← All changes | includes/Core/Database/ApiModel.php +54 -27 2.10.0 → 3.3.1 View file →

		@@ -30,11 +30,12 @@
30	30
31	31	public function getField($id)
32	32	{
33	33	$result = $this->_wpdb->get_results(
34		- "
35		- SELECT form_content,id FROM `{$this->_wpdb->prefix}bitforms_form` WHERE `status`=1 AND `id`='$id'
36		- "
	34	+ $this->_wpdb->prepare(
	35	+ "SELECT form_content,id FROM `{$this->_wpdb->prefix}bitforms_form` WHERE `status`=1 AND `id`=%d",
	36	+ $id
	37	+ )
37	38	);
38	39	return $result;
39	40	}
40	41
		@@ -40,11 +41,12 @@
40	41
41	42	public function editEntry($entryID)
42	43	{
43	44	$result = $this->_wpdb->get_results(
44		- "
45		- SELECT bitforms_form_entry_id,meta_key,meta_value FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id`='$entryID'
46		- "
	45	+ $this->_wpdb->prepare(
	46	+ "SELECT bitforms_form_entry_id,meta_key,meta_value FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id`=%d",
	47	+ $entryID
	48	+ )
47	49	);
48	50	return $result;
49	51	}
50	52
		@@ -49,9 +51,12 @@
49	51	}
50	52
51	53	public function entryDelete($entryID)
52	54	{
53		- $sql = "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id` = $entryID";
	55	+ $sql = $this->_wpdb->prepare(
	56	+ "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id` = %d",
	57	+ $entryID
	58	+ );
54	59	$result = $this->_wpdb->query($sql);
55	60	return $result;
56	61	}
57	62
		@@ -56,14 +61,25 @@
56	61	}
57	62
58	63	public function findRecord($table_name, $column, $value)
59	64	{
60		- $result = $this->_wpdb->get_results(
61		- "
62		- SELECT $column FROM `{$this->_wpdb->prefix}$table_name` WHERE `$column`='$value'
63		- "
	65	+ // Identifiers (table/column) cannot be parameterized with wpdb placeholders.
	66	+ // Sanitize identifiers to prevent SQL injection through dynamic identifiers.
	67	+ $safeTable = preg_replace('/[^A-Za-z0-9_]/', '', (string) $table_name);
	68	+ $safeColumn = preg_replace('/[^A-Za-z0-9_]/', '', (string) $column);
	69	+ $table_name = $this->_wpdb->prefix . $safeTable;
	70	+ $value = is_scalar($value) ? $value : ''; // Ensure value is scalar for placeholder.
	71	+ if ('' === $safeTable || '' === $safeColumn) {
	72	+ return [];
	73	+ }
	74	+
	75	+ $sql = $this->_wpdb->prepare(
	76	+ 'SELECT `%1$s` FROM `%2$s` WHERE `%1$s`=%3$s',
	77	+ $safeColumn,
	78	+ $table_name,
	79	+ $value
64	80	);
65		- return $result;
	81	+ return $this->_wpdb->get_results($sql);
66	82	}
67	83
68	84	public function noteCreate($formID, $entryID, $note_details)
69	85	{
		@@ -85,13 +101,9 @@
85	101	}
86	102
87	103	public function noteList()
88	104	{
89		- $result = $this->_wpdb->get_results(
90		- "
91		- SELECT * FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `status`=1
92		- "
93		- );
	105	+ $result = $this->_wpdb->get_results("SELECT * FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `status`=1");
94	106	return $result;
95	107	}
96	108
97	109	public function getWorkFlow($formID)
		@@ -96,11 +108,12 @@
96	108
97	109	public function getWorkFlow($formID)
98	110	{
99	111	$result = $this->_wpdb->get_results(
100		- "
101		- SELECT workflow_name,id FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id`= $formID
102		- "
	112	+ $this->_wpdb->prepare(
	113	+ "SELECT workflow_name,id FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id` = %d",
	114	+ $formID
	115	+ )
103	116	);
104	117	return $result;
105	118	}
106	119
		@@ -118,9 +131,12 @@
118	131	}
119	132
120	133	public function noteDelete($noteID)
121	134	{
122		- $sql = "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `id` = $noteID";
	135	+ $sql = $this->_wpdb->prepare(
	136	+ "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `id` = %d",
	137	+ $noteID
	138	+ );
123	139	$result = $this->_wpdb->query($sql);
124	140	return $result;
125	141	}
126	142
		@@ -125,9 +141,12 @@
125	141	}
126	142
127	143	public function get_form_value($entryID)
128	144	{
129		- $sql = "SELECT `meta_key`,`meta_value` FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` where bitforms_form_entry_id=$entryID";
	145	+ $sql = $this->_wpdb->prepare(
	146	+ "SELECT `meta_key`,`meta_value` FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE bitforms_form_entry_id=%d",
	147	+ $entryID
	148	+ );
130	149	$result = $this->_wpdb->get_results($sql);
131	150	return $result;
132	151	}
133	152
		@@ -135,9 +154,13 @@
135	154	{
136	155	if (empty($logID)) {
137	156	return false;
138	157	}
139		- $sql = "UPDATE `{$this->_wpdb->prefix}bitforms_form_entry_log` SET content='$updateValue' WHERE id=$logID";
	158	+ $sql = $this->_wpdb->prepare(
	159	+ "UPDATE `{$this->_wpdb->prefix}bitforms_form_entry_log` SET content=%s WHERE id=%d",
	160	+ $updateValue,
	161	+ $logID
	162	+ );
140	163	$result = $this->_wpdb->get_results($sql);
141	164	return $result;
142	165	}
143	166
		@@ -142,9 +165,12 @@
142	165	}
143	166
144	167	public function getFormId($formID)
145	168	{
146		- $sql = "SELECT form_id FROM `{$this->_wpdb->prefix}bitforms_form_entries` WHERE id=$formID";
	169	+ $sql = $this->_wpdb->prepare(
	170	+ "SELECT form_id FROM `{$this->_wpdb->prefix}bitforms_form_entries` WHERE id=%d",
	171	+ $formID
	172	+ );
147	173	$result = $this->_wpdb->get_results($sql);
148	174	return $result;
149	175	}
150	176
		@@ -149,11 +175,12 @@
149	175	}
150	176
151	177	public function getOnSubmitWorkflow($formID)
152	178	{
153		- $sql = "SELECT `id`, `workflow_name`, `workflow_type`, `workflow_run`, `workflow_behaviour`
154		- FROM `{$this->_wpdb->prefix}bitforms_workflows`
155		- WHERE `form_id`=$formID AND `workflow_type`='onsubmit' order by id desc";
	179	+ $sql = $this->_wpdb->prepare(
	180	+ "SELECT `id`, `workflow_name`, `workflow_type`, `workflow_run`, `workflow_behaviour`, `workflow_status` FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id`=%d AND `workflow_type`='onsubmit' ORDER BY id DESC",
	181	+ $formID
	182	+ );
156	183	$result = $this->_wpdb->get_results($sql);
157	184	return $result;
158	185	}
159	186	}