← All changes | includes/functions.php +75 -25 1.6.4 → 1.6.23 View file →

		@@ -85,17 +85,26 @@
85	85	];
86	86
87	87	$r = wp_parse_args( $args, $defaults );
88	88
89		- $query = 'SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
90		- FROM ' . $wpdb->weforms_entries .
91		- ' WHERE form_id = ' . $form_id . ' AND status = \'' . $r['status'] . '\'' .
92		- ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'];
	89	+ $query = $wpdb->prepare(
	90	+ "
	91	+ SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
	92	+ FROM $wpdb->weforms_entries
	93	+ WHERE form_id = %d AND status = %s
	94	+ ORDER BY %s %s
	95	+ LIMIT %d, %d
	96	+ ",
	97	+ array(
	98	+ $form_id,
	99	+ $r['status'],
	100	+ $r['orderby'],
	101	+ $r['order'],
	102	+ $r['offset'],
	103	+ $r['number'],
	104	+ )
	105	+ );
93	106
94		- if ( !empty( $r['offset'] ) && !empty( $r['number'] ) ) {
95		- $query .= ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
96		- }
97		-
98	107	$results = $wpdb->get_results( $query );
99	108
100	109	return $results;
101	110	}
		@@ -110,10 +119,8 @@
110	119	function weforms_count_entries( $args = [] ) {
111	120	global $wpdb;
112	121
113	122	$defaults = [
114		- 'number' => -1,
115		- 'offset' => 0,
116	123	'orderby' => 'created_at',
117	124	'status' => 'publish',
118	125	'order' => 'DESC',
119	126	];
		@@ -119,17 +126,22 @@
119	126	];
120	127
121	128	$r = wp_parse_args( $args, $defaults );
122	129
123		- $query = 'SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
124		- FROM ' . $wpdb->weforms_entries .
125		- ' WHERE status = \'' . $r['status'] . '\'' .
126		- ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'];
	130	+ $query = $wpdb->prepare(
	131	+ "
	132	+ SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
	133	+ FROM $wpdb->weforms_entries
	134	+ WHERE status = %s
	135	+ ORDER BY %s %s
	136	+ ",
	137	+ array(
	138	+ $r['status'],
	139	+ $r['orderby'],
	140	+ $r['order'],
	141	+ )
	142	+ );
127	143
128		- if ( !empty( $r['offset'] ) && !empty( $r['number'] ) ) {
129		- $query .= ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
130		- }
131		-
132	144	$results = $wpdb->get_results( $query );
133	145
134	146	return count( $results );
135	147	}
		@@ -153,12 +165,24 @@
153	165	];
154	166
155	167	$r = wp_parse_args( $args, $defaults );
156	168
157		- $query = 'SELECT * FROM ' . $wpdb->prefix . 'weforms_payments' .
158		- ' WHERE form_id = ' . $form_id .
159		- ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'] .
160		- ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
	169	+ $query = $wpdb->prepare(
	170	+ "
	171	+ SELECT *
	172	+ FROM wp_weforms_payments
	173	+ WHERE form_id = %d
	174	+ ORDER BY %s %s
	175	+ LIMIT %d, %d
	176	+ ",
	177	+ array(
	178	+ $form_id,
	179	+ $r['orderby'],
	180	+ $r['order'],
	181	+ $r['offset'],
	182	+ $r['number'],
	183	+ )
	184	+ );
161	185
162	186	$results = $wpdb->get_results( $query );
163	187
164	188	return $results;
		@@ -164,8 +188,33 @@
164	188	return $results;
165	189	}
166	190
167	191	/**
	192	+ * Get payments by a entry_id
	193	+ *
	194	+ * @param int $entry_id
	195	+ *
	196	+ * @return object
	197	+ */
	198	+function weforms_get_entry_payment( $entry_id ) {
	199	+ global $wpdb;
	200	+
	201	+ $query = $wpdb->prepare(
	202	+ "
	203	+ SELECT transaction_id
	204	+ FROM $wpdb->prefix 'weforms_payments'
	205	+ WHERE entry_id = %d
	206	+ ",
	207	+ array(
	208	+ $entry_id
	209	+ )
	210	+ );
	211	+ $payment = $wpdb->get_row( $query );
	212	+
	213	+ return $payment;
	214	+}
	215	+
	216	+/**
168	217	* Get an entry by id
169	218	*
170	219	* @param int $entry_id
171	220	*
		@@ -206,9 +255,9 @@
206	255	'form_id' => 0,
207	256	'user_id' => get_current_user_id(),
208	257	'user_ip' => ip2long( weforms_get_client_ip() ),
209	258	'user_device' => $browser['name'] . '/' . $browser['platform'],
210		- 'referer' => isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '',
	259	+ 'referer' => isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_url( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '',
211	260	'created_at' => current_time( 'mysql' )
212	261	];
213	262
214	263	$r = wp_parse_args( $args, $defaults );
		@@ -1082,9 +1131,9 @@
1082	1131	'message' => __( 'Thanks for contacting us! We will get in touch with you shortly.', 'weforms' ),
1083	1132	'page_id' => '',
1084	1133	'url' => '',
1085	1134
1086		- 'submit_text' => __( 'Submit Query', 'weforms' ),
	1135	+ 'submit_text' => __( 'Submit', 'weforms' ),
1087	1136	'submit_button_cond' => [
1088	1137	'condition_status' => 'no',
1089	1138	'cond_logic' => 'any',
1090	1139	'conditions' => [
		@@ -1114,8 +1163,9 @@
1114	1163	'respondent_can_see' => [ 'missed_questions', 'correct_answers', 'point_values' ],
1115	1164	'total_points' => 0,
1116	1165	'enable_multistep' => false,
1117	1166	'multistep_progressbar_type' => 'progressive',
	1167	+ 'humanpresence_enabled' => false,
1118	1168
1119	1169	// payment
1120	1170	'payment_paypal_images' => 'https://www.paypalobjects.com/webstatic/mktg/logo/AM_mc_vs_dc_ae.jpg',
1121	1171
		@@ -1301,7 +1351,7 @@
1301	1351	function weforms_clean( $var ) {
1302	1352	if ( is_array( $var ) ) {
1303	1353	return array_map( 'weforms_clean', $var );
1304	1354	} else {
1305		- return is_scalar( $var ) ? sanitize_text_field( wp_unslash( $var ) ) : $var;
	1355	+ return is_scalar( $var ) ? sanitize_textarea_field( wp_unslash( $var ) ) : $var;
1306	1356	}
1307	1357	}