--- subscriptions.module.orig	2007-09-24 14:26:54.000000000 -0700
+++ subscriptions.module	2007-09-24 15:14:11.000000000 -0700
@@ -493,19 +493,32 @@ function subscriptions_sendmail($name, $
  * @strsent
  *
  */
-function subscriptions_mailvars($sid, $ssid, $uid, $stype, $strsent) {
+function subscriptions_mailvars($sid, $ssid, $uid, $stype) {
   global $user, $locale;
+  static $sent = array();
   $initial_user = $user;
   $initial_locale = $locale;
   if (function_exists('locale')) {
     $languages = locale_supported_languages();
     $languages = $languages['name'];
   }
+  
+  // We could directly put array_keys in the query string, but let's practice
+  // writing safe queries.
+  if ($sent) {
+    $placeholders = 'u.uid NOT IN (%d'. str_repeat(',%d', count($sent) - 1) .')';
+    $args = $sent;
+    $args[] = $sid;
+  }
+  else {
+    $placeholders = '';
+    $args = $sid;
+  }
   // if comment insertion, get vars
   if ($stype == 'node') {
     $result = db_query('SELECT title FROM {node} WHERE nid = %d', $sid);
     $subject = db_result($result);
-    $result = db_query('SELECT u.uid, u.name, u.mail, u.language FROM {users} u INNER JOIN {subscriptions} s ON u.uid = s.uid WHERE u.status= 1 AND s.sid = %d AND s.stype = \'node\'', $sid);
+    $result = db_query("SELECT u.uid, u.name, u.mail, u.language FROM {users} u INNER JOIN {subscriptions} s ON u.uid = s.uid WHERE $placeholders AND u.status= 1 AND s.sid = %d AND s.stype = 'node'", $args);
     $strtype = 'thread';
     $nid = $sid;
     $cid = $ssid;
@@ -515,17 +528,16 @@ function subscriptions_mailvars($sid, $s
     }
   }
   // if content type, get vars
-  if ($stype == 'type') {
-    $typestr = 'type'. $sid;
-    $result = db_query('SELECT u.mail, u.name, u.uid, u.language FROM {users} u INNER JOIN {subscriptions} s ON u.uid = s.uid WHERE u.status= 1 AND s.stype =\''. $typestr .'\'');
+  if ($stype == 'type' && node_get_types('type', $sid)) {
+    $result = db_query("SELECT u.mail, u.name, u.uid, u.language FROM {users} u INNER JOIN {subscriptions} s ON u.uid = s.uid WHERE $placeholders AND u.status= 1 AND s.stype = 'type%s'", $args);
     $strtype = 'content type';
     $nid = $ssid;
   }
   // if node insert, test if node has a taxonomy else skip
-  if ($stype == 'taxa' && !is_null($sid)) {
+  if ($stype == 'taxa' && isset($sid)) {
     $result = db_query('SELECT name FROM {term_data} WHERE tid = %d', $sid);
     $subject = db_result($result);
-    $result = db_query('SELECT u.mail, u.name, u.uid, u.language FROM {users} u INNER JOIN {subscriptions} s ON u.uid = s.uid WHERE u.status= 1 AND s.sid = %d AND stype = \'taxa\'', $sid);
+    $result = db_query("SELECT u.mail, u.name, u.uid, u.language FROM {users} u INNER JOIN {subscriptions} s ON u.uid = s.uid WHERE  $placeholders AND u.status= 1 AND s.sid = %d AND stype = 'taxa'", $args);
     $strtype = 'category';
     $nid = $ssid;
   }
@@ -533,7 +545,7 @@ function subscriptions_mailvars($sid, $s
   if ($stype == 'blog') {
     $result = db_query('SELECT name FROM {users} WHERE uid = %d', $uid);
     $subject = t('new blog for ') . db_result($result);
-    $result = db_query('SELECT u.uid, u.name, u.mail, u.language FROM {users} u INNER JOIN {subscriptions} s ON u.uid = s.uid WHERE u.status= 1 AND s.sid = %d AND s.stype = \'blog\'', $sid);
+    $result = db_query("SELECT u.uid, u.name, u.mail, u.language FROM {users} u INNER JOIN {subscriptions} s ON u.uid = s.uid WHERE  $placeholders AND u.status= 1 AND s.sid = %d AND s.stype = 'blog'", $args);
     $strtype = 'blog';
     $nid = $ssid;
   }
@@ -563,9 +575,9 @@ function subscriptions_mailvars($sid, $s
     else {
       $teaser = '';
     }
-    if ($selftest && $nodeaccess && !is_null($sid) && strpos($strsent, '!'. $subscriptions->uid .'!') === FALSE) {
-      // add this user to "previously notified" string
-      $strsent .= $subscriptions->uid .'!';
+     if ($selftest && $nodeaccess && isset($sid)) {
+      // add this user to "previously notified" array
+      $sent[$subscriptions->uid] = $subscriptions->uid;
       // translate the message using the reciever's language
       if (function_exists('locale') && $languages[$subscriptions->language]) {
         $locale = $subscriptions->language;
@@ -583,8 +595,6 @@ function subscriptions_mailvars($sid, $s
       subscriptions_sendmail($subscriptions->name, $subscriptions->mail, $mail_subject, $body, $from, $headers);
     }
   }
-
-  return $strsent;
 }
 
