? drupal-667714-simple.patch
? drupal-667714.patch
Index: includes/database.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/Attic/database.inc,v
retrieving revision 1.92.2.8
diff -u -p -r1.92.2.8 database.inc
--- includes/database.inc	14 Sep 2009 10:49:34 -0000	1.92.2.8
+++ includes/database.inc	7 Jan 2010 20:27:20 -0000
@@ -54,15 +54,27 @@ define('DB_ERROR', 'a515ac9c2796ca0e23ad
  * Perform an SQL query and return success or failure.
  *
  * @param $sql
- *   A string containing a complete SQL query.  %-substitution
- *   parameters are not supported.
+ *   A string containing an SQL query.
+ * @param ...
+ *   A variable number of arguments which are substituted into the query
+ *   using printf() syntax. Instead of a variable number of query arguments,
+ *   you may also pass a single array containing the query arguments.
+ *
+ *   Valid %-modifiers are: %s, %d, %f, %b (binary data, do not enclose
+ *   in '') and %%.
+ *
+ *   NOTE: using this syntax will cast NULL and FALSE values to decimal 0,
+ *   and TRUE values to decimal 1.
+ *
  * @return
  *   An array containing the keys:
  *      success: a boolean indicating whether the query succeeded
  *      query: the SQL query executed, passed through check_plain()
  */
 function update_sql($sql) {
-  $result = db_query($sql, true);
+  $args = func_get_args();
+  array_shift($args);
+  $result = db_query($sql, $args);
   return array('success' => $result !== FALSE, 'query' => check_plain($sql));
 }