- $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_sponsor_paytypes (pay_name, pay_rate, pay_min_count, pay_currency)
- VALUES ('%s', '%s', '%s', '%s')",
- array(htmlspecialchars($HTTP_POST_VARS['pay_name']), str_replace(",", ".", $HTTP_POST_VARS['pay_rate']), bigintval($HTTP_POST_VARS['pay_min_count']), htmlspecialchars($HTTP_POST_VARS['pay_currency'])),
- __FILE__, __LINE__);
+ SQL_QUERY_ESC("INSERT INTO `{!_MYSQL_PREFIX!}_sponsor_paytypes` (`pay_name`, `pay_rate`, `pay_min_count`, `pay_currency`) VALUES ('%s','%s','%s','%s')",
+ array(
+ REQUEST_POST('pay_name'),
+ convertCommaToDot(REQUEST_POST('pay_rate')),
+ bigintval(REQUEST_POST('pay_min_count')),
+ REQUEST_POST('pay_currency')
+ ), __FILE__, __LINE__);