[IMP]:Idea sql queries to parameterized query

bzr revid: nch@tinyerp.com-20091126054326-evu8fblc8bmwk3ky

diff --git a/addons/idea/idea.py b/addons/idea/idea.py
index ad5b29e..dff0aa5 100644 (file)
--- a/addons/idea/idea.py
+++ b/addons/idea/idea.py
@@ -46,41 +46,28 @@ class idea_idea(osv.osv):
     def _vote_avg_compute(self, cr, uid, ids, name, arg, context = None):
         if not len(ids):
             return {}
-
-        sql = """select i.id, avg(v.score::integer)
-                   from idea_idea i left outer join idea_vote v on i.id = v.idea_id
-                    where i.id in (%s)
-                    group by i.id
-                """ % ','.join(['%s']*len(ids))
-
-        cr.execute(sql, ids)
+        cr.execute(""" select i.id, avg(v.score::integer)
+                    from idea_idea i left outer join idea_vote v on i.id = v.idea_id
+                    where i.id =ANY(%s)
+                    group by i.id """,(ids,))
         return dict(cr.fetchall())
 
     def _vote_count(self,cr,uid,ids,name,arg,context=None):
         if not len(ids):
             return {}
-
-        sql = """select i.id, count(1)
+        cr.execute("""select i.id, count(1)
                    from idea_idea i left outer join idea_vote v on i.id = v.idea_id
-                    where i.id in (%s)
-                    group by i.id
-                """ % ','.join(['%s']*len(ids))
-
-        cr.execute(sql, ids)
+                    where i.id =ANY(%s)
+                    group by i.id""",(ids,))
         return dict(cr.fetchall())
 
     def _comment_count(self,cr,uid,ids,name,arg,context=None):
         if not len(ids):
             return {}
-
-        sql = """select i.id, count(1)
+        cr.execute("""select i.id, count(1)
                    from idea_idea i left outer join idea_comment c on i.id = c.idea_id
-                    where i.id in (%s)
-                    group by i.id
-                """ % ','.join(['%s']*len(ids))
-
-
-        cr.execute(sql,ids)
+                    where i.id =ANY(%s)
+                    group by i.id""",(ids,))
         return dict(cr.fetchall())
 
     def _vote_read(self, cr, uid, ids, name, arg, context = None):