← All changes | admin/partials/include-data.php +8 -6 2.5.3 → 2.5.6 View file →

		@@ -14,9 +14,10 @@
14	14
15	15	$act = ( isset( $_REQUEST["act"] ) ) ? sanitize_text_field( $_REQUEST["act"] ) : '';
16	16	if ( $act === "update" ) {
17	17	$recid = absint( $_REQUEST["id"] );
18		- $result = $wpdb->get_row( "SELECT * FROM $data WHERE id=$recid" );
	18	+ $sSQL = $wpdb->prepare( "select * from $data WHERE id = %d", $recid );
	19	+ $result = $wpdb->get_row( $sSQL );
19	20	if ( $result ) {
20	21	$id = $result->id;
21	22	$title = $result->title;
22	23	$param = unserialize( $result->param );
		@@ -23,16 +24,17 @@
23	24	$tool_id = $id;
24	25	$hidval = 2;
25	26	$btn = __( 'Update', 'wpcoder' );
26	27	}
27		-} else if ( $act === "duplicate" ) {
28		- $recid = $_REQUEST["id"];
29		- $result = $wpdb->get_row( "SELECT * FROM $data WHERE id=$recid" );
	28	+} elseif ( $act === "duplicate" ) {
	29	+ $recid = absint( $_REQUEST["id"] );
	30	+ $sSQL = $wpdb->prepare( "select * from $data WHERE id = %d", $recid );
	31	+ $result = $wpdb->get_row( $sSQL );
30	32	if ( $result ) {
31	33	$id = "";
32	34	$title = "";
33	35	$param = unserialize( $result->param );
34		- $last = $wpdb->get_col( "SELECT id FROM $data" );;
	36	+ $last = $wpdb->get_col( "SELECT id FROM $data" );
35	37	$tool_id = max( $last ) + 1;
36	38	$hidval = 1;
37	39	$btn = __( 'Save', 'wpcoder' );
38	40	}
		@@ -38,9 +40,9 @@
38	40	}
39	41	} else {
40	42	$id = "";
41	43	$title = "";
42		- $last = $wpdb->get_col( "SELECT id FROM $data" );
	44	+ $last = $wpdb->get_col( "SELECT id FROM $data" );
43	45	$tool_id = ! empty( $last ) ? max( $last ) + 1 : 1;
44	46	$param = '';
45	47	$hidval = 1;
46	48	$btn = __( 'Save', 'wpcoder' );