| @@ -267,26 +267,34 @@ | ||
| 267 | 267 | */ |
| 268 | 268 | public function is_restore_exists( $param, $request, $key ) { |
| 269 | 269 | global $wpdb; |
| 270 | 270 | |
| 271 | - // if( is_array( $param ) ) { | |
| 272 | 271 | if ( is_array( $request['entry_id'] ) ) { |
| 273 | 272 | $entry_id = implode( ',', $param ); |
| 274 | - $querystr = " | |
| 273 | + $querystr = $wpdb->prepare( | |
| 274 | + " | |
| 275 | 275 | SELECT $wpdb->weforms_entries.id |
| 276 | 276 | FROM $wpdb->weforms_entries |
| 277 | - WHERE $wpdb->weforms_entries.ID IN ( $entry_id ) | |
| 277 | + WHERE $wpdb->weforms_entries.ID IN ( %s ) | |
| 278 | 278 | AND $wpdb->weforms_entries.status = \"trash\" |
| 279 | - "; | |
| 279 | + ", | |
| 280 | + array( | |
| 281 | + $entry_id | |
| 282 | + ) | |
| 283 | + ); | |
| 280 | 284 | } else { |
| 281 | - // $entry_id = (int) $param; | |
| 282 | 285 | $entry_id = (int) $request['entry_id']; |
| 283 | - $querystr = " | |
| 286 | + $querystr = $wpdb->prepare( | |
| 287 | + " | |
| 284 | 288 | SELECT $wpdb->weforms_entries.id |
| 285 | 289 | FROM $wpdb->weforms_entries |
| 286 | - WHERE $wpdb->weforms_entries.ID = $entry_id | |
| 290 | + WHERE $wpdb->weforms_entries.ID = %d | |
| 287 | 291 | AND $wpdb->weforms_entries.status = \"trash\" |
| 288 | - "; | |
| 292 | + ", | |
| 293 | + array( | |
| 294 | + $entry_id | |
| 295 | + ) | |
| 296 | + ); | |
| 289 | 297 | } |
| 290 | 298 | |
| 291 | 299 | $result = $wpdb->get_results( $querystr ); |
| 292 | 300 | |
