tl`.`id` AS `id`,
                 `tl`.`profile_id` AS `profile_id`,
                 `tl`.`media_id` AS `media_id`,
@@ -217,20 +222,26 @@ class BxTimelineDb extends BxBaseModNotificationsDb
                 `tl`.`added` AS `added`
             FROM `" . $this->_sPrefix . "links` AS `tl`
             LEFT JOIN `" . $this->_sPrefix . "links2events` AS `tle` ON `tl`.`id`=`tle`.`link_id`
-            WHERE `tl`.`profile_id`=? AND ISNULL(`tle`.`event_id`)" . $sWhereAddon . "
-            ORDER BY `tl`.`added` DESC", $iUserId);
+            WHERE `tl`.`profile_id`=:profile_id AND ISNULL(`tle`.`event_id`)" . $sWhereAddon . "
+            ORDER BY `tl`.`added` DESC";
 
-        return $this->$sMethod($sQuery);
+        return call_user_func_array(array($this, $aMethod['name']), $aMethod['params']);;
     }
 
     public function deleteUnusedLinks($iUserId, $iLinkId = 0)
     {
+    	$aBindings = array(
+    		'profile_id' => $iUserId
+    	);
+
         $sWhereAddon = '';
-        if(!empty($iLinkId))
-            $sWhereAddon = $this->prepare(" AND `id`=?", $iLinkId);
+        if(!empty($iLinkId)) {
+        	$aBindings['id'] = $iLinkId;
+
+            $sWhereAddon = " AND `id`=:id";
+        }
 
-        $sQuery = $this->prepare("DELETE FROM `" . $this->_sPrefix . "links` WHERE `profile_id`=?" . $sWhereAddon, $iUserId);
-        return $this->query($sQuery);
+        return $this->query("DELETE FROM `" . $this->_sPrefix . "links` WHERE `profile_id`=:profile_id" . $sWhereAddon);
     }
 
     public function saveLink($iEventId, $iLinkId)
@@ -266,10 +277,10 @@ class BxTimelineDb extends BxBaseModNotificationsDb
     {
         switch($sFilter) {
             case BX_TIMELINE_FILTER_OWNER:
-                $sFilterAddon = " AND `{$this->_sTable}`.`action`='' AND `{$this->_sTable}`.`object_id`='" . $iOwnerId . "' ";
+                $sFilterAddon = $this->prepareAsString(" AND `{$this->_sTable}`.`action`='' AND `{$this->_sTable}`.`object_id`=? ", $iOwnerId);
                 break;
             case BX_TIMELINE_FILTER_OTHER:
-                $sFilterAddon = " AND `{$this->_sTable}`.`action`='' AND `{$this->_sTable}`.`object_id`<>'" . $iOwnerId . "' ";
+                $sFilterAddon = $this->prepareAsString(" AND `{$this->_sTable}`.`action`='' AND `{$this->_sTable}`.`object_id`<>? ", $iOwnerId);
                 break;
             case BX_TIMELINE_FILTER_ALL:
             default:
@@ -285,12 +296,12 @@ class BxTimelineDb extends BxBaseModNotificationsDb
 
         switch($aParams['browse']) {
         	case 'owner_id':
-        		$sWhereClause = $this->prepare("AND `{$this->_sTable}`.`owner_id`=? ", $aParams['value']);
+        		$sWhereClause = $this->prepareAsString("AND `{$this->_sTable}`.`owner_id`=? ", $aParams['value']);
         		break;
 
         	case 'common_by_object':
         		$sCommonPostPrefix = $this->_oConfig->getPrefix('common_post');
-        		$sWhereClause = $this->prepare("AND SUBSTRING(`{$this->_sTable}`.`type`, 1, " . strlen($sCommonPostPrefix) . ")='" . $sCommonPostPrefix . "' AND `{$this->_sTable}`.`object_id`=? ", $aParams['value']);
+        		$sWhereClause = $this->prepareAsString("AND SUBSTRING(`{$this->_sTable}`.`type`, 1, " . strlen($sCommonPostPrefix) . ")='" . $sCommonPostPrefix . "' AND `{$this->_sTable}`.`object_id`=? ", $aParams['value']);
         		break;
 
             case 'descriptor':
@@ -298,11 +309,11 @@ class BxTimelineDb extends BxBaseModNotificationsDb
                 $sWhereClause = "";
 
                 if(isset($aParams['type']))
-                	$sWhereClause .= $this->prepare("AND `{$this->_sTable}`.`type`=? ", $aParams['type']);
+                	$sWhereClause .= $this->prepareAsString("AND `{$this->_sTable}`.`type`=? ", $aParams['type']);
 				if(isset($aParams['action']))
-					$sWhereClause .= $this->prepare("AND `{$this->_sTable}`.`action`=? ", $aParams['action']);
+					$sWhereClause .= $this->prepareAsString("AND `{$this->_sTable}`.`action`=? ", $aParams['action']);
 				if(isset($aParams['object_id']))
-					$sWhereClause .= $this->prepare("AND `{$this->_sTable}`.`object_id`=? ", $aParams['object_id']);
+					$sWhereClause .= $this->prepareAsString("AND `{$this->_sTable}`.`object_id`=? ", $aParams['object_id']);
 
 				$sLimitClause = "LIMIT 1";
                 break;
@@ -311,10 +322,10 @@ class BxTimelineDb extends BxBaseModNotificationsDb
             	$sWhereClause = "";
 
             	if(isset($aParams['type']))
-                	$sWhereClause .= "AND `{$this->_sTable}`.`content` LIKE '%" . $this->escape($aParams['type']) . "%'";
+                	$sWhereClause .= "AND `{$this->_sTable}`.`content` LIKE " . $this->escape('%' . $aParams['type'] . '%');
 
                 if(isset($aParams['action']))
-                	$sWhereClause .= "AND `{$this->_sTable}`.`content` LIKE '%" . $this->escape($aParams['action']) . "%'";
+                	$sWhereClause .= "AND `{$this->_sTable}`.`content` LIKE " . $this->escape('%' . $aParams['action'] . '%');
                 break;
 
             default:
@@ -332,7 +343,7 @@ class BxTimelineDb extends BxBaseModNotificationsDb
     	$sWhereClause = "AND `{$this->_sTable}`.`hidden`='0' ";
 
 		if(isset($aParams['active']))
-        	$sWhereClause .= $this->prepare("AND `{$this->_sTable}`.`active`=? ", (int)$aParams['active']);
+        	$sWhereClause .= $this->prepareAsString("AND `{$this->_sTable}`.`active`=? ", (int)$aParams['active']);
 