 /**
@@ -607,7 +617,6 @@ function subscriptions_autosubscribe($ui
  * handling for held nodes
  */
 function subscriptions_heldnodes($heldnode, $poster) {
-  $strsent = '!';
   $onode = unserialize($heldnode);
   if ($onode->status) {
     if (!empty($onode->taxonomy)) {
@@ -619,21 +628,21 @@ function subscriptions_heldnodes($heldno
           }
           // send taxonomy subscriptions
           foreach ($taxa as $tid) {
-            $strsent .= subscriptions_mailvars($tid, $onode->nid, $poster, 'taxa', $strsent);
+            subscriptions_mailvars($tid, $onode->nid, $poster, 'taxa');
           }
         }
       }
     }
 
-    $strsent .= subscriptions_mailvars($onode->nid, 0, $poster, 'node', $strsent);
+    subscriptions_mailvars($onode->nid, 0, $poster, 'node');
 
     if ($node->type == 'blog') {
-      $strsent .= subscriptions_mailvars($onode->uid, $onode->nid, $poster, 'blog', $strsent);
+      subscriptions_mailvars($onode->uid, $onode->nid, $poster, 'blog');
     }
 
     // @ TODO this is supposed to handle content type sending
     //        does there need to be an if statment here?
-    $strsent .= subscriptions_mailvars($onode->type, $onode->nid, $poster, 'type', $strsent);
+    subscriptions_mailvars($onode->type, $onode->nid, $poster, 'type');
   }
 }
 
@@ -641,8 +650,7 @@ function subscriptions_heldnodes($heldno
  * handling for held comments
  */
 function subscriptions_heldcomments($heldcomment, $poster) {
-  $strsent = '!';
-  subscriptions_mailvars($heldcomment['nid'], $heldcomment['cid'], $poster, 'node', $strsent);
+   subscriptions_mailvars($heldcomment['nid'], $heldcomment['cid'], $poster, 'node');
   // @ TODO taxonomy/type subscribers (missing here, sent in subscriptions_comment for no-cron)
 }
 
@@ -737,7 +745,6 @@ function subscriptions_comment_taxa($com
  */
 function subscriptions_comment($comment, $op) {
   global $user;
-  $strsent = '!';
   // $comment can be an object or an array.
   $comment = (array)$comment;
   if ($op == 'insert' || ($op == 'update' && $comment['status'] == 0)) { // ignore deactivated comments
@@ -749,15 +756,15 @@ function subscriptions_comment($comment,
       $nid = $comment['nid'];
       $nobj = node_load($nid);
       // send node subscriptions
-      $strsent .= subscriptions_mailvars($nid, $comment['cid'], $user->uid, 'node', $strsent);
+      subscriptions_mailvars($nid, $comment['cid'], $user->uid, 'node');
       // get subscription->node->taxonomy
       $taxa = subscriptions_comment_taxa($comment);
       // send to taxonomy subscribers
       foreach ($taxa as $tid) {
-        $strsent .= subscriptions_mailvars($tid, $nid, $user->uid, 'taxa', $strsent);
+       subscriptions_mailvars($tid, $nid, $user->uid, 'taxa');
       }
       // send content type subscriptions
-      $strsent .= subscriptions_mailvars($nobj->type, $nobj->nid, $user->uid, 'type', $strsent);
+      subscriptions_mailvars($nobj->type, $nobj->nid, $user->uid, 'type');
     } // end cron test
     subscriptions_autosubscribe($user->uid, $nid);
   }
@@ -827,7 +834,6 @@ function subscriptions_comment_page($com
  */
 function subscriptions_nodeapi(&$node, $op, $arg = 0) {
   global $user;
-  $strsent = '!';
   switch ($op) {
     case 'update':
       if ($node->status == '0') { // unpublished
@@ -857,18 +863,18 @@ function subscriptions_nodeapi(&$node, $
                 }
                 // send taxonomy subscriptions
                 foreach ($taxa as $tid) {
-                  $strsent .= subscriptions_mailvars($tid, $node->nid, $user->uid, 'taxa', $strsent);
+                  subscriptions_mailvars($tid, $node->nid, $user->uid, 'taxa');
                 }
               }
             }
           }
           // send content type subscriptions
-          $strsent .= subscriptions_mailvars($node->type, $node->nid, $user->uid, 'type', $strsent);
+          subscriptions_mailvars($node->type, $node->nid, $user->uid, 'type');
           // send node subscriptions
-          $strsent .= subscriptions_mailvars($node->nid, 0, $user->uid, 'node', $strsent);
+          subscriptions_mailvars($node->nid, 0, $user->uid, 'node');
           if ($node->type == 'blog') {
             // send blog subscriptions
-            $strsent .= subscriptions_mailvars($node->uid, $node->nid, $user->uid, 'blog', $strsent);
+             subscriptions_mailvars($node->uid, $node->nid, $user->uid, 'blog');
           }
         }
       }  // cron test