X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=inc%2Fmodules%2Forder.php;h=74fbc6a45a58e087c6444d48f4de7113c72b2503;hb=6d4ae5d04f53cbad26c28d91f2a0c10a60df8044;hp=53d88eb7783fea5cee0bfeb440f1ff1da0e68b19;hpb=19cd0d37b2bcbf9dd4f3c38a9cecd7f5011d6b66;p=mailer.git

diff --git a/inc/modules/order.php b/inc/modules/order.php
index 53d88eb778..74fbc6a45a 100644
--- a/inc/modules/order.php
+++ b/inc/modules/order.php
@@ -39,7 +39,7 @@ if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) {
 } elseif ((!EXT_IS_ACTIVE("order")) && (!IS_ADMIN())) {
 	ADD_FATAL(EXTENSION_PROBLEM_EXT_INACTIVE, "order");
 	return;
-} elseif (!IS_LOGGED_IN()) {
+} elseif (!IS_MEMBER()) {
 	// Sorry, no guest access!
 	$URL = URL."/modules.php?module=index";
 } elseif (empty($_GET['order'])) {
@@ -63,22 +63,22 @@ if (empty($URL)) {
 	}
 
 	// Update sending pool
-	$result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_pool SET data_type='%s' WHERE id=%d AND sender=%d AND data_type='TEMP' LIMIT 1",
+	$result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_pool SET data_type='%s' WHERE id=%s AND sender=%s AND data_type='TEMP' LIMIT 1",
 	 array($type, bigintval($_GET['order']), $GLOBALS['userid']), __FILE__, __LINE__);
 
 	// Finally is the entry valid?
-	if (SQL_AFFECTEDROWS($link) == 1) {
+	if (SQL_AFFECTEDROWS() == 1) {
 		// Update his login data
 		UPDATE_LOGIN_DATA();
 
 		// Load personal data...
-		$result = SQL_QUERY_ESC("SELECT sex, surname, family, email FROM "._MYSQL_PREFIX."_user_data WHERE userid=%d LIMIT 1",
+		$result = SQL_QUERY_ESC("SELECT sex, surname, family, email FROM "._MYSQL_PREFIX."_user_data WHERE userid=%s LIMIT 1",
 		 array($GLOBALS['userid']), __FILE__, __LINE__);
 		list($sex, $sname, $fname, $email) = SQL_FETCHROW($result);
 		SQL_FREERESULT($result);
 
 		// Load mail again...              0       1        2           3          4      5      6         7
-		$result = SQL_QUERY_ESC("SELECT subject, text, receivers, payment_id, timestamp, url, cat_id, target_send FROM "._MYSQL_PREFIX."_pool WHERE id=%d AND sender=%d LIMIT 1",
+		$result = SQL_QUERY_ESC("SELECT subject, text, receivers, payment_id, timestamp, url, cat_id, target_send FROM "._MYSQL_PREFIX."_pool WHERE id=%s AND sender=%s LIMIT 1",
 		 array(bigintval($_GET['order']), $GLOBALS['userid']), __FILE__, __LINE__);
 		$DATA = SQL_FETCHROW($result);
 		SQL_FREERESULT($result);
@@ -90,8 +90,7 @@ if (empty($URL)) {
 		// Update used points
 		$ADD = "";
 		if ($_CONFIG['order_max_full'] == "ORDER") $ADD = ", mail_orders=mail_orders+1";
-		$result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_user_data SET used_points=used_points+%s".$ADD." WHERE userid=%d LIMIT 1",
-		 array($USED, $GLOBALS['userid']), __FILE__, __LINE__);
+		SUB_POINTS($GLOBALS['userid'], $USED);
 
 		// Update mediadata as well
 		if (GET_EXT_VERSION("mediadata") >= "0.0.4") {