 		//--- Apply filter
         if(isset($aParams['filter']))
@@ -341,7 +352,7 @@ class BxTimelineDb extends BxBaseModNotificationsDb
 		//--- Apply timeline
         if(isset($aParams['timeline']) && !empty($aParams['timeline'])) {
         	$iYear = (int)$aParams['timeline'];
-            $sWhereClause .= $this->prepare("AND `date`<=? ", mktime(23, 59, 59, 12, 31, $iYear));
+            $sWhereClause .= $this->prepareAsString("AND `date`<=? ", mktime(23, 59, 59, 12, 31, $iYear));
 		}
 
 		//--- Apply modules or handlers filter
@@ -368,7 +379,7 @@ class BxTimelineDb extends BxBaseModNotificationsDb
 				if(empty($aParams['owner_id']))
 					break;
 
-				$sWhereClause .= $this->prepare("AND `{$this->_sTable}`.`owner_id`=? ", $aParams['owner_id']);
+				$sWhereClause .= $this->prepareAsString("AND `{$this->_sTable}`.`owner_id`=? ", $aParams['owner_id']);
 				break;
 
 			case BX_BASE_MOD_NTFS_TYPE_CONNECTIONS:
@@ -383,7 +394,7 @@ class BxTimelineDb extends BxBaseModNotificationsDb
 				$iUserId = bx_get_logged_profile_id();
 				$sCommonPostPrefix = $this->_oConfig->getPrefix('common_post');
 
-				$sWhereClause .= "AND IF(SUBSTRING(`{$this->_sTable}`.`type`, 1, " . strlen($sCommonPostPrefix) . ") = '" . $sCommonPostPrefix . "', `{$this->_sTable}`.`object_id` <> " . $iUserId . ", 1) ";
+				$sWhereClause .= $this->prepareAsString("AND IF(SUBSTRING(`{$this->_sTable}`.`type`, 1, " . strlen($sCommonPostPrefix) . ") = '" . $sCommonPostPrefix . "', `{$this->_sTable}`.`object_id` <> ?, 1) ", $iUserId);
 				break;
 
 			case BX_BASE_MOD_NTFS_TYPE_PUBLIC:
@@ -409,30 +420,42 @@ class BxTimelineDb extends BxBaseModNotificationsDb
         if(isset($aHandler['group_by']) && !empty($aHandler['group_by']) && (!isset($oAlert->aExtras[$aHandler['group_by']]) || empty($oAlert->aExtras[$aHandler['group_by']])))
             return false;
 
+		$aBindings = array(
+			'object_id' => $oAlert->iObject,
+			'id' => $iId,
+			'owner_id' => $oAlert->iSender,
+			'type' => $sType,
+			'action' => $sAction
+		);
+
         $sWhereClause = "";
         switch($sDuration) {
             case 'day':
-                $iDayStart  = mktime(0, 0, 0, date('m'), date('d'), date('Y'));
-                $iDayEnd  = mktime(23, 59, 59, date('m'), date('d'), date('Y'));
-                $sWhereClause .= "AND `date`>" . $iDayStart . " AND `date`<" . $iDayEnd . " ";
+                $aBindings['day_start'] = mktime(0, 0, 0, date('m'), date('d'), date('Y'));
+                $aBindings['day_end'] = mktime(23, 59, 59, date('m'), date('d'), date('Y'));
+
+                $sWhereClause .= "AND `date`>:day_start AND `date`<:day_end ";
                 break;
         }
 
-        if(isset($aHandler['group_by']))
-            $sWhereClause .= "AND `content` LIKE '%" . $oAlert->aExtras[$aHandler['group_by']] . "%' ";
+        if(isset($aHandler['group_by'])) {
+        	$aBindings['content'] = '%' . $oAlert->aExtras[$aHandler['group_by']] . '%';
+
+            $sWhereClause .= "AND `content` LIKE :content ";
+        }
 
         $sSql = "UPDATE `{$this->_sTable}`
             SET
-                `object_id`=CONCAT(`object_id`, '," . $oAlert->iObject . "'),
+                `object_id`=CONCAT(`object_id`, ',:object_id'),
                 `title`='',
                 `description`='',
                 `date`=UNIX_TIMESTAMP()
             WHERE
-                `id`<>'" . $iId . "' AND
-                `owner_id`='" . $oAlert->iSender . "' AND
-                `type`='" . $sType . "' AND
-                `action`='" . $sAction . "' " . $sWhereClause;
-        $mixedResult = $this->query($sSql);
+                `id`<>:id AND
+                `owner_id`=:owner_id AND
+                `type`=:type AND
+                `action`=:action " . $sWhereClause;
+        $mixedResult = $this->query($sSql, $aBindings);
 
         if((int)$mixedResult > 0)
             $this->deleteEvent(array('id' => $iId));

studio/classes/BxDolStudioBuilderPageQuery.php

@@ -25,21 +25,40 @@ class BxDolStudioBuilderPageQuery extends BxDolStudioPageQuery
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tp`.`id`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tp`.`id`=:id ";
                 break;
             case 'by_object':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tp`.`object`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'object' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tp`.`object`=:object ";
                 break;
+
             case 'by_object_full':
                 $aMethod['name'] = 'getRow';
+                $aMethod['params'][1] = array(
+                	'object' => $aParams['value']
+                );
+
                 $sSelectClause = ", `tpl`.`name` AS `layout_name`, `tpl`.`icon` AS `layout_icon`, `tpl`.`title` AS `layout_title`, `tpl`.`template` AS `layout_template`, `tpl`.`cells_number` AS `layout_cells_number`";
                 $sJoinClause = "LEFT JOIN `sys_pages_layouts` AS `tpl` ON `tp`.`layout_id`=`tpl`.`id`";
-                $sWhereClause = $this->prepare(" AND `tp`.`object`=? ", $aParams['value']);
+                $sWhereClause = " AND `tp`.`object`=:object ";
                 break;
+
             case 'by_module':
-                $sWhereClause = $this->prepare(" AND `tp`.`module`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'module' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tp`.`module`=:module ";
                 break;
+
             case 'all':
                 break;
         }
@@ -86,11 +105,21 @@ class BxDolStudioBuilderPageQuery extends BxDolStudioPageQuery
 
