Index: modules/system/system.admin.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.admin.inc,v
retrieving revision 1.143
diff -u -p -r1.143 system.admin.inc
--- modules/system/system.admin.inc	12 May 2009 13:43:44 -0000	1.143
+++ modules/system/system.admin.inc	12 May 2009 19:39:43 -0000
@@ -22,13 +22,13 @@ function system_main_admin_page($arg = N
     drupal_set_message(t('One or more problems were detected with your Drupal installation. Check the <a href="@status">status report</a> for more information.', array('@status' => url('admin/reports/status'))), 'error');
   }
   $blocks = array();
-  if ($admin = db_fetch_array(db_query("SELECT menu_name, mlid FROM {menu_links} WHERE link_path = 'admin' AND module = 'system'"))) {
+  if ($admin = db_query("SELECT menu_name, mlid FROM {menu_links} WHERE link_path = 'admin' AND module = 'system'")->fetchAssoc()) {
     $result = db_query("
       SELECT m.*, ml.*
       FROM {menu_links} ml
       INNER JOIN {menu_router} m ON ml.router_path = m.path
-      WHERE ml.link_path != 'admin/help' AND menu_name = '%s' AND ml.plid = %d AND hidden = 0", $admin);
-    while ($item = db_fetch_array($result)) {
+      WHERE ml.link_path != 'admin/help' AND menu_name = :menu_name AND ml.plid = :mlid AND hidden = 0", $admin, array('fetch' => PDO::FETCH_ASSOC));
+    foreach ($result as $item) {
       _menu_link_translate($item);
       if (!$item['access']) {
         continue;
@@ -246,7 +246,10 @@ function system_themes_form_submit($form
       $old_theme_list[] = $theme->name;
     }
   }
-  db_query("UPDATE {system} SET status = 0 WHERE type = 'theme'");
+  db_update('system')
+    ->fields(array('status' => 0))
+    ->condition('type', 'theme')
+    ->execute();
 
   if ($form_state['values']['op'] == t('Save configuration')) {
     if (is_array($form_state['values']['status'])) {
@@ -254,7 +257,11 @@ function system_themes_form_submit($form
         // Always enable the default theme, despite its status checkbox being checked:
         if ($choice || $form_state['values']['theme_default'] == $key) {
           $new_theme_list[] = $key;
-          db_query("UPDATE {system} SET status = 1 WHERE type = 'theme' and name = '%s'", $key);
+          db_update('system')
+            ->fields(array('status' => 1))
+            ->condition('type', 'theme')
+            ->condition('name', $key)
+            ->execute();
         }
       }
     }
@@ -276,7 +283,11 @@ function system_themes_form_submit($form
     variable_del('theme_default');
     variable_del('admin_theme');
     variable_del('node_admin_theme');
-    db_query("UPDATE {system} SET status = 1 WHERE type = 'theme' AND name = 'garland'");
+    db_update('system')
+      ->fields(array('status' => 1))
+      ->condition('type', 'theme')
+      ->condition('name', 'garland')
+      ->execute();
     $new_theme_list = array('garland');
   }
 
@@ -962,8 +973,8 @@ function system_modules_uninstall($form_
   $form = array();
 
   // Pull all disabled modules from the system table.
-  $disabled_modules = db_query("SELECT name, filename, info FROM {system} WHERE type = 'module' AND status = 0 AND schema_version > %d ORDER BY name", SCHEMA_UNINSTALLED);
-  while ($module = db_fetch_object($disabled_modules)) {
+  $disabled_modules = db_query("SELECT name, filename, info FROM {system} WHERE type = 'module' AND status = 0 AND schema_version > :schema ORDER BY name", array(':schema' => SCHEMA_UNINSTALLED));
+  foreach ($disabled_modules as $module) {
 
