- $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_sponsor_paytypes (pay_name, pay_rate, pay_min_count, pay_currency)
- VALUES ('%s','%s','%s','%s')",
- array(htmlspecialchars($_POST['pay_name']), str_replace(",", ".", $_POST['pay_rate']), bigintval($_POST['pay_min_count']), htmlspecialchars($_POST['pay_currency'])),
- __FILE__, __LINE__);
+ SQL_QUERY_ESC("INSERT INTO `{?_MYSQL_PREFIX?}_sponsor_paytypes` (`pay_name`, `pay_rate`, `pay_min_count`, `pay_currency`) VALUES ('%s','%s','%s','%s')",
+ array(
+ postRequestElement('pay_name'),
+ convertCommaToDot(postRequestElement('pay_rate')),
+ bigintval(postRequestElement('pay_min_count')),
+ postRequestElement('pay_currency')
+ ), __FILE__, __LINE__);