         switch($aParams['type']) {
             case 'by_id':
-                $sWhereClause = $this->prepare("AND `tp`.`id`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tp`.`id`=:id ";
                 break;
+
             case 'by_object':
-                $sWhereClause = $this->prepare("AND `tp`.`object`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'object' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tp`.`object`=? ";
                 break;
+
             case 'all':
                 break;
         }
@@ -116,8 +145,13 @@ class BxDolStudioBuilderPageQuery extends BxDolStudioPageQuery
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare("AND `tpl`.`id`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tpl`.`id`=:id ";
                 break;
+
             case 'all':
                 break;
         }
@@ -150,11 +184,17 @@ class BxDolStudioBuilderPageQuery extends BxDolStudioPageQuery
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare("AND `tpd`.`id`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tpd`.`id`=:id ";
                 break;
+
             case 'ordered':
                 $sWhereClause = "AND `tpd`.`order`<>0 ";
                 break;
+
             case 'all':
                 break;
         }
@@ -195,28 +235,56 @@ class BxDolStudioBuilderPageQuery extends BxDolStudioPageQuery
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare("AND `tpb`.`id`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tpb`.`id`=:id ";
                 break;
+
             case 'skeleton_by_type':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare("AND `tpb`.`object`='' AND `tpb`.`module`=? AND `tpb`.`type`=? ", BX_DOL_STUDIO_BP_SKELETONS, $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'module' => BX_DOL_STUDIO_BP_SKELETONS,
+                	'type' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tpb`.`object`='' AND `tpb`.`module`=:module AND `tpb`.`type`=:type ";
                 break;
+
             case 'by_ids':
                 $sWhereClause = "AND `tpb`.`id` IN ('" . implode("','", array_fill(0, count($aParams['value']), '?')) . "')";
                 $sWhereClause = call_user_func_array(array($this, 'prepare'), array_merge(array($sWhereClause), $aParams['value']));
                 break;
+
             case 'by_object':
-                $sWhereClause = $this->prepare("AND `tpb`.`object`=?", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'object' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tpb`.`object`=?";
                 break;
+
             case 'by_object_cell':
-                $sWhereClause = $this->prepare("AND `tpb`.`object`=? AND `tpb`.`cell_id`=?", $aParams['object'], $aParams['cell']);
+            	$aMethod['params'][1] = array(
+                	'object' => $aParams['object'],
+            		'cell_id' => $aParams['cell']
+                );
+
+                $sWhereClause = "AND `tpb`.`object`=:object AND `tpb`.`cell_id`=:cell_id";
                 break;
+
             case 'by_module_to_copy':
-                $sWhereClause = $this->prepare("AND `tpb`.`module`=? AND `tpb`.`copyable`=1", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'module' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tpb`.`module`=:module AND `tpb`.`copyable`=1";
 
                 if($aParams['value'] == BX_DOL_STUDIO_BP_SKELETONS)
                     $sWhereClause .= " AND `tpb`.`object`=''";
                 break;
+
             case 'counter_by_pages':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'object';
@@ -224,6 +292,7 @@ class BxDolStudioBuilderPageQuery extends BxDolStudioPageQuery
                 $sSelectClause = ", COUNT(*) AS `counter`";
                 $sGroupClause = "GROUP BY `tpb`.`object`";
                 break;
+
             case 'all':
                 break;
         }
@@ -276,11 +345,21 @@ class BxDolStudioBuilderPageQuery extends BxDolStudioPageQuery
 
         switch($aParams['type']) {
             case 'by_id':
-                $sWhereClause = $this->prepare("AND `tpb`.`id`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tpb`.`id`=:id ";
                 break;
+
             case 'by_object':
-                $sWhereClause = $this->prepare("AND `tpb`.`object`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'object' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tpb`.`object`=:object ";
                 break;
+
             case 'all':
                 break;
         }
@@ -307,8 +386,13 @@ class BxDolStudioBuilderPageQuery extends BxDolStudioPageQuery
 
         switch($aParams['type']) {
             case 'by_id':
-                $sWhereClause = $this->prepare("AND `tpb`.`id`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tpb`.`id`=:id ";
                 break;
+
             case 'all':
                 break;
         }

studio/classes/BxDolStudioDashboardQuery.php

@@ -16,7 +16,7 @@ class BxDolStudioDashboardQuery extends BxDolStudioPageQuery
 
     function getModuleStorageSize($sModule)
     {
-    	$sSql = "SELECT SUM(`current_size`) AS `size` FROM `sys_objects_storage` WHERE `object` LIKE '" . $this->escape($sModule) . "%' LIMIT 1";
+    	$sSql = "SELECT SUM(`current_size`) AS `size` FROM `sys_objects_storage` WHERE `object` LIKE " . $this->escape($sModule . '%') . " LIMIT 1";
     	return $this->getOne($sSql);
     }
 }

studio/classes/BxDolStudioFormsForms.php

@@ -23,7 +23,7 @@ class BxDolStudioFormsForms extends BxTemplStudioGrid
             list($sModule, $sFilter) = explode($this->sParamsDivider, $sFilter);
 
         if($sModule != '')
-            $this->_aOptions['source'] .= $this->oDb->prepare(" AND `module`=?", $sModule);
+            $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `module`=?", $sModule);
 
         return parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
     }

studio/classes/BxDolStudioFormsPreLists.php

@@ -23,7 +23,7 @@ class BxDolStudioFormsPreLists extends BxTemplStudioGrid
             list($sModule, $sFilter) = explode($this->sParamsDivider, $sFilter);
 
         if($sModule != '')
-            $this->_aOptions['source'] .= $this->oDb->prepare(" AND `module`=?", $sModule);
+            $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `module`=?", $sModule);
 
         $aResults = parent::_getDataSql($sFilter, !empty($sOrderField) ? $sOrderField : 'title', $sOrderDir, $iStart, $iPerPage);
 

studio/classes/BxDolStudioFormsPreValues.php

@@ -38,7 +38,7 @@ class BxDolStudioFormsPreValues extends BxTemplStudioGrid
         if(empty($this->sList))
             return array();
 
