diff -urpN drupal/includes/actions.inc drupal-6.x-dev-clean_query-0.1/includes/actions.inc
--- drupal/includes/actions.inc	2007-09-10 04:01:39.000000000 +0800
+++ drupal-6.x-dev-clean_query-0.1/includes/actions.inc	2007-09-15 01:06:59.000000000 +0800
@@ -239,7 +239,7 @@ function actions_function_lookup($hash) 
   }
 
   // Must be an instance; must check database.
-  $aid = db_result(db_query("SELECT aid FROM {actions} WHERE MD5(aid) = '%s' AND parameters != ''", $hash));
+  $aid = db_result(db_query("SELECT aid FROM {actions} WHERE MD5(aid) = '%s' AND parameters != '%s'", $hash, ''));
   return $aid;
 }
 
@@ -256,7 +256,7 @@ function actions_synchronize($actions_in
     $actions_in_code = actions_list();
   }
   $actions_in_db = array();
-  $result = db_query("SELECT * FROM {actions} WHERE parameters = ''");
+  $result = db_query("SELECT * FROM {actions} WHERE parameters = '%s'", '');
   while ($action = db_fetch_object($result)) {
     $actions_in_db[$action->callback] = array('aid' => $action->aid, 'description' => $action->description);
   }
diff -urpN drupal/includes/bootstrap.inc drupal-6.x-dev-clean_query-0.1/includes/bootstrap.inc
--- drupal/includes/bootstrap.inc	2007-09-10 20:19:11.000000000 +0800
+++ drupal-6.x-dev-clean_query-0.1/includes/bootstrap.inc	2007-09-15 01:08:35.000000000 +0800
@@ -825,7 +825,7 @@ function drupal_is_denied($type, $mask) 
   // these, we return 1 (denied). If no matching records or only ones
   // with status = 1, we get no return from db_result, so we return
   // (bool)NULL = 0 (allowed).
-  return (bool) db_result(db_query_range("SELECT 1 FROM {access} WHERE type = '%s' AND LOWER('%s') LIKE LOWER(mask) AND status = 0", $type, $mask, 0, 1));
+  return (bool) db_result(db_query_range("SELECT 1 FROM {access} WHERE type = '%s' AND LOWER('%s') LIKE LOWER(mask) AND status = %d", $type, $mask, 0, 0, 1));
 }
 
 /**
diff -urpN drupal/includes/install.inc drupal-6.x-dev-clean_query-0.1/includes/install.inc
--- drupal/includes/install.inc	2007-09-07 18:48:24.000000000 +0800
+++ drupal-6.x-dev-clean_query-0.1/includes/install.inc	2007-09-15 01:13:17.000000000 +0800
@@ -371,7 +371,8 @@ function drupal_uninstall_module($module
     }
     $placeholders = implode(', ', array_fill(0, count($paths), "'%s'"));
 
-    $result = db_query('SELECT * FROM {menu_links} WHERE router_path IN ('. $placeholders .') AND external = 0 ORDER BY depth DESC', $paths);
+    $paths[] = 0;
+    $result = db_query('SELECT * FROM {menu_links} WHERE router_path IN ('. $placeholders .') AND external = %d ORDER BY depth DESC', $paths);
     // Remove all such items. Starting from those with the greatest depth will
     // minimize the amount of re-parenting done by menu_link_delete().
     while ($item = db_fetch_array($result)) {
diff -urpN drupal/includes/locale.inc drupal-6.x-dev-clean_query-0.1/includes/locale.inc
--- drupal/includes/locale.inc	2007-09-05 05:10:45.000000000 +0800
+++ drupal-6.x-dev-clean_query-0.1/includes/locale.inc	2007-09-15 01:19:57.000000000 +0800
@@ -1664,7 +1664,7 @@ function _locale_parse_js_file($filepath
       // Remove the quotes and string concatenations from the string.
       $string = implode('', preg_split('~(?<!\\\\)[\'"]\s*\+\s*[\'"]~s', substr($string, 1, -1)));
 
-      $result = db_query("SELECT lid, location FROM {locales_source} WHERE source = '%s' AND textgroup = 'default'", $string);
+      $result = db_query("SELECT lid, location FROM {locales_source} WHERE source = '%s' AND textgroup = '%s'", $string, 'default');
       if ($source = db_fetch_object($result)) {
         // We already have this source string and now have to add the location
         // to the location column, if this file is not yet present in there.
@@ -1680,7 +1680,7 @@ function _locale_parse_js_file($filepath
       }
       else {
         // We don't have the source string yet, thus we insert it into the database.
-        db_query("INSERT INTO {locales_source} (location, source, textgroup) VALUES ('%s', '%s', 'default')", $filepath, $string);
+        db_query("INSERT INTO {locales_source} (location, source, textgroup) VALUES ('%s', '%s', '%s')", $filepath, $string, 'default');
       }
     }
   }
@@ -2057,7 +2057,7 @@ function _locale_rebuild_js($langcode = 
 
