← All changes | includes/Core/Fallback/EntryMetaFallback.php +1 -0 2.10.1 → 3.3.1 View file →

		@@ -7,8 +7,9 @@
7	7	public function removeAllDuplicateMetaKeysExceptLast()
8	8	{
9	9	global $wpdb;
10	10	$tablename = $wpdb->prefix . 'bitforms_form_entrymeta';
	11	+ // Direct query: table name from $wpdb->prefix concatenation only (no user input). $wpdb->prepare() cannot parameterize table names in self-join delete.
11	12	$sql = $wpdb->query("DELETE a FROM $tablename AS a
12	13	JOIN (
13	14	SELECT bitforms_form_entry_id, meta_key, MAX(meta_id) AS max_id
14	15	FROM $tablename