More SQL rewrites, TODO: Put all table and column names in backticks (`)

[mailer.git] / doubler.php

diff --git a/doubler.php b/doubler.php
index 4bbc6581b02d46f7d2319a8834136b641185606e..5d39bf1771d7f119f52b524e672e657055acee1c 100644 (file)
--- a/doubler.php
+++ b/doubler.php
@@ -63,11 +63,11 @@ if (isBooleanConstantAndTrue('mxchange_installed')) {
        $probe_nickname = ((EXT_IS_ACTIVE("nickname")) && (("".round($GLOBALS['refid'])."") != $GLOBALS['refid']));
        if ($probe_nickname) {
                // Nickname in URL, so load the ID
-               $result = SQL_QUERY_ESC("SELECT userid, status FROM "._MYSQL_PREFIX."_user_data WHERE nickname='%s' LIMIT 1",
+               $result = SQL_QUERY_ESC("SELECT userid, status FROM `"._MYSQL_PREFIX."_user_data` WHERE nickname='%s' LIMIT 1",
                 array(bigintval($GLOBALS['refid'])), __FILE__, __LINE__);
        } else {
                // Direct userid entered
-               $result = SQL_QUERY_ESC("SELECT userid, status FROM "._MYSQL_PREFIX."_user_data WHERE userid=%s LIMIT 1",
+               $result = SQL_QUERY_ESC("SELECT userid, status FROM `"._MYSQL_PREFIX."_user_data` WHERE userid=%s LIMIT 1",
                 array(bigintval($GLOBALS['refid'])), __FILE__, __LINE__);
        }
 
@@ -96,11 +96,11 @@ if (isBooleanConstantAndTrue('mxchange_installed')) {
                        $probe_nickname = ((EXT_IS_ACTIVE("nickname")) && (("".round($_POST['userid'])."") != $_POST['userid']));
                        if ($probe_nickname) {
                                // Nickname in URL, so load the ID
-                               $result = SQL_QUERY_ESC("SELECT userid, status, password FROM "._MYSQL_PREFIX."_user_data WHERE nickname='%s' LIMIT 1",
+                               $result = SQL_QUERY_ESC("SELECT userid, status, password FROM `"._MYSQL_PREFIX."_user_data` WHERE nickname='%s' LIMIT 1",
                                 array($_POST['userid']), __FILE__, __LINE__);
                        } else {
                                // Direct userid entered
-                               $result = SQL_QUERY_ESC("SELECT userid, status, password FROM "._MYSQL_PREFIX."_user_data WHERE userid=%s LIMIT 1",
+                               $result = SQL_QUERY_ESC("SELECT userid, status, password FROM `"._MYSQL_PREFIX."_user_data` WHERE userid=%s LIMIT 1",
                                 array(bigintval($_POST['userid'])), __FILE__, __LINE__);
                        }