     // Grab the module info
     $info = unserialize($module->info);
@@ -1077,7 +1088,7 @@ function system_ip_blocking() {
   $rows = array();
   $header = array(t('IP address'), t('Operations'));
   $result = db_query('SELECT * FROM {blocked_ips}');
-  while ($ip = db_fetch_object($result)) {
+  foreach ($result as $ip) {
     $rows[] = array(
       $ip->ip,
       l(t('delete'), "admin/settings/ip-blocking/delete/$ip->iid"),
@@ -1118,7 +1129,7 @@ function system_ip_blocking_form($form_s
 
 function system_ip_blocking_form_validate($form, &$form_state) {
   $ip = trim($form_state['values']['ip']);
-  if (db_result(db_query("SELECT * FROM {blocked_ips} WHERE ip = '%s'", $ip))) {
+  if (db_query("SELECT * FROM {blocked_ips} WHERE ip = :ip", array(':ip' => $ip))->fetchField()) {
     form_set_error('ip', t('This IP address is already blocked.'));
   }
   elseif ($ip == ip_address()) {
@@ -1131,7 +1142,9 @@ function system_ip_blocking_form_validat
 
 function system_ip_blocking_form_submit($form, &$form_state) {
   $ip = trim($form_state['values']['ip']);
-  db_query("INSERT INTO {blocked_ips} (ip) VALUES ('%s')", $ip);
+  db_insert('blocked_ips')
+    ->fields(array('ip' => $ip))
+    ->execute();
   drupal_set_message(t('The IP address %ip has been blocked.', array('%ip' => $ip)));
   $form_state['redirect'] = 'admin/settings/ip-blocking';
   return;
@@ -1155,7 +1168,9 @@ function system_ip_blocking_delete(&$for
  */
 function system_ip_blocking_delete_submit($form, &$form_state) {
   $blocked_ip = $form_state['values']['blocked_ip'];
-  db_query("DELETE FROM {blocked_ips} WHERE iid = %d", $blocked_ip['iid']);
+  db_delete('blocked_ips')
+    ->condition('iid', $blocked_ip['iid'])
+    ->execute();
   watchdog('user', 'Deleted %ip', array('%ip' => $blocked_ip['ip']));
   drupal_set_message(t('The IP address %ip was deleted.', array('%ip' => $blocked_ip['ip'])));
   $form_state['redirect'] = 'admin/settings/ip-blocking';
@@ -1771,8 +1786,12 @@ function system_status($check = FALSE) {
   }
   // MySQL import might have set the uid of the anonymous user to autoincrement
   // value. Let's try fixing it. See http://drupal.org/node/204411
-  db_query("UPDATE {users} SET uid = uid - uid WHERE name = '' AND pass = '' AND status = 0");
-
+  db_update('users')
+    ->expression('uid', 'uid - uid')
+    ->condition('name', '')
+    ->condition('pass', '')
+    ->condition('status', 0)
+    ->execute();
   return theme('status_report', $requirements);
 }
 
@@ -1826,7 +1845,7 @@ function _system_sql($data, $keys) {
 function system_sql() {
 
   $result = db_query("SHOW STATUS");
-  while ($entry = db_fetch_object($result)) {
+  foreach ($result as $entry) {
     // 'SHOW STATUS' returns fields named 'Variable_name' and 'Value',
     // case is important.
     $data[$entry->Variable_name] = $entry->Value;
Index: modules/system/system.api.php
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.api.php,v
retrieving revision 1.32
diff -u -p -r1.32 system.api.php
--- modules/system/system.api.php	6 May 2009 11:30:19 -0000	1.32
+++ modules/system/system.api.php	12 May 2009 19:39:50 -0000
@@ -141,7 +141,10 @@ function hook_elements() {
  *   None.
  */
 function hook_exit($destination = NULL) {
-  db_query('UPDATE {counter} SET hits = hits + 1 WHERE type = 1');
+  db_update('counter')
+    ->expression('hits', 'hits + 1')
+    ->condition('type', 1)
+    ->execute();
 }
 