-        $this->_aOptions['source'] .= $this->oDb->prepare(" AND `Key`=? ", $this->sList);
+        $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `Key`=? ", $this->sList);
         return parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
     }
 }

studio/classes/BxDolStudioFormsQuery.php

@@ -25,22 +25,39 @@ class BxDolStudioFormsQuery extends BxDolDb
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tf`.`id`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tf`.`id`=:id ";
                 break;
+
             case 'by_object_display':
                 $aMethod['name'] = 'getRow';
+                $aMethod['params'][1] = array(
+                	'object' => $aParams['object'],
+                	'display_name' => $aParams['display']
+                );
+
                 $sJoinClause = "LEFT JOIN `sys_form_displays` AS `td` ON `tf`.`object`=`td`.`object` ";
-                $sWhereClause = $this->prepare("AND `td`.`object`=? AND `td`.`display_name`=? ", $aParams['object'], $aParams['display']);
+                $sWhereClause = "AND `td`.`object`=:object AND `td`.`display_name`=:display_name ";
                 break;
+
             case 'by_module':
-                $sWhereClause = $this->prepare("AND `tf`.`module`=?", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'module' => $aParams['value']
+                );
+
+                $sWhereClause = "AND `tf`.`module`=:module";
                 break;
+
             case 'counter_by_modules':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'module';
                 $aMethod['params'][2] = 'counter';
                 $sSelectClause = ", COUNT(*) AS `counter`";
                 $sGroupClause = "GROUP BY `tf`.`module`";
+
             case 'all':
                 break;
         }
@@ -83,30 +100,61 @@ class BxDolStudioFormsQuery extends BxDolDb
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `td`.`id`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `td`.`id`=:id ";
                 $sLimitClause = "LIMIT 1";
                 break;
+
             case 'by_object_display':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `td`.`object`=? AND `td`.`display_name`=? ", $aParams['object'], $aParams['display']);
+                $aMethod['params'][1] = array(
+                	'object' => $aParams['object'],
+                	'display_name' => $aParams['display']
+                );
+
+                $sWhereClause = " AND `td`.`object`=:object AND `td`.`display_name`=:display_name ";
                 $sLimitClause = "LIMIT 1";
                 break;
+
             case 'by_name':
-                $sWhereClause = $this->prepare(" AND `td`.`display_name`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'display_name' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `td`.`display_name`=:display_name ";
                 $sLimitClause = "LIMIT 1";
                 break;
+
             case 'by_module':
-                $sWhereClause = $this->prepare(" AND `td`.`module`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'module' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `td`.`module`=:module ";
                 break;
+
             case 'by_module_with_forms':
+            	$aMethod['params'][1] = array(
+                	'module' => $aParams['value']
+                );
+
                 $sSelectClause = ", `tf`.`title` AS `form_title`";
                 $sJoinClause = "LEFT JOIN `sys_objects_form` AS `tf` ON `td`.`object`=`tf`.`object` ";
-                $sWhereClause = $this->prepare(" AND `td`.`module`=? ", $aParams['value']);
+                $sWhereClause = " AND `td`.`module`=:module ";
                 $sOrderClause = "ORDER BY `td`.`object` ASC, `td`.`title` ASC";
                 break;
+
             case 'by_object':
-                $sWhereClause = $this->prepare(" AND `td`.`object`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'object' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `td`.`object`=:object ";
                 break;
+
             case 'counter_by_forms':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'object';
@@ -114,6 +162,7 @@ class BxDolStudioFormsQuery extends BxDolDb
                 $sSelectClause = ", COUNT(*) AS `counter`";
                 $sGroupClause = "GROUP BY `td`.`object`";
                 break;
+
             case 'counter_by_modules':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'module';
@@ -121,8 +170,10 @@ class BxDolStudioFormsQuery extends BxDolDb
                 $sSelectClause = ", COUNT(*) AS `counter`";
                 $sGroupClause = "GROUP BY `td`.`module`";
                 break;
+
             case 'all':
                 break;
+
             case 'all_with_forms':
                 $sSelectClause = ", `tf`.`title` AS `form_title`";
                 $sJoinClause = "LEFT JOIN `sys_objects_form` AS `tf` ON `td`.`object`=`tf`.`object` ";
@@ -178,35 +229,68 @@ class BxDolStudioFormsQuery extends BxDolDb
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tdi`.`id`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tdi`.`id`=:id ";
                 break;
+
             case 'by_object_id':
                 $aMethod['name'] = 'getRow';
+                $aMethod['params'][1] = array(
+                	'object' => $aParams['object'],
+                	'id' => $aParams['id']
+                );
+
                 $sSelectClause = "`ti`.*, `tdi`.`id` AS `di_id`, `tdi`.`display_name` AS `display_name`, `tdi`.`visible_for_levels` AS `visible_for_levels`";
-                $sWhereClause = $this->prepare(" AND `ti`.`object`=? AND `tdi`.`id`=? ", $aParams['object'], $aParams['id']);
+                $sWhereClause = " AND `ti`.`object`=:object AND `tdi`.`id`=:id ";
                 break;
+
             case 'by_object_display':
-                $sWhereClause = $this->prepare(" AND `ti`.`object`=? AND `tdi`.`display_name`=? ", $aParams['object'], $aParams['display']);
+            	$aMethod['params'][1] = array(
+                	'object' => $aParams['object'],
+                	'display_name' => $aParams['display']
+                );
+
+                $sWhereClause = " AND `ti`.`object`=:object AND `tdi`.`display_name`=:display_name ";
                 break;
+
             case 'by_object_name_filter':
                 $aMethod['name'] = 'getColumn';
+                $aMethod['params'][1] = array(
+                	'object' => $aParams['object'],
+                	'name_filter' => $aParams['name_filter']
+                );
+
                 $sSelectClause = "DISTINCT `ti`.`name` AS `name`";
-                $sWhereClause = $this->prepare(" AND `ti`.`object`=? AND `ti`.`name` LIKE (?) ", $aParams['object'], $aParams['name_filter']);
+                $sWhereClause = " AND `ti`.`object`=:object AND `ti`.`name` LIKE (:name_filter) ";
                 $sOrderClause = "ORDER BY LENGTH(`ti`.`name`) ASC, `ti`.`name` ASC";
                 break;
+
             case 'dump_inputs':
+            	$aMethod['params'][1] = array(
+                	'object' => $aParams['value']
+                );
+
                 $sSelectClause = "`ti`.*";
                 $sFromClause = "`sys_form_inputs` AS `ti`";
                 $sJoinClause = "";
-                $sWhereClause = $this->prepare(" AND `ti`.`object`=? ", $aParams['value']);
+                $sWhereClause = " AND `ti`.`object`=:object ";
                 $sOrderClause = "";
                 break;
+
             case 'dump_connections':
+            	$aMethod['params'][1] = array(
+                	'object' => $aParams['value']
+                );
+
                 $sSelectClause = "`tdi`.*";
                 $sJoinClause .= "LEFT JOIN `sys_form_displays` AS `td` ON `tdi`.`display_name`=`td`.`display_name` ";
-                $sWhereClause = $this->prepare(" AND `td`.`object`=? AND `ti`.`object`=? ", $aParams['value'], $aParams['value']);
+                $sWhereClause = " AND `td`.`object`=:object AND `ti`.`object`=:object ";
                 $sOrderClause = "ORDER BY `tdi`.`display_name` ASC, `tdi`.`order` ASC";
                 break;
+
             case 'counter_by_displays':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'display_name';
@@ -215,6 +299,7 @@ class BxDolStudioFormsQuery extends BxDolDb
                 $sJoinClause = "";
                 $sGroupClause = "GROUP BY `tdi`.`display_name`";
                 break;
+
             case 'counter_by_modules':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'module';
@@ -225,6 +310,7 @@ class BxDolStudioFormsQuery extends BxDolDb
                 $sGroupClause = "GROUP BY `ti`.`module`";
                 $sOrderClause = "";
                 break;
+
             case 'all':
                 break;
         }
@@ -292,15 +378,30 @@ class BxDolStudioFormsQuery extends BxDolDb
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tl`.`id`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tl`.`id`=:id ";
                 break;
+
             case 'by_key':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tl`.`key`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'key' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tl`.`key`=:key ";
                 break;
+
             case 'by_module':
-                $sWhereClause = $this->prepare(" AND `tl`.`module`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'module' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tl`.`module`=:module ";
                 break;
+
             case 'pairs_list_values':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'key';
@@ -309,6 +410,7 @@ class BxDolStudioFormsQuery extends BxDolDb
                 $sJoinClause = "LEFT JOIN `sys_form_pre_values` AS `tv` ON `tl`.`key`=`tv`.`Key`";
                 $sGroupClause = "GROUP BY `tl`.`id`";
                 break;
+
             case 'counter_by_modules':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'module';
@@ -316,9 +418,11 @@ class BxDolStudioFormsQuery extends BxDolDb
                 $sSelectClause = ", COUNT(*) AS `counter`";
                 $sGroupClause = "GROUP BY `tl`.`module`";
                 break;
+
             case 'all_for_sets':
                 $sWhereClause = "AND `tl`.`use_for_sets`='1'";
                 break;
+
             case 'all':
                 break;
         }
@@ -369,16 +473,31 @@ class BxDolStudioFormsQuery extends BxDolDb
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tv`.`id`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tv`.`id`=:id ";
                 break;
+
             case 'by_key':
-                $sWhereClause = $this->prepare(" AND `tv`.`Key`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'key' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tv`.`Key`=:key ";
                 break;
+
             case 'by_key_key_value':
                 $aMethod['name'] = 'getAllWithKey';
                 $aMethod['params'][1] = 'value';
-                $sWhereClause = $this->prepare(" AND `tv`.`Key`=? ", $aParams['value']);
+                $aMethod['params'][2] = array(
+                	'key' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tv`.`Key`=:key ";
                 break;
+
             case 'counter_by_lists':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'key';
@@ -386,6 +505,7 @@ class BxDolStudioFormsQuery extends BxDolDb
                 $sSelectClause = ", COUNT(*) AS `counter`";
                 $sGroupClause = "GROUP BY `tv`.`Key`";
                 break;
+
             case 'counter_by_modules':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'module';
@@ -394,6 +514,7 @@ class BxDolStudioFormsQuery extends BxDolDb
                 $sJoinClause = "LEFT JOIN `sys_form_pre_lists` AS `tl` ON `tv`.`Key`=`tl`.`key`";
                 $sGroupClause = "GROUP BY `tl`.`module`";
                 break;
+
             case 'all':
                 break;
         }
@@ -426,8 +547,13 @@ class BxDolStudioFormsQuery extends BxDolDb
 
