← All changes | qcld-wpwbot-search.php +9 -9 8.7.4 → 8.8.0 View file →

		@@ -639,9 +639,9 @@
639	639
640	640	$table = $wpdb->prefix . 'wpbot_response';
641	641	$table_sql = '`' . esc_sql( $table ) . '`';
642	642
643		- $result = $wpdb->get_row( $wpdb->prepare( "SELECT `response` FROM {$table_sql} WHERE 1 AND `intent` = %s", $keyword ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	643	+ $result = $wpdb->get_row( $wpdb->prepare( "SELECT `response` FROM {$table_sql} WHERE 1 AND `intent` = %s", $keyword ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
644	644
645	645	$response = array('status'=>'fail');
646	646
647	647	if(!empty($result)){
		@@ -867,9 +867,9 @@
867	867	if ( ! current_user_can( 'manage_options' ) ) {
868	868	return;
869	869	}
870	870
871		- $emails = $wpdb->get_results( "SELECT * FROM {$table_sql}" ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	871	+ $emails = $wpdb->get_results( "SELECT * FROM {$table_sql}" ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
872	872	$childArray = array();
873	873	foreach ( $emails as $email ) {
874	874	$innerArray = array();
875	875	$innerArray[0] = $email->name;
		@@ -905,9 +905,9 @@
905	905	global $wpdb;
906	906	$table = $wpdb->prefix . 'wpbot_response_category';
907	907	$table_sql = '`' . esc_sql( $table ) . '`';
908	908	$status = array( 'status' => 'fail' );
909		- $results = $wpdb->get_results( "SELECT * FROM {$table_sql}" ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	909	+ $results = $wpdb->get_results( "SELECT * FROM {$table_sql}" ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
910	910	$response_result = array();
911	911
912	912	if(!empty($results)){
913	913	foreach($results as $result){
		@@ -947,9 +947,9 @@
947	947
948	948	$status = array( 'status' => 'fail', 'multiple' => false );
949	949	$field = 'ID';
950	950	if ( ( $strid != '' ) && empty( $response_result ) ) {
951		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$table_sql} WHERE `ID` = %d", $strid ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	951	+ $results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$table_sql} WHERE `ID` = %d", $strid ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
952	952	if(!empty($results)){
953	953	foreach($results as $result){
954	954
955	955	$response_result[] = array('id'=>$result->id,'query'=>$result->query, 'response'=>$result->response, 'score'=>1);
		@@ -957,9 +957,9 @@
957	957	}
958	958	}
959	959	}
960	960	$field = 'query';
961		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT `id`, `query`, `response` FROM {$table_sql} WHERE 1 AND `query` = %s", $keyword ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	961	+ $results = $wpdb->get_results( $wpdb->prepare( "SELECT `id`, `query`, `response` FROM {$table_sql} WHERE 1 AND `query` = %s", $keyword ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
962	962
963	963
964	964	if(!empty($results)){
965	965	foreach($results as $result){
		@@ -970,9 +970,9 @@
970	970	}
971	971
972	972	$field = 'category';
973	973	if ( empty( $response_result ) ) {
974		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT `id`, `query`, `response` FROM {$table_sql} WHERE 1 AND `category` = %s", $keyword ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	974	+ $results = $wpdb->get_results( $wpdb->prepare( "SELECT `id`, `query`, `response` FROM {$table_sql} WHERE 1 AND `category` = %s", $keyword ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
975	975
976	976
977	977	if(!empty($results)){
978	978	foreach($results as $result){
		@@ -1040,9 +1040,9 @@
1040	1040	}
1041	1041	$field = 'keyword';
1042	1042	if ( empty( $response_result ) ) {
1043	1043
1044		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$table_sql} WHERE `keyword` REGEXP %s", $keyword ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	1044	+ $results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$table_sql} WHERE `keyword` REGEXP %s", $keyword ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
1045	1045
1046	1046
1047	1047	if(!empty($results)){
1048	1048	foreach($results as $result){
		@@ -1069,9 +1069,9 @@
1069	1069	// Try again with new keyword.
1070	1070	// Repeat the main search logic with $keyword2.
1071	1071	$response_result = array();
1072	1072	$field = 'query';
1073		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT `id`, `query`, `response` FROM {$table_sql} WHERE 1 AND `query` = %s", $keyword2 ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	1073	+ $results = $wpdb->get_results( $wpdb->prepare( "SELECT `id`, `query`, `response` FROM {$table_sql} WHERE 1 AND `query` = %s", $keyword2 ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
1074	1074	if(!empty($results)){
1075	1075	foreach($results as $result){
1076	1076	$response_result[] = array('id'=>$result->id,'query'=>$result->query, 'response'=>$result->response, 'score'=>1);
1077	1077	}
		@@ -1088,9 +1088,9 @@
1088	1088	if(empty($status['data']) || (isset($status['status']) && $status['status']==='fail')){
1089	1089	// Try a partial match if still nothing found.
1090	1090	if(empty($status['data'])) {
1091	1091	$keyword_like = '%' . preg_replace('/[\\s\\?]+/', '%', $keyword) . '%';
1092		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT `id`, `query`, `response` FROM {$table_sql} WHERE `query` LIKE %s", $keyword_like ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	1092	+ $results = $wpdb->get_results( $wpdb->prepare( "SELECT `id`, `query`, `response` FROM {$table_sql} WHERE `query` LIKE %s", $keyword_like ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
1093	1093	$response_result = array();
1094	1094	if(!empty($results)){
1095	1095	foreach($results as $result){
1096	1096	$response_result[] = array('id'=>$result->id,'query'=>$result->query, 'response'=>$result->response, 'score'=>1);