← All changes | includes/api/class-weforms-api-rest-controller.php +16 -6 1.6.20 → 1.6.23 View file →

		@@ -195,20 +195,30 @@
195	195	global $wpdb;
196	196
197	197	if ( is_array( $request['entry_id'] ) ) {
198	198	$entry_id = implode( ',', $request['entry_id'] );
199		- $querystr = "
	199	+ $querystr = $wpdb->prepare(
	200	+ "
200	201	SELECT $wpdb->weforms_entries.id
201	202	FROM $wpdb->weforms_entries
202		- WHERE $wpdb->weforms_entries.ID IN ( $entry_id )
203		- ";
	203	+ WHERE $wpdb->weforms_entries.ID IN ( %s )
	204	+ ",
	205	+ array(
	206	+ $entry_id
	207	+ )
	208	+ );
204	209	} else {
205	210	$entry_id = (int) $request['entry_id'];
206		- $querystr = "
	211	+ $querystr = $wpdb->prepare(
	212	+ "
207	213	SELECT $wpdb->weforms_entries.id
208	214	FROM $wpdb->weforms_entries
209		- WHERE $wpdb->weforms_entries.ID = $entry_id
210		- ";
	215	+ WHERE $wpdb->weforms_entries.ID = %d
	216	+ ",
	217	+ array(
	218	+ $entry_id
	219	+ )
	220	+ );
211	221	}
212	222
213	223	$result = $wpdb->get_results( $querystr );
214	224