         switch($aParams['type']) {
             case 'by_key':
-                $sWhereClause = $this->prepare(" AND `tv`.`Key`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'key' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tv`.`Key`=:key ";
                 break;
+
             case 'all':
                 break;
         }

studio/classes/BxDolStudioInstallerQuery.php

@@ -16,17 +16,21 @@ class BxDolStudioInstallerQuery extends BxDolModuleQuery
 
     function getRelationsBy($aParams = array())
     {
-    	$sMethod = 'getAll';
+    	$aMethod = array('name' => 'getAll', 'params' => array(0 => 'query'));
     	$sWhereClause = "";
 
         switch($aParams['type']) {
             case 'module':
-            	$sMethod = 'getRow';
-                $sWhereClause .= $this->prepare(" AND `module`=?", $aParams['value']);
+            	$aMethod['name'] = 'getRow';
+            	$aMethod['params'][1] = array(
+                	'module' => $aParams['value']
+                );
+
+                $sWhereClause .= " AND `module`=:module";
                 break;
         }
 
-        $sSql = "SELECT
+        $aMethod['params'][0] = "SELECT
                 `id`,
                 `module`,
                 `on_install`,
@@ -36,7 +40,7 @@ class BxDolStudioInstallerQuery extends BxDolModuleQuery
             FROM `sys_modules_relations`
             WHERE 1" . $sWhereClause;
 
-        return $this->$sMethod($sSql);
+        return call_user_func_array(array($this, $aMethod['name']), $aMethod['params']);
     }
 
     function insertModule(&$aConfig)

studio/classes/BxDolStudioNavigationImport.php

@@ -31,12 +31,12 @@ class BxDolStudioNavigationImport extends BxTemplStudioGridNavigation
             list($sSet, $sModule, $sFilter) = explode($this->sParamsDivider, $sFilter);
 
         if($sSet != '')
-            $this->_aOptions['source'] .= $this->oDb->prepare(" AND `set_name`=?", $sSet);
+            $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `set_name`=?", $sSet);
 
         if($sModule != '')
-            $this->_aOptions['source'] .= $this->oDb->prepare(" AND `module`=?", $sModule);
+            $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `module`=?", $sModule);
 
-        $this->_aOptions['source'] .= $this->oDb->prepare(" AND `set_name`<>?", $this->sSet);
+        $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `set_name`<>?", $this->sSet);
         return parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
     }
 }

studio/classes/BxDolStudioNavigationItems.php

@@ -65,7 +65,7 @@ class BxDolStudioNavigationItems extends BxTemplStudioGrid
         if(empty($this->sSet))
             return array();
 