 /**
@@ -1247,8 +1250,8 @@ function hook_file_delete($file) {
 function hook_file_download($filepath) {
   // Check if the file is controlled by the current module.
   $filepath = file_create_path($filepath);
-  $result = db_query("SELECT f.* FROM {files} f INNER JOIN {upload} u ON f.fid = u.fid WHERE filepath = '%s'", $filepath);
-  if ($file = db_fetch_object($result)) {
+  $result = db_query("SELECT f.* FROM {files} f INNER JOIN {upload} u ON f.fid = u.fid WHERE filepath = :filepath", array('filepath' => $filepath));
+  foreach ($result as $file) {
     if (!user_access('view uploaded files')) {
       return -1;
     }
@@ -1621,8 +1624,12 @@ function hook_update_N(&$sandbox = NULL)
     // We'll -1 to disregard the uid 0...
     $sandbox['max'] = db_query('SELECT COUNT(DISTINCT uid) FROM {users}')->fetchField() - 1;
   }
-  
-  $users = db_query_range("SELECT uid, name FROM {users} WHERE uid > %d ORDER BY uid ASC", $sandbox['current_uid'], 0, 3);
+  db_select('users', 'u')
+    ->fields('u', array('uid', 'name'))
+    ->condition('uid', $sandbox['current_uid'], '>')
+    ->range(0, 3)
+    ->orderBy('uid', 'ASC')
+    ->execute();
   foreach ($users as $user) {
     $user->name .= '!';
     $ret[] = update_sql("UPDATE {users} SET name = '$user->name' WHERE uid = $user->uid");
Index: modules/system/system.install
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.install,v
retrieving revision 1.323
diff -u -p -r1.323 system.install
--- modules/system/system.install	12 May 2009 13:43:45 -0000	1.323
+++ modules/system/system.install	12 May 2009 19:39:59 -0000
@@ -317,14 +317,14 @@ function system_install() {
       \'SELECT greatest($1, greatest($2, $3));\'
       LANGUAGE \'sql\''
     );
-    if (!db_result(db_query("SELECT COUNT(*) FROM pg_proc WHERE proname = 'rand'"))) {
+    if (!db_query("SELECT COUNT(*) FROM pg_proc WHERE proname = 'rand'")->fetchField()) {
       db_query('CREATE OR REPLACE FUNCTION "rand"() RETURNS float AS
         \'SELECT random();\'
         LANGUAGE \'sql\''
       );
     }
 
