← All changes | includes/Core/Database/ApiModel.php +24 -62 3.2.1 → 2.7.0 View file →

		@@ -9,10 +9,8 @@
9	9	*/
10	10
11	11	class ApiModel extends Model
12	12	{
13		- public $_wpdb;
14		-
15	13	public function __construct()
16	14	{
17	15	global $wpdb;
18	16	$this->_wpdb = $wpdb;
		@@ -30,12 +28,11 @@
30	28
31	29	public function getField($id)
32	30	{
33	31	$result = $this->_wpdb->get_results(
34		- $this->_wpdb->prepare(
35		- "SELECT form_content,id FROM `{$this->_wpdb->prefix}bitforms_form` WHERE `status`=1 AND `id`=%d",
36		- $id
37		- )
	32	+ "
	33	+ SELECT form_content,id FROM `{$this->_wpdb->prefix}bitforms_form` WHERE `status`=1 AND `id`='$id'
	34	+ "
38	35	);
39	36	return $result;
40	37	}
41	38
		@@ -41,12 +38,11 @@
41	38
42	39	public function editEntry($entryID)
43	40	{
44	41	$result = $this->_wpdb->get_results(
45		- $this->_wpdb->prepare(
46		- "SELECT bitforms_form_entry_id,meta_key,meta_value FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id`=%d",
47		- $entryID
48		- )
	42	+ "
	43	+ SELECT bitforms_form_entry_id,meta_key,meta_value FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id`='$entryID'
	44	+ "
49	45	);
50	46	return $result;
51	47	}
52	48
		@@ -51,12 +47,9 @@
51	47	}
52	48
53	49	public function entryDelete($entryID)
54	50	{
55		- $sql = $this->_wpdb->prepare(
56		- "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id` = %d",
57		- $entryID
58		- );
	51	+ $sql = "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id` = $entryID";
59	52	$result = $this->_wpdb->query($sql);
60	53	return $result;
61	54	}
62	55
		@@ -61,25 +54,14 @@
61	54	}
62	55
63	56	public function findRecord($table_name, $column, $value)
64	57	{
65		- // Identifiers (table/column) cannot be parameterized with wpdb placeholders.
66		- // Sanitize identifiers to prevent SQL injection through dynamic identifiers.
67		- $safeTable = preg_replace('/[^A-Za-z0-9_]/', '', (string) $table_name);
68		- $safeColumn = preg_replace('/[^A-Za-z0-9_]/', '', (string) $column);
69		- $table_name = $this->_wpdb->prefix . $safeTable;
70		- $value = is_scalar($value) ? $value : ''; // Ensure value is scalar for placeholder.
71		- if ('' === $safeTable || '' === $safeColumn) {
72		- return [];
73		- }
74		-
75		- $sql = $this->_wpdb->prepare(
76		- 'SELECT `%1$s` FROM `%2$s` WHERE `%1$s`=%3$s',
77		- $safeColumn,
78		- $table_name,
79		- $value
	58	+ $result = $this->_wpdb->get_results(
	59	+ "
	60	+ SELECT $column FROM `{$this->_wpdb->prefix}$table_name` WHERE `$column`='$value'
	61	+ "
80	62	);
81		- return $this->_wpdb->get_results($sql);
	63	+ return $result;
82	64	}
83	65
84	66	public function noteCreate($formID, $entryID, $note_details)
85	67	{
		@@ -101,9 +83,13 @@
101	83	}
102	84
103	85	public function noteList()
104	86	{
105		- $result = $this->_wpdb->get_results("SELECT * FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `status`=1");
	87	+ $result = $this->_wpdb->get_results(
	88	+ "
	89	+ SELECT * FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `status`=1
	90	+ "
	91	+ );
106	92	return $result;
107	93	}
108	94
109	95	public function getWorkFlow($formID)
		@@ -108,12 +94,11 @@
108	94
109	95	public function getWorkFlow($formID)
110	96	{
111	97	$result = $this->_wpdb->get_results(
112		- $this->_wpdb->prepare(
113		- "SELECT workflow_name,id FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id` = %d",
114		- $formID
115		- )
	98	+ "
	99	+ SELECT workflow_name,id FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id`= $formID
	100	+ "
116	101	);
117	102	return $result;
118	103	}
119	104
		@@ -131,12 +116,9 @@
131	116	}
132	117
133	118	public function noteDelete($noteID)
134	119	{
135		- $sql = $this->_wpdb->prepare(
136		- "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `id` = %d",
137		- $noteID
138		- );
	120	+ $sql = "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `id` = $noteID";
139	121	$result = $this->_wpdb->query($sql);
140	122	return $result;
141	123	}
142	124
		@@ -141,12 +123,9 @@
141	123	}
142	124
143	125	public function get_form_value($entryID)
144	126	{
145		- $sql = $this->_wpdb->prepare(
146		- "SELECT `meta_key`,`meta_value` FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE bitforms_form_entry_id=%d",
147		- $entryID
148		- );
	127	+ $sql = "SELECT `meta_key`,`meta_value` FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` where bitforms_form_entry_id=$entryID";
149	128	$result = $this->_wpdb->get_results($sql);
150	129	return $result;
151	130	}
152	131
		@@ -154,13 +133,9 @@
154	133	{
155	134	if (empty($logID)) {
156	135	return false;
157	136	}
158		- $sql = $this->_wpdb->prepare(
159		- "UPDATE `{$this->_wpdb->prefix}bitforms_form_entry_log` SET content=%s WHERE id=%d",
160		- $updateValue,
161		- $logID
162		- );
	137	+ $sql = "UPDATE `{$this->_wpdb->prefix}bitforms_form_entry_log` SET content='$updateValue' WHERE id=$logID";
163	138	$result = $this->_wpdb->get_results($sql);
164	139	return $result;
165	140	}
166	141
		@@ -165,22 +140,9 @@
165	140	}
166	141
167	142	public function getFormId($formID)
168	143	{
169		- $sql = $this->_wpdb->prepare(
170		- "SELECT form_id FROM `{$this->_wpdb->prefix}bitforms_form_entries` WHERE id=%d",
171		- $formID
172		- );
173		- $result = $this->_wpdb->get_results($sql);
174		- return $result;
175		- }
176		-
177		- public function getOnSubmitWorkflow($formID)
178		- {
179		- $sql = $this->_wpdb->prepare(
180		- "SELECT `id`, `workflow_name`, `workflow_type`, `workflow_run`, `workflow_behaviour`, `workflow_status` FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id`=%d AND `workflow_type`='onsubmit' ORDER BY id DESC",
181		- $formID
182		- );
	144	+ $sql = "SELECT form_id FROM `{$this->_wpdb->prefix}bitforms_form_entries` WHERE id=$formID";
183	145	$result = $this->_wpdb->get_results($sql);
184	146	return $result;
185	147	}
186	148	}