   // Construct the array for JavaScript translations.
   // We sort on plural so that we have all plural forms before singular forms.
-  $result = db_query("SELECT s.lid, s.source, t.plid, t.plural, t.translation FROM {locales_source} s LEFT JOIN {locales_target} t ON s.lid = t.lid AND t.language = '%s' WHERE s.location LIKE '%%.js%%' AND s.textgroup = 'default' ORDER BY t.plural DESC", $language->language);
+  $result = db_query("SELECT s.lid, s.source, t.plid, t.plural, t.translation FROM {locales_source} s LEFT JOIN {locales_target} t ON s.lid = t.lid AND t.language = '%s' WHERE s.location LIKE '%%.js%%' AND s.textgroup = '%s' ORDER BY t.plural DESC", $language->language, 'default');
 
   $translations = $plurals = array();
   while ($data = db_fetch_object($result)) {
@@ -2156,7 +2156,7 @@ function _locale_rebuild_js($langcode = 
   elseif (!empty($language->javascript)) {
     // Delete the old JavaScript file
     file_delete(file_create_path(variable_get('locale_js_directory', 'languages') .'/'. $language->language .'_'. $language->javascript .'.js'));
-    db_query("UPDATE {languages} SET javascript = '' WHERE language = '%s'", $language->language);
+    db_query("UPDATE {languages} SET javascript = '%s' WHERE language = '%s'", '', $language->language);
     watchdog('locale', 'Deleted JavaScript translation file for the locale %language.', array('%language' => t($language->name)));
   }
 }
@@ -2423,7 +2423,7 @@ function locale_batch_by_language($langc
 
