All database names are now 'back-ticked' and constant _MYSQL_PREFIX is wrapped. Partl...

[mailer.git] / inc / modules / order.php

diff --git a/inc/modules/order.php b/inc/modules/order.php
index db72794c44ab9e8be34336e6a59588f5ee76d323..399efd48a4b02d983949944eaac1aaddbea29a69 100644 (file)
--- a/inc/modules/order.php
+++ b/inc/modules/order.php
@@ -63,19 +63,19 @@ if (empty($URL)) {
        }
 
        // Update sending pool
-       SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_pool SET data_type='%s' WHERE id=%s AND sender=%s AND data_type='TEMP' LIMIT 1",
+       SQL_QUERY_ESC("UPDATE `{!MYSQL_PREFIX!}_pool` SET data_type='%s' WHERE id=%s AND sender=%s AND data_type='TEMP' LIMIT 1",
                array($type, bigintval($_GET['order']), $GLOBALS['userid']), __FILE__, __LINE__);
 
        // Finally is the entry valid?
        if (SQL_AFFECTEDROWS() == 1) {
                // Load personal data...
-               $result = SQL_QUERY_ESC("SELECT gender, surname, family, email FROM `"._MYSQL_PREFIX."_user_data` WHERE userid=%s LIMIT 1",
+               $result = SQL_QUERY_ESC("SELECT gender, surname, family, email FROM `{!MYSQL_PREFIX!}_user_data` WHERE userid=%s LIMIT 1",
                        array($GLOBALS['userid']), __FILE__, __LINE__);
                list($gender, $sname, $fname, $email) = SQL_FETCHROW($result);
                SQL_FREERESULT($result);
 
                // Load mail again...              0       1        2           3          4      5      6         7
-               $result = SQL_QUERY_ESC("SELECT subject, text, receivers, payment_id, timestamp, url, cat_id, target_send FROM "._MYSQL_PREFIX."_pool WHERE id=%s AND sender=%s LIMIT 1",
+               $result = SQL_QUERY_ESC("SELECT subject, text, receivers, payment_id, timestamp, url, cat_id, target_send FROM `{!MYSQL_PREFIX!}_pool` WHERE id=%s AND sender=%s LIMIT 1",
                        array(bigintval($_GET['order']), $GLOBALS['userid']), __FILE__, __LINE__);
                $DATA = SQL_FETCHROW($result);
                SQL_FREERESULT($result);