| @@ -46,13 +46,18 @@ | ||
| 46 | 46 | } |
| 47 | 47 | |
| 48 | 48 | function prepare_data( $idsStr ) { |
| 49 | 49 | global $wpdb; |
| 50 | + | |
| 51 | + // Escape the array of IDs for SQL | |
| 52 | + $ids = array_map( 'intval', explode(',', $idsStr ) ); | |
| 53 | + $idsStr = implode( ',', $ids ); | |
| 54 | + | |
| 50 | 55 | $query = "SELECT p.ID id, p.post_excerpt caption, m.meta_value meta |
| 51 | 56 | FROM $wpdb->posts p, $wpdb->postmeta m |
| 52 | 57 | WHERE m.meta_key = '_wp_attachment_metadata' |
| 53 | 58 | AND p.ID = m.post_id |
| 54 | - AND p.ID IN (" . esc_sql( $idsStr ) . ")"; | |
| 59 | + AND p.ID IN (" . $idsStr . ")"; | |
| 55 | 60 | $res = $wpdb->get_results( $query ); |
| 56 | 61 | $this->ids = explode( ',', $idsStr ); |
| 57 | 62 | foreach ( $res as $r ) { |
| 58 | 63 | $this->data[$r->id] = array( 'caption' => $r->caption,'meta' => unserialize( $r->meta ) ); |