   // Collect all files to import for all enabled modules and themes.
   $files = array();
-  $result = db_query("SELECT name, filename FROM {system} WHERE status = 1");
+  $result = db_query("SELECT name, filename FROM {system} WHERE status = %d", 1);
   while ($component = db_fetch_object($result)) {
     // Collect all files for all components, names as $langcode.po or
     // with names ending with $langcode.po. This allows for filenames
@@ -2492,7 +2492,7 @@ function locale_batch_by_component($comp
   if (count($languages[1])) {
     $language_list = join('|', array_keys($languages[1]));
     // Collect all files to import for all $components.
-    $result = db_query("SELECT name, filename FROM {system} WHERE status = 1");
+    $result = db_query("SELECT name, filename FROM {system} WHERE status = %d", 1);
     while ($component = db_fetch_object($result)) {
       if (in_array($component->name, $components)) {
         // Collect all files for this component in all enabled languages, named
diff -urpN drupal/includes/menu.inc drupal-6.x-dev-clean_query-0.1/includes/menu.inc
--- drupal/includes/menu.inc	2007-09-10 20:21:30.000000000 +0800
+++ drupal-6.x-dev-clean_query-0.1/includes/menu.inc	2007-09-15 01:27:26.000000000 +0800
@@ -723,7 +723,7 @@ function menu_tree_page_data($menu_name 
             // Collect all the links set to be expanded, and then add all of
             // their children to the list as well.
             do {
-              $result = db_query("SELECT mlid FROM {menu_links} WHERE menu_name = '%s' AND expanded = 1 AND has_children = 1 AND plid IN (". $placeholders .') AND mlid NOT IN ('. $placeholders .')', array_merge(array($menu_name), $args, $args));
+              $result = db_query("SELECT mlid FROM {menu_links} WHERE menu_name = '%s' AND expanded = %d AND has_children = %d AND plid IN (". $placeholders .') AND mlid NOT IN ('. $placeholders .')', array_merge(array($menu_name, 1, 1), $args, $args));
               $num_rows = FALSE;
               while ($item = db_fetch_array($result)) {
                 $args[] = $item['mlid'];
@@ -1492,7 +1492,7 @@ function _menu_navigation_links_rebuild(
       }
     }
   }
-  $result = db_query("SELECT ml.link_path, ml.mlid, ml.router_path FROM {menu_links} ml WHERE ml.updated = 1");
+  $result = db_query("SELECT ml.link_path, ml.mlid, ml.router_path FROM {menu_links} ml WHERE ml.updated = %d", 1);
   while ($item = db_fetch_array($result)) {
     $router_path = _menu_find_router_path($menu, $item['link_path']);
     if (!empty($router_path) && $router_path != $item['router_path']) {
@@ -1684,7 +1684,7 @@ function menu_link_save(&$item) {
   }
   // Keep track of which menus have expanded items.
   $names = array();
-  $result = db_query("SELECT menu_name FROM {menu_links} WHERE expanded != 0 GROUP BY menu_name");
+  $result = db_query("SELECT menu_name FROM {menu_links} WHERE expanded != %d GROUP BY menu_name", 0);
   while ($n = db_fetch_array($result)) {
     $names[] = $n['menu_name'];
   }
@@ -1810,7 +1810,7 @@ function _menu_update_parental_status($i
     // We may want to exclude the passed link as a possible child.
     $where = $exclude ? " AND mlid != %d" : '';
     // Check if at least one visible child exists in the table.
-    $parent_has_children = (bool)db_result(db_query_range("SELECT mlid FROM {menu_links} WHERE menu_name = '%s' AND plid = %d AND hidden = 0". $where, $item['menu_name'], $item['plid'], $item['mlid'], 0, 1));
+    $parent_has_children = (bool)db_result(db_query_range("SELECT mlid FROM {menu_links} WHERE menu_name = '%s' AND plid = %d AND hidden = %d". $where, $item['menu_name'], $item['plid'], 0, $item['mlid'], 0, 1));
     db_query("UPDATE {menu_links} SET has_children = %d WHERE mlid = %d", $parent_has_children, $item['plid']);
   }
 }
diff -urpN drupal/includes/module.inc drupal-6.x-dev-clean_query-0.1/includes/module.inc
--- drupal/includes/module.inc	2007-09-05 05:10:45.000000000 +0800
+++ drupal-6.x-dev-clean_query-0.1/includes/module.inc	2007-09-15 01:28:52.000000000 +0800
@@ -58,10 +58,10 @@ function module_list($refresh = FALSE, $
     }
     else {
       if ($bootstrap) {
-        $result = db_query("SELECT name, filename, throttle FROM {system} WHERE type = 'module' AND status = 1 AND bootstrap = 1 ORDER BY weight ASC, filename ASC");
+        $result = db_query("SELECT name, filename, throttle FROM {system} WHERE type = '%s' AND status = %d AND bootstrap = %d ORDER BY weight ASC, filename ASC", 'module', 1, 1);
       }
       else {
-        $result = db_query("SELECT name, filename, throttle FROM {system} WHERE type = 'module' AND status = 1 ORDER BY weight ASC, filename ASC");
+        $result = db_query("SELECT name, filename, throttle FROM {system} WHERE type = '%s' AND status = %d ORDER BY weight ASC, filename ASC", 'module', 1);
       }
       while ($module = db_fetch_object($result)) {
         if (file_exists($module->filename)) {
diff -urpN drupal/includes/path.inc drupal-6.x-dev-clean_query-0.1/includes/path.inc
--- drupal/includes/path.inc	2007-06-18 14:59:11.000000000 +0800
+++ drupal-6.x-dev-clean_query-0.1/includes/path.inc	2007-09-15 01:30:04.000000000 +0800
@@ -65,7 +65,7 @@ function drupal_lookup_path($action, $pa
         return $map[$path_language][$path];
       }
       // Get the most fitting result falling back with alias without language
-      $alias = db_result(db_query("SELECT dst FROM {url_alias} WHERE src = '%s' AND language IN('%s', '') ORDER BY language DESC", $path, $path_language));
+      $alias = db_result(db_query("SELECT dst FROM {url_alias} WHERE src = '%s' AND language IN('%s', '%s') ORDER BY language DESC", $path, $path_language, ''));
       $map[$path_language][$path] = $alias;
       return $alias;
     }
@@ -76,7 +76,7 @@ function drupal_lookup_path($action, $pa
       $src = '';
       if (!isset($map[$path_language]) || !($src = array_search($path, $map[$path_language]))) {
         // Get the most fitting result falling back with alias without language
-        if ($src = db_result(db_query("SELECT src FROM {url_alias} WHERE dst = '%s' AND language IN('%s', '') ORDER BY language DESC", $path, $path_language))) {
+        if ($src = db_result(db_query("SELECT src FROM {url_alias} WHERE dst = '%s' AND language IN('%s', '%s') ORDER BY language DESC", $path, $path_language, ''))) {
           $map[$path_language][$src] = $path;
         }
         else {
diff -urpN drupal/update.php drupal-6.x-dev-clean_query-0.1/update.php
--- drupal/update.php	2007-09-02 23:19:16.000000000 +0800
+++ drupal-6.x-dev-clean_query-0.1/update.php	2007-09-15 01:03:58.000000000 +0800
@@ -191,7 +191,7 @@ function update_fix_schema_version() {
         break;
     }
     // Set all enabled (contrib) modules to schema version 0 (installed)
-    db_query('UPDATE {system} SET schema_version = 0 WHERE status = 1');
+    db_query('UPDATE {system} SET schema_version = %d WHERE status = %d', 0, 1);
 
     // Set schema version for core
     drupal_set_installed_schema_version('system', $sql_updates[$update_start]);
@@ -713,7 +713,7 @@ function update_fix_compatibility() {
   $incompatible = array();
   $themes = system_theme_data();
   $modules = module_rebuild_cache();
-  $query = db_query("SELECT name, type, status FROM {system} WHERE status = 1 AND type IN ('module','theme')");
+  $query = db_query("SELECT name, type, status FROM {system} WHERE status = %d AND type IN ('%s', '%s')", 1, 'module', 'theme');
   while ($result = db_fetch_object($query)) {
     $name = $result->name;
     $file = array();