Use prepared queries on the wiki

sections/wiki/add_alias.php

 
 $ArticleID = (int)$_POST['article'];
 
-$DB->query("SELECT MinClassEdit FROM wiki_articles WHERE ID = $ArticleID");
+$DB->prepared_query("SELECT MinClassEdit FROM wiki_articles WHERE ID = $ArticleID");
 list($MinClassEdit) = $DB->next_record();
 
 if ($MinClassEdit > $LoggedUser['EffectiveClass']) {
 $Dupe = Wiki::alias_to_id($_POST['alias']);
 
 if ($NewAlias !== '' && $NewAlias!== 'addalias' && $Dupe === false) { // Not null, and not dupe
-    $DB->query("INSERT INTO wiki_aliases (Alias, UserID, ArticleID) VALUES ('$NewAlias', '$LoggedUser[ID]', '$ArticleID')");
+    $DB->prepared_query("INSERT INTO wiki_aliases (Alias, UserID, ArticleID) VALUES ('$NewAlias', '$LoggedUser[ID]', '$ArticleID')");
 } else {
     error('The alias you attempted to add was either null or already in the database.');
 }

sections/wiki/compare.php

     if ((int) $Rev === $Revision) {
         $Str = $Body;
     } else {
-        $DB->query("
+        $DB->prepared_query("
           SELECT Body
           FROM wiki_revisions
           WHERE ID = '$ID'
   || !is_number($_GET['old'])
   || !is_number($_GET['new'])
   || !is_number($_GET['id'])
-  || $_GET['old'] > $_GET['new']
 ) {
-    error(0);
+    error(400);
+}
+
+if ($_GET['old'] > $_GET['new']) {
+    error('The new revision compared must be newer than the old revision to compare against.');
 }
 
 $ArticleID = (int) $_GET['id'];

sections/wiki/delete.php

     error('You cannot delete the main wiki article.');
 }
 
-$DB->query("
+$DB->prepared_query("
   SELECT Title
   FROM wiki_articles
   WHERE ID = $ID");
 Misc::write_log("Wiki article $ID ($Title) was deleted by ".$LoggedUser['Username']);
 
 // Delete
-$DB->query("DELETE FROM wiki_articles WHERE ID = $ID");
-$DB->query("DELETE FROM wiki_aliases WHERE ArticleID = $ID");
-$DB->query("DELETE FROM wiki_revisions WHERE ID = $ID");
+$DB->prepared_query("DELETE FROM wiki_articles WHERE ID = $ID");
+$DB->prepared_query("DELETE FROM wiki_aliases WHERE ArticleID = $ID");
+$DB->prepared_query("DELETE FROM wiki_revisions WHERE ID = $ID");
 
 Wiki::flush_aliases();
 Wiki::flush_article($ID);

sections/wiki/delete_alias.php

 
 $ArticleID = Wiki::alias_to_id($_GET['alias']);
 
-$DB->query("SELECT MinClassEdit FROM wiki_articles WHERE ID = $ArticleID");
+$DB->prepared_query("SELECT MinClassEdit FROM wiki_articles WHERE ID = $ArticleID");
 list($MinClassEdit) = $DB->next_record();
 if ($MinClassEdit > $LoggedUser['EffectiveClass']) {
     error(403);
 }
 
-$DB->query("DELETE FROM wiki_aliases WHERE Alias='".Wiki::normalize_alias($_GET['alias'])."'");
+$DB->prepared_query("DELETE FROM wiki_aliases WHERE Alias='".Wiki::normalize_alias($_GET['alias'])."'");
 Wiki::flush_article($ArticleID);
 Wiki::flush_aliases();

sections/wiki/revisions.php

       </tr>
 
       <?php
-$DB->query("
+$DB->prepared_query("
   SELECT
     Revision,
     Title,

sections/wiki/search.php

 
         <tr>
           <td colspan="4" class="center">
-            <input type="submit" value="Search" />
+            <input type="submit" class="button-primary" value="Search" />
           </td>
         </tr>
       </table>

sections/wiki/takecreate.php

 $Err = $Val->ValidateForm($_POST);
 
 if (!$Err) {
-    $DB->query("
+    $DB->prepared_query("
       SELECT ID
       FROM wiki_articles
       WHERE Title = '$P[title]'");
     $Edit = 100;
 }
 
-$DB->query("
+$DB->prepared_query("
   INSERT INTO wiki_articles
     (Revision, Title, Body, MinClassRead, MinClassEdit, Date, Author)
   VALUES
 $Dupe = Wiki::alias_to_id($_POST['title']);
 
 if ($TitleAlias !== '' && $Dupe === false) {
-    $DB->query("
+    $DB->prepared_query("
       INSERT INTO wiki_aliases (Alias, ArticleID)
       VALUES ('".db_string($TitleAlias)."', '$ArticleID')");
     Wiki::flush_aliases();

sections/wiki/takeedit.php

 }
 
 // Store previous revision
-$DB->query("
+$DB->prepared_query("
   INSERT INTO wiki_revisions
     (ID, Revision, Title, Body, Date, Author)
   VALUES
     Author = '$LoggedUser[ID]'
   WHERE ID = '$P[id]'";
 
-$DB->query($SQL);
+$DB->prepared_query($SQL);
 Wiki::flush_article($ArticleID);
 header("Location: wiki.php?action=article&id=$ArticleID");

sections/wiki/wiki_browse.php

 }
 
 $sql .= " ORDER BY Title";
-$DB->query($sql);
+$DB->prepared_query($sql);
 ?>
 
 <div>