-        $this->_aOptions['source'] .= $this->oDb->prepare(" AND `set_name`=?", $this->sSet);
+        $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `set_name`=?", $this->sSet);
         return parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
     }
 }

studio/classes/BxDolStudioNavigationMenus.php

@@ -22,7 +22,7 @@ class BxDolStudioNavigationMenus extends BxTemplStudioGridNavigation
             list($sModule, $sFilter) = explode($this->sParamsDivider, $sFilter);
 
         if($sModule != '')
-            $this->_aOptions['source'] .= $this->oDb->prepare(" AND `tm`.`module`=?", $sModule);
+            $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `tm`.`module`=?", $sModule);
 
         return parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
     }

studio/classes/BxDolStudioNavigationQuery.php

@@ -25,15 +25,30 @@ class BxDolStudioNavigationQuery extends BxDolDb
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tm`.`id`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tm`.`id`=:id ";
                 break;
+
             case 'by_object':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tm`.`object`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'object' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tm`.`object`=:object ";
                 break;
+
             case 'by_set_name':
-                $sWhereClause = $this->prepare(" AND `tm`.`set_name`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'set_name' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tm`.`set_name`=:set_name ";
                 break;
+
             case 'counter_by_modules':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'module';
@@ -41,6 +56,7 @@ class BxDolStudioNavigationQuery extends BxDolDb
                 $sSelectClause = ", COUNT(*) AS `counter`";
                 $sGroupClause = "GROUP BY `tm`.`module`";
                 break;
+
             case 'all':
                 break;
         }
@@ -83,14 +99,24 @@ class BxDolStudioNavigationQuery extends BxDolDb
         switch($aParams['type']) {
             case 'by_name':
                 $aMethod['name'] = 'getRow';
+                $aMethod['params'][1] = array(
+                	'set_name' => $aParams['value']
+                );
+
                 $sSelectClause = ", COUNT(`tmi`.`id`) AS `items_count`";
                 $sJoinClause = "LEFT JOIN `sys_menu_items` AS `tmi` ON `tms`.`set_name`=`tmi`.`set_name` AND `tmi`.`active`='1'";
-                $sWhereClause = $this->prepare(" AND `tms`.`set_name`=? ", $aParams['value']);
+                $sWhereClause = " AND `tms`.`set_name`=:set_name ";
                 $sGroupClause = "GROUP BY `tms`.`set_name`";
                 break;
+
             case 'by_module':
-                $sWhereClause = $this->prepare(" AND `tms`.`module`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'module' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tms`.`module`=:module ";
                 break;
+
             case 'counter_by_modules':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'module';
@@ -98,13 +124,24 @@ class BxDolStudioNavigationQuery extends BxDolDb
                 $sSelectClause = ", COUNT(*) AS `counter`";
                 $sGroupClause = "GROUP BY `tms`.`module`";
                 break;
+
             case 'dump_by_name':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tms`.`set_name`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'set_name' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tms`.`set_name`=:set_name ";
                 break;
+
             case 'all':
-                if(isset($aParams['except']))
-                    $sWhereClause = $this->prepare(" AND `tms`.`set_name`<>? ", $aParams['except']);
+                if(isset($aParams['except'])) {
+                	$aMethod['params'][1] = array(
+	                	'set_name' => $aParams['except']
+	                );
+
+                    $sWhereClause = " AND `tms`.`set_name`<>:set_name ";
+                }
                 break;
         }
 
@@ -169,11 +206,21 @@ class BxDolStudioNavigationQuery extends BxDolDb
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause = $this->prepare(" AND `tmi`.`id`=? ", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tmi`.`id`=:id ";
                 break;
+
             case 'by_set_name':
-                $sWhereClause = $this->prepare(" AND `tmi`.`set_name`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'set_name' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tmi`.`set_name`=:set_name ";
                 break;
+
             case 'counter_by_sets':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'set_name';
@@ -181,6 +228,7 @@ class BxDolStudioNavigationQuery extends BxDolDb
                 $sSelectClause = ", COUNT(*) AS `counter`";
                 $sGroupClause = "GROUP BY `tmi`.`set_name`";
                 break;
+
             case 'counter_by_modules':
                 $aMethod['name'] = 'getPairs';
                 $aMethod['params'][1] = 'module';
@@ -188,6 +236,7 @@ class BxDolStudioNavigationQuery extends BxDolDb
                 $sSelectClause = ", COUNT(*) AS `counter`";
                 $sGroupClause = "GROUP BY `tmi`.`module`";
                 break;
+
             case 'all':
                 break;
         }
@@ -225,11 +274,21 @@ class BxDolStudioNavigationQuery extends BxDolDb
 
         switch($aParams['type']) {
             case 'by_id':
-                $sWhereClause = $this->prepare(" AND `tmi`.`id`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tmi`.`id`=:id ";
                 break;
+
             case 'by_set_name':
-                $sWhereClause = $this->prepare(" AND `tmi`.`set_name`=? ", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'set_name' => $aParams['value']
+                );
+
+                $sWhereClause = " AND `tmi`.`set_name`=:set_name ";
                 break;
+
             case 'all':
                 break;
         }

studio/classes/BxDolStudioNavigationSets.php

@@ -22,7 +22,7 @@ class BxDolStudioNavigationSets extends BxTemplStudioGridNavigation
             list($sModule, $sFilter) = explode($this->sParamsDivider, $sFilter);
 
         if($sModule != '')
-            $this->_aOptions['source'] .= $this->oDb->prepare(" AND `module`=?", $sModule);
+            $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `module`=?", $sModule);
 