-    if (!db_result(db_query("SELECT COUNT(*) FROM pg_proc WHERE proname = 'concat'"))) {
+    if (!db_query("SELECT COUNT(*) FROM pg_proc WHERE proname = 'concat'")->fetchField()) {
       db_query('CREATE OR REPLACE FUNCTION "concat"(text, text) RETURNS text AS
         \'SELECT $1 || $2;\'
         LANGUAGE \'sql\''
@@ -2803,7 +2803,7 @@ function system_update_6049() {
 function system_update_7000() {
   $ret = array();
   $result = db_query("SELECT rid, perm FROM {permission} ORDER BY rid");
-  while ($role = db_fetch_object($result)) {
+  foreach ($result as $role) {
     $renamed_permission = preg_replace('/(?<=^|,\ )create\ blog\ entries(?=,|$)/', 'create blog content', $role->perm);
     $renamed_permission = preg_replace('/(?<=^|,\ )edit\ own\ blog\ entries(?=,|$)/', 'edit own blog content', $role->perm);
     $renamed_permission = preg_replace('/(?<=^|,\ )edit\ any\ blog\ entry(?=,|$)/', 'edit any blog content', $role->perm);
@@ -2873,7 +2873,10 @@ function system_update_7002() {
 function system_update_7003() {
   $ret = array();
   $type = 'host';
-  $result = db_query("SELECT mask FROM {access} WHERE status = %d AND TYPE = '%s'", 0, $type);
+  $result = db_query("SELECT mask FROM {access} WHERE status = :status AND type = :type", array(
+    ':status' => 0,
+    ':type' => $type,
+  ));
   while ($blocked = db_fetch_object($result)) {
     if (filter_var($blocked->mask, FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE) !== FALSE) {
       $ret[] = update_sql("INSERT INTO {blocked_ips} (ip) VALUES ('$blocked->mask')");
@@ -2889,8 +2892,11 @@ function system_update_7003() {
   }
   // Make sure not to block any IP addresses that were specifically allowed by access rules.
   if (!empty($result)) {
-    $result = db_query("SELECT mask FROM {access} WHERE status = %d AND type = '%s'", 1, $type);
-    while ($allowed = db_fetch_object($result)) {
+    $result = db_query("SELECT mask FROM {access} WHERE status = :status AND type = :type", array(
+      ':status' => 1,
+      ':type' => $type,
+    ));
+    foreach ($result as $allowed) {
       $ret[] = update_sql("DELETE FROM {blocked_ips} WHERE LOWER(ip) LIKE LOWER('$allowed->mask')");
     }
   }
@@ -2934,7 +2940,12 @@ function system_update_7004(&$sandbox) {
       foreach ($renamed_deltas as $module => $deltas) {
         foreach ($deltas as $old_delta => $new_delta) {
           // Only do the update if the old block actually exists.
-          if (db_result(db_query("SELECT COUNT(*) FROM {" . $table . "} WHERE module = '%s' AND delta = '%s'", $module, $old_delta))) {
+          $block_exists = db_query("SELECT COUNT(*) FROM {" . $table . "} WHERE module = :module AND delta = :delta",array(
+            ':module' => $module,
+            ':delta' => $old_delta,
+          ))
+          ->fetchField();
+          if ($block_exists) {
             $ret[] = update_sql("UPDATE {" . $table . "} SET delta = '" . $new_delta . "' WHERE module = '" . $module . "' AND delta = '" . $old_delta . "'");
           }
         }
@@ -2954,12 +2965,17 @@ function system_update_7004(&$sandbox) {
     // Initialize batch update information.
     $sandbox['progress'] = 0;
     $sandbox['last_user_processed'] = -1;
-    $sandbox['max'] = db_result(db_query("SELECT COUNT(*) FROM {users} WHERE data IS NOT NULL"));
+    $sandbox['max'] = db_query("SELECT COUNT(*) FROM {users} WHERE data IS NOT NULL")->fetchField();
   }
   // Now do the batch update of the user-specific block visibility settings.
   $limit = 100;
-  $result = db_query_range("SELECT uid, data FROM {users} WHERE uid > %d AND data IS NOT NULL", $sandbox['last_user_processed'], 0, $limit);
-  while ($row = db_fetch_object($result)) {
+  $result = db_select('users', 'u')
+    ->fields('u', array('uid', 'data'))
+    ->condition('uid', $sandbox['last_user_processed'], '>')
+    ->where('data IS NOT NULL')
+    ->range(0, $limit)
+    ->execute();
+  foreach ($result as $row) {
     $data = unserialize($row->data);
     $user_needs_update = FALSE;
     foreach ($renamed_deltas as $module => $deltas) {
@@ -2975,7 +2991,10 @@ function system_update_7004(&$sandbox) {
     }
     // Update the current user.
     if ($user_needs_update) {
-      db_query("UPDATE {users} SET data = '%s' WHERE uid = %d", serialize($data), $row->uid);
+      db_update('users')
+        ->fields(array('data' => serialize($data)))
+        ->condition('uid', $row->uid)
+        ->execute();
     }
     // Update our progress information for the batch update.
     $sandbox['progress']++;
@@ -3083,12 +3102,17 @@ function system_update_7007() {
 
   // Copy the permissions from the old {permission} table to the new {role_permission} table.
   $result = db_query("SELECT rid, perm FROM {permission} ORDER BY rid ASC");
-  while ($role = db_fetch_object($result)) {
+  $query = db_insert('role_permission')->fields(array('rid', 'permission'));
+  foreach ($result as $role) {
     foreach (explode(', ', $role->perm) as $perm) {
-      db_query("INSERT INTO {role_permission} (rid, permission) VALUES (%d, '%s')", $role->rid, $perm);
+      $query->values(array(
+        'rid' => $role->rid,
+        'permission' => $perm,
+      ));
     }
     $ret[] = array('success' => TRUE, 'query' => "Inserted into {role_permission} the permissions for role ID " . $role->rid);
   }
+  $query->execute();
   db_drop_table($ret, 'permission');
 
