--- og_teampage.module	2007-07-10 02:36:46.000000000 -0400
+++ og_teampage_db_query.module	2008-04-27 12:59:57.484375000 -0400
@@ -53,7 +53,7 @@ function og_teampage_nodeapi(&$node, $op
 	if (($op == 'view') && (og_is_group_type($node->type))) {
 		if ($teaser == FALSE) {
 			$res = db_query("SELECT * FROM {og_teampage_members}
-				WHERE uid='0' AND gid='".$node->nid."' AND hidden='3'");
+				WHERE uid='0' AND gid=%d AND hidden='3'", $node->nid);
 			if (db_num_rows($res) > 0) {
 				$node->content['og_mission']['#value'] =
 				substr($node->content['og_mission']['#value'],0,
@@ -71,7 +71,7 @@ function sort_members_array($a, $b) {
 }
 
 function og_teampage_teamtable($gid) {
-	$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid='0' AND gid='".$gid."'");
+	$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid='0' AND gid=%d", $gid);
 	$test = db_fetch_object($res);
 	$use_userimage = 0;
 	if ($test->weight == '1') $use_userimage = 1;
@@ -81,16 +81,16 @@ function og_teampage_teamtable($gid) {
 	$min_is_active = 1;
 	$min_is_admin = 0;
 	
-	$sql = "SELECT u.uid, u.name, u.picture, ou.* FROM {og_uid} ou INNER JOIN {users} u ON ou.uid = u.uid WHERE ou.nid = %b AND u.status > 0 AND is_active >= $min_is_active AND is_admin >= $min_is_admin ORDER BY u.name ASC";
-	$result = db_query($sql, $gid);
+	$sql = "SELECT u.uid, u.name, u.picture, ou.* FROM {og_uid} ou INNER JOIN {users} u ON ou.uid = u.uid WHERE ou.nid = %d AND u.status > 0 AND is_active >= %d AND is_admin >= %d ORDER BY u.name ASC";
+	$result = db_query($sql, $gid, $min_is_active, $min_is_admin);
     $i=0;
     while ($account = db_fetch_object($result)) {
         $rows[$i][username] = $account->name;
 		$rows[$i][uid] = $account->uid;
 		$rows[$i][picture] = $account->picture;
-		$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid='".$account->uid."' AND gid='".$gid."'");
+		$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid=%d AND gid=%d", $account->uid, %gid);
 		if (db_num_rows($res) < 1) {
-			$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid='".$account->uid."' AND gid='0'");
+			$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid=%d AND gid=0", $account->uid);
 		}
 		$rows[$i][data] = db_fetch_object($res);
         $i++;
@@ -184,7 +184,7 @@ function og_teampage_admin_members_form(
 	$form['#attributes']['enctype'] = 'multipart/form-data';
 	$form['gid'] = array('#type' => 'value', '#value' => $gid);
 	$form['submit'] = array('#type' => 'submit', '#value' => t('Save changes'));
-	$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid='0' AND gid='".$gid."'");
+	$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid=0 AND gid=%d", $gid);
 	$data = db_fetch_object($res);
 	$val = 0;
 	if ($data->hidden == '3') $val = '1';
@@ -223,9 +223,9 @@ function og_teampage_admin_members_form(
 		$form[$uid][op] = array('#type' => 'markup', '#value' => $ophtml);
 		$form[$uid][username] = array('#type' => 'markup', '#value' => theme('username', $account));	
 		
-		$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid='".$uid."' AND gid='".$gid."'");
+		$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid=%d AND gid=%d", $uid, $gid);
 		if (db_num_rows($res) < 1) {
-			$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid='".$uid."' AND gid='0'");
+			$res = db_query("SELECT * FROM {og_teampage_members} WHERE uid=%d AND gid=0", $uid);
 		}
 		$data = db_fetch_object($res);
 		$form[$uid][weight] = array('#type' => 'weight', '#default_value' => $data->weight, '#title' => t('Weight'), '#delta' => 10);
@@ -313,7 +313,7 @@ function og_teampage_filter($op, $delta 
 function og_teampage_admin_members_form_submit($form_id, $form_values) {
     $error = FALSE;
 	$gid = $form_values['gid'];
-	db_query("DELETE FROM {og_teampage_members} WHERE uid='0' AND gid='".$gid."'");
+	db_query("DELETE FROM {og_teampage_members} WHERE uid='0' AND gid=%d", $gid);
 	if ($form_values['showtable'] == 1)
 	{
 		$hidden = 3;
@@ -322,7 +322,8 @@ function og_teampage_admin_members_form_
 	{
 		$weight = 1;
 	} else $weight =0;
-	db_query("INSERT INTO {og_teampage_members} SET uid='0', gid='".$gid."', weight='".$weight."',hidden='".$hidden."'");
+	db_query("INSERT INTO {og_teampage_members} SET uid='0', gid=%d, weight=%d, hidden=%d",
+    $gid, $weight, $hidden);
 	foreach ($form_values as $uid => $value) {
 		if (isset($value['description'])&& is_array($value)) {	
 			if ($value['image_delete'] == 1)
@@ -342,8 +343,9 @@ function og_teampage_admin_members_form_
 					}
 				}
 			if ($newfilename == '') $newfilename = $value['image_oldpath'];
-			$res = db_query("DELETE FROM {og_teampage_members} WHERE uid='".$uid."' AND gid='".$gid."'");
-			$res = db_query("INSERT INTO {og_teampage_members} SET weight='".$value['weight']."', uid='".$uid."', gid='".$gid."', hidden='".$value['hidden']."', name='".$value['name']."', description='".$value['description']."', picture1='".$newfilename."'");
+			$res = db_query("DELETE FROM {og_teampage_members} WHERE uid=%d AND gid=%d", $uid, $gid);
+			$res = db_query("INSERT INTO {og_teampage_members} SET weight=%d, uid=%d, gid=%d, hidden=%d, name='%s', description='%s', picture1='%s'",
+        $value['weight'], $uid, $gid, $value['hidden'], $value['name'], $value['description'], $newfilename);
 		}
 	}
 	$res = db_query("DELETE FROM {cache} WHERE 1 = 1");
@@ -355,7 +357,7 @@ function og_teampage_check_access($gid)
 {
 	$ret = false;
 	global $user;
-	$res = db_query("SELECT * FROM {og_uid} WHERE uid='".$user->uid."' AND nid='".$gid."'");
+	$res = db_query("SELECT * FROM {og_uid} WHERE uid=%d AND nid=%d", $user->uid, $gid);
 	$data = db_fetch_object($res);
 	if (($data->is_active == 1) && ($data->is_admin == 1)) $ret = true;
 	return $ret;