| @@ -821,18 +821,18 @@ | ||
| 821 | 821 | |
| 822 | 822 | public function get_charts($ordering = ''){ |
| 823 | 823 | global $wpdb; |
| 824 | 824 | $charts_table = esc_sql( $wpdb->prefix . CHART_BUILDER_DB_PREFIX ) . "charts"; |
| 825 | - | |
| 826 | - $sql = "SELECT id,title | |
| 827 | - FROM {$charts_table} WHERE `status` = 'published' OR `status` = 'draft'"; | |
| 828 | - | |
| 829 | - | |
| 830 | - if($ordering != ''){ | |
| 831 | - $sql .= ' ORDER BY id '.$ordering; | |
| 825 | + | |
| 826 | + $sql = "SELECT id, title FROM {$charts_table} WHERE `status` IN (%s, %s)"; | |
| 827 | + $params = array('published', 'draft'); | |
| 828 | + | |
| 829 | + if ( $ordering != '' ) { | |
| 830 | + $sql .= " ORDER BY id {$ordering}"; | |
| 832 | 831 | } |
| 833 | - | |
| 834 | - $charts = $wpdb->get_results( $sql , "ARRAY_A" ); | |
| 832 | + // phpcs:ignore | |
| 833 | + $charts = $wpdb->get_results( $wpdb->prepare( $sql, ...$params ), 'ARRAY_A' ); | |
| 834 | + | |
| 835 | 835 | |
| 836 | 836 | return $charts; |
| 837 | 837 | } |
| 838 | 838 | } |