         return parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
     }

studio/classes/BxDolStudioPageQuery.php

@@ -25,37 +25,64 @@ class BxDolStudioPageQuery extends BxDolDb
         switch($aParams['type']) {
             case 'all':
                 break;
+
             case 'by_page_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare("AND `tp`.`id`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `tp`.`id`=:id";
                 $sOrderClause = "";
                 $sLimitClause = "LIMIT 1";
                 break;
+
             case 'by_page_id_full':
                 $aMethod['name'] = 'getRow';
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
                 $sSelectClause .= ", `tw`.`id` AS `wid_id`, `tw`.`module` AS `wid_module`, `tw`.`url` AS `wid_url`, `tw`.`click` AS `wid_click`, `tw`.`icon` AS `wid_icon`, `tw`.`caption` AS `wid_caption`, `tw`.`cnt_notices` AS `wid_cnt_notices`, `tw`.`cnt_actions` AS `wid_cnt_actions` ";
                 $sJoinClause .= "LEFT JOIN `sys_std_widgets` AS `tw` ON `tp`.`id`=`tw`.`page_id` ";
-                $sWhereClause .= $this->prepare("AND `tp`.`id`=?", $aParams['value']);
+                $sWhereClause .= "AND `tp`.`id`=:id";
                 $sLimitClause = "LIMIT 1";
                 break;
+
             case 'by_page_name':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare("AND `tp`.`name`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `tp`.`name`=?";
                 $sLimitClause = "LIMIT 1";
                 break;
+
             case 'by_page_name_full':
                 $aMethod['name'] = 'getRow';
+                $aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
                 $sSelectClause .= ", `tw`.`id` AS `wid_id`, `tw`.`module` AS `wid_module`, `tw`.`url` AS `wid_url`, `tw`.`click` AS `wid_click`, `tw`.`icon` AS `wid_icon`, `tw`.`caption` AS `wid_caption`, `tw`.`cnt_notices` AS `wid_cnt_notices`, `tw`.`cnt_actions` AS `wid_cnt_actions` ";
                 $sJoinClause .= "LEFT JOIN `sys_std_widgets` AS `tw` ON `tp`.`id`=`tw`.`page_id` ";
-                $sWhereClause .= $this->prepare("AND `tp`.`name`=?", $aParams['value']);
+                $sWhereClause .= "AND `tp`.`name`=:name";
                 $sLimitClause = "LIMIT 1";
                 break;
+
             case 'by_page_names_full':
                 $aMethod['name'] = 'getAll';
+                $aMethod['params'][1] = array();
+
                 $sSelectClause .= ", `tw`.`id` AS `wid_id`, `tw`.`module` AS `wid_module`, `tw`.`url` AS `wid_url`, `tw`.`click` AS `wid_click`, `tw`.`icon` AS `wid_icon`, `tw`.`caption` AS `wid_caption`, `tw`.`cnt_notices` AS `wid_cnt_notices`, `tw`.`cnt_actions` AS `wid_cnt_actions` ";
                 $sJoinClause .= "LEFT JOIN `sys_std_widgets` AS `tw` ON `tp`.`id`=`tw`.`page_id` ";
-                foreach($aParams['value'] as $sValue)
-                    $sWhereClause .= $this->prepare(" OR `tp`.`name`=?", $sValue);
+                foreach($aParams['value'] as $iKey => $sValue) {
+                	$sKey = 'name' . $iKey;
+                	$aMethod['params'][1][$sKey] = $sValue;
+
+                    $sWhereClause .= " OR `tp`.`name`=:" . $sKey;
+                }
                 $sWhereClause = "AND (0" . $sWhereClause . ")";
                 break;
         }

studio/classes/BxDolStudioPermissionsActions.php

@@ -39,9 +39,9 @@ class BxDolStudioPermissionsActions extends BxTemplStudioGrid
             list($sModule, $sFilter) = explode($this->sParamsDivider, $sFilter);
 
         if($sModule != '')
-            $this->_aOptions['source'] .= $this->oDb->prepare(" AND `Module`=?", $sModule);
+            $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `Module`=?", $sModule);
 
-        $this->_aOptions['source'] .= $this->oDb->prepare(" AND (`DisabledForLevels`='0' OR `DisabledForLevels`&?=0)", pow(2, ($this->iLevel - 1)));
+        $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND (`DisabledForLevels`='0' OR `DisabledForLevels`&?=0)", pow(2, ($this->iLevel - 1)));
         $aActions = parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
 
         $aActionsActive = array();

studio/classes/BxDolStudioPolyglotEtemplates.php

@@ -23,7 +23,7 @@ class BxDolStudioPolyglotEtemplates extends BxTemplStudioGrid
             list($sModule, $sFilter) = explode($this->sParamsDivider, $sFilter);
 
         if($sModule != '')
-            $this->_aOptions['source'] .= $this->oDb->prepare(" AND `Module`=?", $sModule);
+            $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `Module`=?", $sModule);
 
         return parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
     }

studio/classes/BxDolStudioPolyglotKeys.php

@@ -81,7 +81,7 @@ class BxDolStudioPolyglotKeys extends BxTemplStudioGrid
 
         $this->_aOptions['source'] = sprintf($this->_aOptions['source'], $aLanguage['id']);
         if((int)$iModule != 0)
-            $this->_aOptions['source'] .= $this->oDb->prepare(" AND `tlk`.`IDCategory`=?", $iModule);
+            $this->_aOptions['source'] .= $this->oDb->prepareAsString(" AND `tlk`.`IDCategory`=?", $iModule);
 
         $aResults = parent::_getDataSql($sFilter, $sOrderField, $sOrderDir, $iStart, $iPerPage);
 

studio/classes/BxDolStudioSettingsQuery.php

@@ -25,12 +25,21 @@ class BxDolStudioSettingsQuery extends BxDolStudioPageQuery
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare("AND `tt`.`id`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `tt`.`id`=:id";
                 $sLimitClause .= "LIMIT 1";
                 break;
+
             case 'by_name':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare("AND `tt`.`name`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `tt`.`name`=:name";
                 $sLimitClause .= "LIMIT 1";
                 break;
         }
@@ -71,37 +80,61 @@ class BxDolStudioSettingsQuery extends BxDolStudioPageQuery
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare("AND `tc`.`id`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `tc`.`id`=:id";
                 $sLimitClause .= "LIMIT 1";
                 break;
             case 'by_name':
                 $aMethod['name'] = 'getRow';
+                $aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
                 $sSelectClause .= ", `tt`.`name` AS `type_name`, `tt`.`group` AS `type_group`";
                 $sJoinClause .= "LEFT JOIN `sys_options_types` AS `tt` ON `tc`.`type_id`=`tt`.`id` ";
-                $sWhereClause .= $this->prepare("AND `tc`.`name`=?", $aParams['value']);
+                $sWhereClause .= "AND `tc`.`name`=:name";
                 $sLimitClause .= "LIMIT 1";
                 break;
+
             case 'all_key_name':
                 $aMethod['name'] = 'getAllWithKey';
                 $aMethod['params'][1] = 'name';
                 break;
+
             case 'by_type_id_key_name':
                 $aMethod['name'] = 'getAllWithKey';
                 $aMethod['params'][1] = 'name';
-                $sWhereClause .= $this->prepare("AND `tc`.`type_id`=?", $aParams['value']);
+                $aMethod['params'][2] = array(
+                	'type_id' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `tc`.`type_id`=:type_id";
                 break;
+
             case 'by_type_name_key_name':
                 $aMethod['name'] = 'getAllWithKey';
                 $aMethod['params'][1] = 'name';
+
                 $sJoinClause = "LEFT JOIN `sys_options_types` AS `tt` ON `tc`.`type_id`=`tt`.`id` ";
                 if(isset($aParams['category_name']) && !empty($aParams['category_name'])) {
                 	if(is_string($aParams['category_name']))
                 		$aParams['category_name'] = array($aParams['category_name']);
 
