From 962477ebad0c8ab84a8cc985ea9909172ca67dcf Mon Sep 17 00:00:00 2001
From: Ben Coleman <b.coleman@accelerateddesign.com>
Date: Wed, 27 Jul 2011 18:06:21 -0400
Subject: [PATCH] Correct handling of IN parameters using db_placeholders

---
 user_register_notify.module |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/user_register_notify.module b/user_register_notify.module
index 626172d..724aa58 100644
--- a/user_register_notify.module
+++ b/user_register_notify.module
@@ -62,9 +62,11 @@ function user_register_notify_setup_email(&$edit, &$account, $action = 'insert')
         $emails = preg_split('/,[\w]+/', variable_get('user_register_notify_mailto', $from));
         // There is no break here for a reason.
       case 'Role':
-        $roles = implode(',', variable_get('user_register_notify_roles', array()));
+        $roles = variable_get('user_register_notify_roles', array());
         if (!empty($roles)) {
-          $result = db_query("SELECT mail FROM {users} AS u INNER JOIN {users_roles} AS r ON u.uid = r.uid WHERE r.rid IN('%s') and u.status = '1' ", $roles);
+          $result = db_query("SELECT mail FROM {users} AS u 
+                                          INNER JOIN {users_roles} AS r ON u.uid = r.uid 
+                                          WHERE r.rid IN(" . db_placeholders($roles, 'int') . ") and u.status = '1' ", $roles);
           while ($mail = db_fetch_object($result)) {
             $emails[] = $mail->mail;
           }
-- 
1.7.4.msysgit.0