← All changes | includes/functions.php +58 -26 1.6.15 → 1.6.24 View file →

		@@ -85,17 +85,26 @@
85	85	];
86	86
87	87	$r = wp_parse_args( $args, $defaults );
88	88
89		- $query = 'SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
90		- FROM ' . $wpdb->weforms_entries .
91		- ' WHERE form_id = ' . $form_id . ' AND status = \'' . $r['status'] . '\'' .
92		- ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'];
	89	+ $query = $wpdb->prepare(
	90	+ "
	91	+ SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
	92	+ FROM $wpdb->weforms_entries
	93	+ WHERE form_id = %d AND status = %s
	94	+ ORDER BY %s %s
	95	+ LIMIT %d, %d
	96	+ ",
	97	+ array(
	98	+ $form_id,
	99	+ $r['status'],
	100	+ $r['orderby'],
	101	+ $r['order'],
	102	+ $r['offset'],
	103	+ $r['number'],
	104	+ )
	105	+ );
93	106
94		- if ( !empty( $r['offset'] ) && !empty( $r['number'] ) ) {
95		- $query .= ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
96		- }
97		-
98	107	$results = $wpdb->get_results( $query );
99	108
100	109	return $results;
101	110	}
		@@ -110,10 +119,8 @@
110	119	function weforms_count_entries( $args = [] ) {
111	120	global $wpdb;
112	121
113	122	$defaults = [
114		- 'number' => -1,
115		- 'offset' => 0,
116	123	'orderby' => 'created_at',
117	124	'status' => 'publish',
118	125	'order' => 'DESC',
119	126	];
		@@ -119,17 +126,22 @@
119	126	];
120	127
121	128	$r = wp_parse_args( $args, $defaults );
122	129
123		- $query = 'SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
124		- FROM ' . $wpdb->weforms_entries .
125		- ' WHERE status = \'' . $r['status'] . '\'' .
126		- ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'];
	130	+ $query = $wpdb->prepare(
	131	+ "
	132	+ SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
	133	+ FROM $wpdb->weforms_entries
	134	+ WHERE status = %s
	135	+ ORDER BY %s %s
	136	+ ",
	137	+ array(
	138	+ $r['status'],
	139	+ $r['orderby'],
	140	+ $r['order'],
	141	+ )
	142	+ );
127	143
128		- if ( !empty( $r['offset'] ) && !empty( $r['number'] ) ) {
129		- $query .= ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
130		- }
131		-
132	144	$results = $wpdb->get_results( $query );
133	145
134	146	return count( $results );
135	147	}
		@@ -153,12 +165,24 @@
153	165	];
154	166
155	167	$r = wp_parse_args( $args, $defaults );
156	168
157		- $query = 'SELECT * FROM ' . $wpdb->prefix . 'weforms_payments' .
158		- ' WHERE form_id = ' . $form_id .
159		- ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'] .
160		- ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
	169	+ $query = $wpdb->prepare(
	170	+ "
	171	+ SELECT *
	172	+ FROM wp_weforms_payments
	173	+ WHERE form_id = %d
	174	+ ORDER BY %s %s
	175	+ LIMIT %d, %d
	176	+ ",
	177	+ array(
	178	+ $form_id,
	179	+ $r['orderby'],
	180	+ $r['order'],
	181	+ $r['offset'],
	182	+ $r['number'],
	183	+ )
	184	+ );
161	185
162	186	$results = $wpdb->get_results( $query );
163	187
164	188	return $results;
		@@ -173,11 +197,19 @@
173	197	*/
174	198	function weforms_get_entry_payment( $entry_id ) {
175	199	global $wpdb;
176	200
177		- $query = 'SELECT transaction_id FROM ' . $wpdb->prefix . 'weforms_payments' .
178		- ' WHERE entry_id = ' . $entry_id;
179		- $payment = $wpdb->get_row( $query, $entry_id );
	201	+ $query = $wpdb->prepare(
	202	+ "
	203	+ SELECT transaction_id
	204	+ FROM $wpdb->prefix 'weforms_payments'
	205	+ WHERE entry_id = %d
	206	+ ",
	207	+ array(
	208	+ $entry_id
	209	+ )
	210	+ );
	211	+ $payment = $wpdb->get_row( $query );
180	212
181	213	return $payment;
182	214	}
183	215
		@@ -223,9 +255,9 @@
223	255	'form_id' => 0,
224	256	'user_id' => get_current_user_id(),
225	257	'user_ip' => ip2long( weforms_get_client_ip() ),
226	258	'user_device' => $browser['name'] . '/' . $browser['platform'],
227		- 'referer' => isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '',
	259	+ 'referer' => isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_url( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '',
228	260	'created_at' => current_time( 'mysql' )
229	261	];
230	262
231	263	$r = wp_parse_args( $args, $defaults );