From b3aff3007d2cee790841aa894ec2a561f4a1b8b6 Mon Sep 17 00:00:00 2001
From: Sven Decabooter <sven@puresign.be>
Date: Tue, 19 Apr 2011 09:07:17 +0200
Subject: Use db_placeholder

---
 node_tasklist.module |   14 ++------------
 1 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/node_tasklist.module b/node_tasklist.module
index fae556b..a9679bd 100644
--- a/node_tasklist.module
+++ b/node_tasklist.module
@@ -121,20 +121,10 @@ function node_tasklist_get_users($type) {
     }
   }
 
-  // create component of sql query to get all of the different roles
-  $i = 0 ;
-  $j = sizeof($roles);
-  foreach ($roles as $key => $value) {
-    $query_rids .= 'rid="' . $key . '"';
-    if ($i < ($j - 1)) {
-      $query_rids .= " or ";
-    }
-    ++$i;
-  }
+  $role_keys = array_keys($roles);
 
   // get the user accounts which have access
-  $sql = "select distinct {uid} from {users_roles} where " . $query_rids; // not using unsanity input - secure ok!
-  $result = db_query($sql);
+  $result = db_query("SELECT distinct {uid} from {users_roles} WHERE rid IN (" . db_placeholders($role_keys) . ")", $role_keys);
   while ($row = db_fetch_object($result)) {
     $users[] = $row->uid;
   }
-- 
1.7.1