As it says in wpdb::prepare
Prepares a SQL query for safe execution. Uses sprintf()-like syntax.
Thus, if you change it to:
$sql = $db->prepare("SELECT
ap.photo_id,
ap.creation_date,
ap.owner_id,
ap.file_id,
ap.title AS photo_title,
ap.description,
aa.album_id,
aa.title AS album_title,
aa.category_id,
sf.storage_path,
u.displayname,
u.username
FROM
engine4_album_photos ap
LEFT JOIN engine4_album_albums aa ON aa.album_id = ap.album_id AND category_id <> 0
LEFT JOIN engine4_storage_files sf ON sf.%s = ap.file_id AND sf.user_id = ap.owner_id
JOIN engine4_authorization_allow auth ON auth.resource_id = aa.album_id AND auth.resource_type="album" AND auth.action='view' AND auth.role="everyone"
JOIN engine4_users u ON u.user_id = ap.owner_id
GROUP BY
ap.photo_id
ORDER BY
ap.creation_date DESC %s", $thumbquality == 'yes' ? "parent_file_id" : "file_id", $pullcount);
you’ll be fine.
Edit: I just edited the above code: in my original I forgot to remove the {}
around the interpolated $pullcount
when I replaced it with %s
.