   return $ret;
@@ -3185,7 +3209,7 @@ function system_update_7013() {
   // the time zone name and use it as the default time zone.
   if (!$timezone && ($timezone_id = variable_get('date_default_timezone_id', 0))) {
     try {
-      $timezone_name = db_result(db_query('SELECT name FROM {event_timezones} WHERE timezone = :timezone_id', array(':timezone_id' => $timezone_id)));
+      $timezone_name = db_query('SELECT name FROM {event_timezones} WHERE timezone = :timezone_id', array(':timezone_id' => $timezone_id))->fetchField();
       if (($timezone_name = str_replace(' ', '_', $timezone_name)) && isset($timezones[$timezone_name])) {
         $timezone = $timezone_name;
       }
@@ -3242,7 +3266,7 @@ function system_update_7016() {
                         LEFT JOIN pg_class c ON (c.oid =  a.attrelid)
                         WHERE pg_catalog.pg_table_is_visible(c.oid) AND c.relkind = 'r'
                         AND pg_catalog.format_type(a.atttypid, a.atttypmod) LIKE '%unsigned%'");
-    while ($row = db_fetch_object($result)) {
+    foreach ($result as $row) {
       switch ($row->type) {
         case 'smallint_unsigned':
           $datatype = 'int';
Index: modules/system/system.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.module,v
retrieving revision 1.692
diff -u -p -r1.692 system.module
--- modules/system/system.module	12 May 2009 08:37:45 -0000	1.692
+++ modules/system/system.module	12 May 2009 19:40:08 -0000
@@ -774,8 +774,7 @@ function system_menu() {
  *   The blocked IP address from the database as an array.
  */
 function blocked_ip_load($iid) {
-  $blocked_ip = db_fetch_array(db_query("SELECT * FROM {blocked_ips} WHERE iid = %d", $iid));
-  return $blocked_ip;
+  return db_query("SELECT * FROM {blocked_ips} WHERE iid = :iid", array(':iid' => $iid))->fetchAssoc();
 }
 
 /**
@@ -987,14 +986,14 @@ function system_block_view($delta = '') 
 function system_admin_menu_block($item) {
   $content = array();
   if (!isset($item['mlid'])) {
-    $item += db_fetch_array(db_query("SELECT mlid, menu_name FROM {menu_links} ml WHERE ml.router_path = '%s' AND module = 'system'", $item['path']));
+    $item += db_query("SELECT mlid, menu_name FROM {menu_links} ml WHERE ml.router_path = :path AND module = 'system'", array(':path' => $item['path']))->fetchAssoc();
   }
   $result = db_query("
     SELECT m.load_functions, m.to_arg_functions, m.access_callback, m.access_arguments, m.page_callback, m.page_arguments, m.title, m.title_callback, m.title_arguments, m.type, m.description, ml.*
     FROM {menu_links} ml
     LEFT JOIN {menu_router} m ON ml.router_path = m.path
-    WHERE ml.plid = %d AND ml.menu_name = '%s' AND hidden = 0", $item['mlid'], $item['menu_name']);
-  while ($item = db_fetch_array($result)) {
+    WHERE ml.plid = :plid AND ml.menu_name = :name AND hidden = 0", array(':plid' => $item['mlid'], ':name' => $item['menu_name']), array('fetch' => PDO::FETCH_ASSOC));
+  foreach ($result as $item) {
     _menu_link_translate($item);
     if (!$item['access']) {
       continue;
@@ -1099,8 +1098,8 @@ function system_check_directory($form_el
  */
 function system_get_files_database(&$files, $type) {
   // Extract current files from database.
-  $result = db_query("SELECT filename, name, type, status, schema_version, weight FROM {system} WHERE type = '%s'", $type);
-  while ($file = db_fetch_object($result)) {
+  $result = db_query("SELECT filename, name, type, status, schema_version, weight FROM {system} WHERE type = :type", array(':type' => $type));
+  foreach ($result as $file) {
     if (isset($files[$file->name]) && is_object($files[$file->name])) {
       $file->filepath = $file->filename;
       $file->old_filepath = $file->filepath;
@@ -1165,15 +1164,26 @@ function system_theme_data() {
   // Extract current files from database.
   system_get_files_database($themes, 'theme');
 
-  db_query("DELETE FROM {system} WHERE type = 'theme'");
+  db_delete('system')
+    ->condition('type', 'theme')
+    ->execute();
 
+  $query = db_insert('system')->fields(array('name', 'owner', 'info', 'type', 'filename', 'status'));
   foreach ($themes as $theme) {
     if (!isset($theme->owner)) {
       $theme->owner = '';
     }
 
