************************************************************************/
// Some security stuff...
-if ((ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) || (!IS_ADMIN())) {
+if ((!defined('__SECURITY')) || (!IS_ADMIN())) {
$INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php";
require($INC);
} elseif (!EXT_IS_ACTIVE("order")) {
// Select category
$CAT_TABS = "LEFT JOIN "._MYSQL_PREFIX."_user_cats AS c ON d.userid=c.userid";
$cat = bigintval($_POST['cat']);
- $CAT_WHERE = " AND c.cat_id=%d";
+ $CAT_WHERE = " AND c.cat_id=%s";
}
if (GET_EXT_VERSION("holiday") >= "0.1.3")
{
if ($_GET['mode'] == "html") $HTML = "Y";
$result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_bonus
(subject, text, receivers, points, time, data_type, timestamp, url, cat_id, target_send, mails_sent, html_msg)
-VALUES ('%s', '%s', '%s', '%s', '%s', 'NEW', UNIX_TIMESTAMP(), '%s', '%s', '%s', '%s', '%s')",
+VALUES ('%s','%s','%s','%s','%s','NEW', UNIX_TIMESTAMP(),'%s','%s','%s','%s','%s')",
array(
$_POST['subject'],
addslashes($_POST['text']),
{
$result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_bonus
(subject, text, receivers, points, time, data_type, timestamp, url, cat_id, target_send, mails_sent)
-VALUES ('%s', '%s', '%s', '%s', '%s', 'NEW', UNIX_TIMESTAMP(), '%s', '%s', '%s', '%s')",
+VALUES ('%s','%s','%s','%s','%s','NEW', UNIX_TIMESTAMP(),'%s','%s','%s','%s')",
array(
$_POST['subject'],
addslashes($_POST['text']),
{
$CATS['id'][] = $id;
$CATS['name'][] = $cat;
- $result_uids = SQL_QUERY_ESC("SELECT userid FROM "._MYSQL_PREFIX."_user_cats WHERE cat_id=%d",
+ $result_uids = SQL_QUERY_ESC("SELECT userid FROM "._MYSQL_PREFIX."_user_cats WHERE cat_id=%s",
array(bigintval($id)), __FILE__, __LINE__);
- $uid_cnt = "0";
+ $uid_cnt = 0;
while (list($ucat) = SQL_FETCHROW($result_uids))
{
$result_ver = SQL_QUERY_ESC("SELECT userid FROM "._MYSQL_PREFIX."_user_data
-WHERE userid=%d AND status='CONFIRMED' AND receive_mails > 0".$MORE." LIMIT 1",
+WHERE userid=%s AND status='CONFIRMED' AND receive_mails > 0".$MORE." LIMIT 1",
array(bigintval($ucat)), __FILE__, __LINE__);
$uid_cnt += SQL_NUMROWS($result_ver);
// Generate options
$OUT = "";
- foreach ($CATS['id'] as $key=>$value)
+ foreach ($CATS['id'] as $key => $value)
{
if (strlen($CATS['name'][$key]) > 20) $CATS['name'][$key] = substr($CATS['name'][$key], 0, 17)."...";
$OUT .= " <OPTION value=\"".$value."\">".$CATS['name'][$key]." (".$CATS['uids'][$key]." ".USER_IN_CAT.")</OPTION>\n";