Always use placeholders in prepared SQL statements

[frankiejarrett]

Fixes #354

Originally, I was just going to remove the prepare statement altogether (see e4155a9).

Then I decided to just keep the prepare and enter a placeholder (see 941ea29).

Either way is justifiable I think, just a matter of preference and preparing just brings another layer of comfort for the paranoid.

[westonruter]

@fjarrett this won't work. It will result in something like:

$where .= " AND $wpdb->stream.ID IN (\"1,2,3,4,5,6\")";

What needs to be done instead is this:

$record__in = array_filter( (array) $args['record__in'], 'is_numeric' );
if ( ! empty( $record__in ) ) {
    $record__in_sql = join( ', ', array_map( function( $record_id ) use ( $wpdb ) {
        return $wpdb->prepare( '%d', $record_id );
    }, $record__in ) );
    $where .= " AND $wpdb->stream.ID IN ($record__in_sql)";
}

[frankiejarrett]

@westonruter Oh whoops, it seems @faishal has already done this in #362. Somehow I missed that! Closing this PR...

[powelski]

@westonruter @fjarrett By the way, that way of forcing placeholders is not very smart: https://github.com/WordPress/WordPress/blob/master/wp-includes/wp-db.php#L1143-L1145 😃