-    db_query("INSERT INTO {system} (name, owner, info, type, filename, status) VALUES ('%s', '%s', '%s', '%s', '%s', %d)", $theme->name, $theme->owner, serialize($theme->info), 'theme', $theme->filename, isset($theme->status) ? $theme->status : 0);
+    $query->values(array(
+      'name' => $theme->name,
+      'owner' => $theme->owner,
+      'info' => serialize($theme->info),
+      'type' => 'theme',
+      'filename' => $theme->filename,
+      'status' => isset($theme->status) ? $theme->status : 0,
+    ));
   }
+  $query->execute();
 
   return $themes;
 }
@@ -1317,7 +1327,7 @@ function system_region_list($theme_key) 
   static $list = array();
 
   if (!array_key_exists($theme_key, $list)) {
-    $info = unserialize(db_result(db_query("SELECT info FROM {system} WHERE type = :type AND name = :name", array(':type' => 'theme', ':name' => $theme_key))));
+    $info = unserialize(db_query("SELECT info FROM {system} WHERE type = :type AND name = :name", array(':type' => 'theme', ':name' => $theme_key))->fetchField());
     $list[$theme_key] = array_map('t', $info['regions']);
   }
 
@@ -1529,9 +1539,9 @@ function system_get_module_admin_tasks($
   if (!isset($items)) {
     $result = db_query("
        SELECT m.load_functions, m.to_arg_functions, m.access_callback, m.access_arguments, m.page_callback, m.page_arguments, m.title, m.title_callback, m.title_arguments, m.type, ml.*
-       FROM {menu_links} ml INNER JOIN {menu_router} m ON ml.router_path = m.path WHERE ml.link_path LIKE 'admin/%' AND hidden >= 0 AND module = 'system' AND m.number_parts > 2");
+       FROM {menu_links} ml INNER JOIN {menu_router} m ON ml.router_path = m.path WHERE ml.link_path LIKE 'admin/%' AND hidden >= 0 AND module = 'system' AND m.number_parts > 2", array(), array('fetch' => PDO::FETCH_ASSOC));
     $items = array();
-    while ($item = db_fetch_array($result)) {
+    foreach ($result as $item) {
       _menu_link_translate($item);
       if ($item['access']) {
         $items[$item['router_path']] = $item;
@@ -1566,14 +1576,22 @@ function system_get_module_admin_tasks($
  */
 function system_cron() {
   // Cleanup the flood.
-  db_query('DELETE FROM {flood} WHERE timestamp < %d', REQUEST_TIME - 3600);
+  db_delete('flood')
+    ->condition('timestamp', REQUEST_TIME - 3600, '<')
+    ->execute();
   // Cleanup the batch table.
-  db_query('DELETE FROM {batch} WHERE timestamp < %d', REQUEST_TIME - 864000);
+  db_delete('batch')
+    ->condition('timestamp', REQUEST_TIME - 864000, '<')
+    ->execute();
 
   // Remove temporary files that are older than DRUPAL_MAXIMUM_TEMP_FILE_AGE.
   // Use separate placeholders for the status to avoid a bug in some versions
   // of PHP. See http://drupal.org/node/352956
-  $result = db_query('SELECT fid FROM {files} WHERE status & :permanent1 <> :permanent2 AND timestamp < :timestamp', array(':permanent1' => FILE_STATUS_PERMANENT, ':permanent2' => FILE_STATUS_PERMANENT, ':timestamp' => REQUEST_TIME - DRUPAL_MAXIMUM_TEMP_FILE_AGE));
+  $result = db_query('SELECT fid FROM {files} WHERE status & :permanent1 <> :permanent2 AND timestamp < :timestamp', array(
+    ':permanent1' => FILE_STATUS_PERMANENT,
+    ':permanent2' => FILE_STATUS_PERMANENT,
+    ':timestamp' => REQUEST_TIME - DRUPAL_MAXIMUM_TEMP_FILE_AGE
+  ));
   foreach ($result as $row) {
     if ($file = file_load($row->fid)) {
       if (!file_delete($file)) {
@@ -1682,15 +1700,20 @@ function system_actions_manage() {
   }
 
