← All changes | includes/Core/Database/ApiModel.php +27 -54 3.2.2 → 2.15.3 View file →

		@@ -30,12 +30,11 @@
30	30
31	31	public function getField($id)
32	32	{
33	33	$result = $this->_wpdb->get_results(
34		- $this->_wpdb->prepare(
35		- "SELECT form_content,id FROM `{$this->_wpdb->prefix}bitforms_form` WHERE `status`=1 AND `id`=%d",
36		- $id
37		- )
	34	+ "
	35	+ SELECT form_content,id FROM `{$this->_wpdb->prefix}bitforms_form` WHERE `status`=1 AND `id`='$id'
	36	+ "
38	37	);
39	38	return $result;
40	39	}
41	40
		@@ -41,12 +40,11 @@
41	40
42	41	public function editEntry($entryID)
43	42	{
44	43	$result = $this->_wpdb->get_results(
45		- $this->_wpdb->prepare(
46		- "SELECT bitforms_form_entry_id,meta_key,meta_value FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id`=%d",
47		- $entryID
48		- )
	44	+ "
	45	+ SELECT bitforms_form_entry_id,meta_key,meta_value FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id`='$entryID'
	46	+ "
49	47	);
50	48	return $result;
51	49	}
52	50
		@@ -51,12 +49,9 @@
51	49	}
52	50
53	51	public function entryDelete($entryID)
54	52	{
55		- $sql = $this->_wpdb->prepare(
56		- "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id` = %d",
57		- $entryID
58		- );
	53	+ $sql = "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id` = $entryID";
59	54	$result = $this->_wpdb->query($sql);
60	55	return $result;
61	56	}
62	57
		@@ -61,25 +56,14 @@
61	56	}
62	57
63	58	public function findRecord($table_name, $column, $value)
64	59	{
65		- // Identifiers (table/column) cannot be parameterized with wpdb placeholders.
66		- // Sanitize identifiers to prevent SQL injection through dynamic identifiers.
67		- $safeTable = preg_replace('/[^A-Za-z0-9_]/', '', (string) $table_name);
68		- $safeColumn = preg_replace('/[^A-Za-z0-9_]/', '', (string) $column);
69		- $table_name = $this->_wpdb->prefix . $safeTable;
70		- $value = is_scalar($value) ? $value : ''; // Ensure value is scalar for placeholder.
71		- if ('' === $safeTable || '' === $safeColumn) {
72		- return [];
73		- }
74		-
75		- $sql = $this->_wpdb->prepare(
76		- 'SELECT `%1$s` FROM `%2$s` WHERE `%1$s`=%3$s',
77		- $safeColumn,
78		- $table_name,
79		- $value
	60	+ $result = $this->_wpdb->get_results(
	61	+ "
	62	+ SELECT $column FROM `{$this->_wpdb->prefix}$table_name` WHERE `$column`='$value'
	63	+ "
80	64	);
81		- return $this->_wpdb->get_results($sql);
	65	+ return $result;
82	66	}
83	67
84	68	public function noteCreate($formID, $entryID, $note_details)
85	69	{
		@@ -101,9 +85,13 @@
101	85	}
102	86
103	87	public function noteList()
104	88	{
105		- $result = $this->_wpdb->get_results("SELECT * FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `status`=1");
	89	+ $result = $this->_wpdb->get_results(
	90	+ "
	91	+ SELECT * FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `status`=1
	92	+ "
	93	+ );
106	94	return $result;
107	95	}
108	96
109	97	public function getWorkFlow($formID)
		@@ -108,12 +96,11 @@
108	96
109	97	public function getWorkFlow($formID)
110	98	{
111	99	$result = $this->_wpdb->get_results(
112		- $this->_wpdb->prepare(
113		- "SELECT workflow_name,id FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id` = %d",
114		- $formID
115		- )
	100	+ "
	101	+ SELECT workflow_name,id FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id`= $formID
	102	+ "
116	103	);
117	104	return $result;
118	105	}
119	106
		@@ -131,12 +118,9 @@
131	118	}
132	119
133	120	public function noteDelete($noteID)
134	121	{
135		- $sql = $this->_wpdb->prepare(
136		- "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `id` = %d",
137		- $noteID
138		- );
	122	+ $sql = "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `id` = $noteID";
139	123	$result = $this->_wpdb->query($sql);
140	124	return $result;
141	125	}
142	126
		@@ -141,12 +125,9 @@
141	125	}
142	126
143	127	public function get_form_value($entryID)
144	128	{
145		- $sql = $this->_wpdb->prepare(
146		- "SELECT `meta_key`,`meta_value` FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE bitforms_form_entry_id=%d",
147		- $entryID
148		- );
	129	+ $sql = "SELECT `meta_key`,`meta_value` FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` where bitforms_form_entry_id=$entryID";
149	130	$result = $this->_wpdb->get_results($sql);
150	131	return $result;
151	132	}
152	133
		@@ -154,13 +135,9 @@
154	135	{
155	136	if (empty($logID)) {
156	137	return false;
157	138	}
158		- $sql = $this->_wpdb->prepare(
159		- "UPDATE `{$this->_wpdb->prefix}bitforms_form_entry_log` SET content=%s WHERE id=%d",
160		- $updateValue,
161		- $logID
162		- );
	139	+ $sql = "UPDATE `{$this->_wpdb->prefix}bitforms_form_entry_log` SET content='$updateValue' WHERE id=$logID";
163	140	$result = $this->_wpdb->get_results($sql);
164	141	return $result;
165	142	}
166	143
		@@ -165,12 +142,9 @@
165	142	}
166	143
167	144	public function getFormId($formID)
168	145	{
169		- $sql = $this->_wpdb->prepare(
170		- "SELECT form_id FROM `{$this->_wpdb->prefix}bitforms_form_entries` WHERE id=%d",
171		- $formID
172		- );
	146	+ $sql = "SELECT form_id FROM `{$this->_wpdb->prefix}bitforms_form_entries` WHERE id=$formID";
173	147	$result = $this->_wpdb->get_results($sql);
174	148	return $result;
175	149	}
176	150
		@@ -175,12 +149,11 @@
175	149	}
176	150
177	151	public function getOnSubmitWorkflow($formID)
178	152	{
179		- $sql = $this->_wpdb->prepare(
180		- "SELECT `id`, `workflow_name`, `workflow_type`, `workflow_run`, `workflow_behaviour`, `workflow_status` FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id`=%d AND `workflow_type`='onsubmit' ORDER BY id DESC",
181		- $formID
182		- );
	153	+ $sql = "SELECT `id`, `workflow_name`, `workflow_type`, `workflow_run`, `workflow_behaviour`
	154	+ FROM `{$this->_wpdb->prefix}bitforms_workflows`
	155	+ WHERE `form_id`=$formID AND `workflow_type`='onsubmit' order by id desc";
183	156	$result = $this->_wpdb->get_results($sql);
184	157	return $result;
185	158	}
186	159	}