5wes13

Hey Faiyazalam

I had the same issue so thank you for posting this solution. Please can you include this minor change in your files for download.

Thanks,
Wesley

Hi Idearius

You will need to read up on prepared statements, but here is an example using the code in the stray_manage.php file in the plugin:

This is a sample code as it stands:

//update the quote
				$sql = "UPDATE " . WP_STRAY_QUOTES_TABLE 
				. " SET quote='" . mysqli_real_escape_string($quote)
				. "', author='" . mysqli_real_escape_string($author) 
				. "', source='" . mysqli_real_escape_string($source) 
				. "', category='" . mysqli_real_escape_string($category)
				. "', visible='" . mysqli_real_escape_string($visible) 
				. "', user='" . mysqli_real_escape_string($current_user->user_nicename)
				. "' WHERE quoteID='" . mysqli_real_escape_string($quoteID) . "'";		     
				$wpdb->get_results($sql);

And this is the same query using prepared statements (I have changed the layout a bit):

//update the quote
				$sql = 
					"UPDATE " . WP_STRAY_QUOTES_TABLE . " 
					SET 
						quote= %s, 
						author=%s, 
						source=%s, 
						category=%s, 
						visible=%s, 
						user=%s 
					WHERE 
						quoteID=%s"
				;
				
				$wpdb->get_results(
					$wpdb->prepare(
						$sql, 
						$quote,
						$author,
						$source,
						$category,
						$visible,
						$current_user->user_nicename,
						$quoteID
					)
				);

Change all queries where mysql_real_escape_string is used in stray_manage.php and stray_new.php.

Let me know if you have any further questions.

• This reply was modified 9 years, 1 month ago by 5wes13.
• This reply was modified 9 years, 1 month ago by 5wes13.

Thanks asirota, I had the same issue and GD fixed it too. Much appreciated!