   $row = array();
-  $instances_present = db_fetch_object(db_query("SELECT aid FROM {actions} WHERE parameters <> ''"));
+  $instances_present = db_query("SELECT aid FROM {actions} WHERE parameters <> ''")->fetchField();
   $header = array(
     array('data' => t('Action type'), 'field' => 'type'),
     array('data' => t('Description'), 'field' => 'description'),
     array('data' => $instances_present ? t('Operations') : '', 'colspan' => '2')
   );
-  $sql = 'SELECT * FROM {actions}';
-  $result = pager_query($sql . tablesort_sql($header), 50);
-  while ($action = db_fetch_object($result)) {
+  $query = db_select('actions')->extend('PagerDefault')->extend('TableSort');
+  $result = $query
+    ->fields('actions')
+    ->limit(50)
+    ->setHeader($header)
+    ->execute();
+
+  foreach ($result as $action) {
     $row[] = array(
       array('data' => $action->type),
       array('data' => $action->description),
@@ -1786,7 +1809,7 @@ function system_actions_configure($form_
   if (is_numeric($action)) {
     $aid = $action;
     // Load stored parameter values from database.
-    $data = db_fetch_object(db_query("SELECT * FROM {actions} WHERE aid = '%s'", $aid));
+    $data = db_query("SELECT * FROM {actions} WHERE aid = :aid", array(':aid' => $aid))->fetch();
     $edit['actions_description'] = $data->description;
     $edit['actions_type'] = $data->type;
     $function = $data->callback;
@@ -2209,7 +2232,9 @@ function system_goto_action($object, $co
  */
 function system_block_ip_action() {
   $ip = ip_address();
-  db_query("INSERT INTO {blocked_ips} (ip) VALUES ('%s')", $ip);
+  db_insert('blocked_ips')
+    ->fields(array('ip' => $ip))
+    ->execute();
   watchdog('action', 'Banned IP address %ip', array('%ip' => $ip));
 }
 
Index: modules/system/system.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.test,v
retrieving revision 1.42
diff -u -p -r1.42 system.test
--- modules/system/system.test	12 May 2009 18:08:43 -0000	1.42
+++ modules/system/system.test	12 May 2009 19:40:08 -0000
@@ -250,7 +250,7 @@ class IPAddressBlockingTestCase extends 
     $edit = array();
     $edit['ip'] = '192.168.1.1';
     $this->drupalPost('admin/settings/ip-blocking', $edit, t('Save'));
-    $ip = db_result(db_query("SELECT iid from {blocked_ips} WHERE ip = '%s'", $edit['ip']));
+    $ip = db_query("SELECT iid from {blocked_ips} WHERE ip = :ip", array(':ip' => $edit['ip']))->fetchField();
     $this->assertNotNull($ip, t('IP address found in database'));
     $this->assertRaw(t('The IP address %ip has been blocked.', array('%ip' => $edit['ip'])), t('IP address was blocked.'));
 
@@ -332,17 +332,28 @@ class CronRunTestCase extends DrupalWebT
 
     // Temporary file that is older than DRUPAL_MAXIMUM_TEMP_FILE_AGE.
     $temp_old = file_save_data('');
-    db_query('UPDATE {files} SET status = :status, timestamp = :timestamp WHERE fid = :fid', array(':status' => 0, ':timestamp' => 1, ':fid' => $temp_old->fid));
+    db_update('files')
+      ->fields(array(
+        'status' => 0,
+        'timestamp' => 1,
+      ))
+      ->condition('fid', $temp_old->fid)
+      ->execute();
     $this->assertTrue(file_exists($temp_old->filepath), t('Old temp file was created correctly.'));
 
     // Temporary file that is less than DRUPAL_MAXIMUM_TEMP_FILE_AGE.
     $temp_new = file_save_data('');
-    db_query('UPDATE {files} SET status = :status WHERE fid = :fid', array(':status' => 0, ':fid' => $temp_new->fid));
+    db_update('files')
+      ->fields(array('status' => 0))
+      ->condition('fid', $temp_new->fid)
+      ->execute();
     $this->assertTrue(file_exists($temp_new->filepath), t('New temp file was created correctly.'));
 
     // Permanent file that is older than DRUPAL_MAXIMUM_TEMP_FILE_AGE.
-    $perm_old = file_save_data('');
-    db_query('UPDATE {files} SET timestamp = :timestamp WHERE fid = :fid', array(':timestamp' => 1, ':fid' => $perm_old->fid));
+    $perm_old = file_save_data('');    db_update('files')
+      ->fields(array('timestamp' => 1))
+      ->condition('fid', $temp_old->fid)
+      ->execute();
     $this->assertTrue(file_exists($perm_old->filepath), t('Old permanent file was created correctly.'));
 
     // Permanent file that is newer than DRUPAL_MAXIMUM_TEMP_FILE_AGE.