-                    $sWhereClause .= $this->prepare("AND `tt`.`name`=? AND `tc`.`name` IN (" . $this->implode_escape($aParams['category_name']) . ")", $aParams['type_name']);
+                    $sWhereClause .= "AND `tt`.`name`=:name AND `tc`.`name` IN (" . $this->implode_escape($aParams['category_name']) . ")";
+                    $aMethod['params'][2] = array(
+                    	'name' => $aParams['type_name']
+                    );
+                }
+                else {
+                    $sWhereClause .= "AND `tt`.`name`=:name AND `tc`.`hidden`=:hidden";
+					$aMethod['params'][2] = array(
+	                	'name' => $aParams['type_name'],
+						'hidden' => $aParams['hidden']
+	                );
                 }
-                else
-                    $sWhereClause .= $this->prepare("AND `tt`.`name`=? AND `tc`.`hidden`=?", $aParams['type_name'], $aParams['hidden']);
                 break;
         }
 
@@ -140,30 +173,56 @@ class BxDolStudioSettingsQuery extends BxDolStudioPageQuery
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare("AND `tm`.`id`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+                
+                $sWhereClause .= "AND `tm`.`id`=:id";
                 $sLimitClause .= "LIMIT 1";
                 break;
+
             case 'by_name':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare("AND `tm`.`name`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `tm`.`name`=:name";
                 $sLimitClause .= "LIMIT 1";
                 break;
+
 			case 'by_type':
-                $sWhereClause .= $this->prepare("AND `tm`.`type`=?", $aParams['value']);
+				$aMethod['params'][1] = array(
+                	'type' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `tm`.`type`=:type";
                 break;
+
 			case 'by_category':
-                $sWhereClause .= $this->prepare("AND `tm`.`category`=?", $aParams['value']);
+				$aMethod['params'][1] = array(
+                	'category' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `tm`.`category`=:category";
                 break;
+
 			case 'by_type_category':
-				$sWhereClause .= $this->prepare("AND `tm`.`type`=? AND `tm`.`category`=?", $aParams['type'], $aParams['category']);
+				$aMethod['params'][1] = array(
+                	'type' => $aParams['type'],
+					'category' => $aParams['category']
+                );
+
+				$sWhereClause .= "AND `tm`.`type`=:type AND `tm`.`category`=:category";
                 break;
         }
 
 		if(!empty($aParams['active'])) {
 			if((int)$aParams['active'] == 1)
 				$aMethod['name'] = 'getRow';
+			$aMethod['params'][1]['active'] = $aParams['active'];
 
-			$sWhereClause .= $this->prepare(" AND `tm`.`active`=?", $aParams['active']);
+			$sWhereClause .= " AND `tm`.`active`=:active";
 		}
 
         $aMethod['params'][0] = "SELECT " . ($bReturnCount ? "SQL_CALC_FOUND_ROWS" : "") . "
@@ -211,7 +270,11 @@ class BxDolStudioSettingsQuery extends BxDolStudioPageQuery
 				$aMethod['name'] = 'getPairs'; 
 				$aMethod['params'][1] = 'option';
 				$aMethod['params'][2] = 'value';
-                $sWhereClause .= $this->prepare("AND `tmo`.`mix_id`=?", $aParams['value']);
+				$aMethod['params'][3] = array(
+                	'mix_id' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `tmo`.`mix_id`=:mix_id";
                 break;
         }
 
@@ -249,25 +312,49 @@ class BxDolStudioSettingsQuery extends BxDolStudioPageQuery
         switch($aParams['type']) {
         	case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare("AND `to`.`id`=?", $aParams['value']);
+				$aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+                
+                $sWhereClause .= "AND `to`.`id`=:id";
                 $sLimitClause .= "LIMIT 1";
                 break;
+
             case 'by_name':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare("AND `to`.`name`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `to`.`name`=:name";
                 $sLimitClause .= "LIMIT 1";
                 break;
+
             case 'by_category_id':
-                $sWhereClause .= $this->prepare("AND `to`.`category_id`=?", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'category_id' => $aParams['value']
+                );
+
+                $sWhereClause .= "AND `to`.`category_id`=:category_id";
                 break;
+
             case 'by_category_name':
+            	$aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
                 $sJoinClause .= "LEFT JOIN `sys_options_categories` AS `tc` ON `to`.`category_id`=`tc`.`id` ";
-                $sWhereClause .= $this->prepare("AND `tc`.`name`=?", $aParams['value']);
+                $sWhereClause .= "AND `tc`.`name`=:name";
                 break;
+
             case 'by_category_name_full':
+            	$aMethod['params'][1] = array(
+                	'name' => $aParams['value']
+                );
+
                 $sSelectClause .= ", `tc`.`name` AS `category_name`, `tt`.`name` AS `type_name`";
                 $sJoinClause .= "LEFT JOIN `sys_options_categories` AS `tc` ON `to`.`category_id`=`tc`.`id` LEFT JOIN `sys_options_types` AS `tt` ON `tc`.`type_id`=`tt`.`id` ";
-                $sWhereClause .= $this->prepare("AND `tc`.`name`=?", $aParams['value']);
+                $sWhereClause .= "AND `tc`.`name`=:name";
                 break;
         }
 

studio/classes/BxDolStudioWidgetsQuery.php

@@ -63,11 +63,19 @@ class BxDolStudioWidgetsQuery extends BxDolStudioPageQuery implements iBxDolSing
         switch($aParams['type']) {
             case 'by_id':
                 $aMethod['name'] = 'getRow';
-                $sWhereClause .= $this->prepare("AND `tw`.`id`=?", $aParams['value']);
+                $aMethod['params'][1] = array(
+                	'id' => $aParams['value']
+                );
+                $sWhereClause .= "AND `tw`.`id`=:id";
                 break;
+
             case 'by_page_id':
-                $sWhereClause .= $this->prepare("AND `tw2p`.`page_id`=?", $aParams['value']);
+            	$aMethod['params'][1] = array(
+                	'page_id' => $aParams['value']
+                );
+                $sWhereClause .= "AND `tw2p`.`page_id`=:page_id";
                 break;
+
             case 'all_with_notices':
 				$sWhereClause .= "AND `tw`.`cnt_notices`<>''";
             	break;

studio/template/css/forms.css

@@ -52,6 +52,11 @@
 	box-shadow: inset 0px 0px 2px 1px rgba(0,0,0,0.15);
 }
 
+.bx-form-value .bx-form-input-select_multiple,
+.bx-form-value .bx-form-input-radio_set,
+.bx-form-value .bx-form-input-checkbox_set {
+    height:auto;
+}
 
 /**
  * General