Same bug class as the awardPoints() fix - :q was reused three times in one
WHERE clause, which fails under real (non-emulated) prepared statements.
Split into distinct :q1/:q2/:q3 placeholders each bound to the same value.
(The other flagged file, admin/import-export.php, turned out to be a false
positive from the earlier scan - the duplicate ":checked"/"::before" matches
were CSS pseudo-selectors inside a <style> block, not SQL placeholders.)
Myron Blair
myron