← All changes | pb_templates/chart-builder-elementor.php +20 -15 3.1.4 → 3.8.1 View file →

		@@ -68,14 +68,14 @@
68	68	</style>';
69	69	}
70	70
71	71	$settings = $this->get_settings_for_display();
72		- echo ("<div class='chart-elementor-container'>
73		- [ays_chart id={$settings['chart_selector']}]
74		- </div>");
	72	+ echo '<div class="chart-elementor-container">';
	73	+ echo esc_html( "[ays_chart id=" . $settings['chart_selector'] . "]" );
	74	+ echo '</div>';
75	75	if ( ( isset( $_REQUEST['action'] ) && $_REQUEST['action'] == 'elementor' ) || ( isset( $_REQUEST['action'] ) && $_REQUEST['action'] == 'elementor_ajax' ) ) {
76	76	echo ("<p style='margin:4px 0 0 3px;font-size:12px;font-style:italic;'>
77		- " . __( 'Note: The chart will be visible on the front end of your website.', "chart-builder" ) . "
	77	+ " . esc_html__( 'Note: The chart will be visible on the front end of your website.', "chart-builder" ) . "
78	78	</p>");
79	79	}
80	80	}
81	81
		@@ -82,14 +82,17 @@
82	82	public function get_active_charts(){
83	83	global $wpdb;
84	84	$current_user = get_current_user_id();
85	85	$charts_table = $wpdb->prefix . CHART_BUILDER_DB_PREFIX . 'charts';
86		- $sql = "SELECT id,title FROM {$charts_table} WHERE `status`='published'";
87		- if( ! current_user_can( 'manage_options' ) ){
88		- $sql .= " AND author_id = ". absint( $current_user ) ." ";
	86	+ $sql = "SELECT id, title FROM {$charts_table} WHERE `status` = %s";
	87	+ $params = ['published'];
	88	+ if (!current_user_can('manage_options')) {
	89	+ $sql .= " AND author_id = %d";
	90	+ $params[] = absint($current_user);
89	91	}
90		- $sql .= " ORDER BY id DESC";
91		- $results = $wpdb->get_results( $sql, ARRAY_A );
	92	+ $sql .= " ORDER BY id DESC ";
	93	+ // phpcs:ignore
	94	+ $results = $wpdb->get_results($wpdb->prepare($sql, ...$params), ARRAY_A);
92	95	$options = array();
93	96	foreach ( $results as $result ){
94	97	$options[$result['id']] = $result['title'];
95	98	}
		@@ -99,15 +102,17 @@
99	102	public function get_default_chart(){
100	103	global $wpdb;
101	104	$current_user = get_current_user_id();
102	105	$charts_table = $wpdb->prefix . CHART_BUILDER_DB_PREFIX . 'charts';
103		- $sql = "SELECT id FROM {$charts_table} WHERE `status`='published'";
104		- if( ! current_user_can( 'manage_options' ) ){
105		- $sql .= " AND author_id = ". absint( $current_user ) ." ";
	106	+ $sql = "SELECT id FROM {$charts_table} WHERE `status` = %s";
	107	+ $params = ['published'];
	108	+ if (!current_user_can('manage_options')) {
	109	+ $sql .= " AND author_id = %d";
	110	+ $params[] = absint($current_user);
106	111	}
107		- $sql .= " ORDER BY id DESC LIMIT 1;";
108		- $id = $wpdb->get_var( $sql );
109		-
	112	+ $sql .= " ORDER BY id DESC LIMIT 1";
	113	+ // phpcs:ignore
	114	+ $id = $wpdb->get_var($wpdb->prepare($sql, ...$params));
110	115	return intval($id);
111	116	}
112	117
113	118	protected function content_template() {}