Ticket #925: bp-xprofile-classes.php.patch

bp-xprofile-classes.php

@@ -207 +207 @@
                         $this->group_id = $field->group_id;
                         $this->parent_id = $field->parent_id;
                         $this->type = $field->type;
-                        $this->name = stripslashes($field->name);
-                        $this->desc = stripslashes($field->description);
+                        $this->name = $field->name;
+                        $this->desc = $field->description;
                         $this->is_required = $field->is_required;
                         $this->can_delete = $field->can_delete;
                         $this->field_order = $field->field_order;
@@ -253 +253 @@
                 do_action( 'xprofile_field_before_save', $this );
                 
                 if ( $this->id != null )
-                        $sql = $wpdb->prepare("UPDATE {$bp->profile->table_name_fields} SET group_id = %d, parent_id = 0, type = %s, name = %s, description = %s, is_required = %d, order_by = %s WHERE id = %d", $this->group_id, $this->type, $this->name, $this->desc, $this->is_required, $this->order_by, $this->id);
+                        $sql = sprintf("UPDATE {$bp->profile->table_name_fields} SET group_id = %d, parent_id = 0, type = '%s', name = '%s', description = '%s', is_required = %d, order_by = '%s' WHERE id = %d", $this->group_id, $this->type, $this->name, $this->desc, $this->is_required, $this->order_by, $this->id);
                 else
-                        $sql = $wpdb->prepare("INSERT INTO {$bp->profile->table_name_fields} (group_id, parent_id, type, name, description, is_required, order_by) VALUES (%d, 0, %s, %s, %s, %d, %d)", $this->group_id, $this->type, $this->name, $this->desc, $this->is_required, $this->order_by);
+                        $sql = sprintf("INSERT INTO {$bp->profile->table_name_fields} (group_id, parent_id, type, name, description, is_required, order_by) VALUES (%d, 0, '%s', '%s', '%s', %d, %d)", $this->group_id, $this->type, $this->name, $this->desc, $this->is_required, $this->order_by);
 
                 if ( $wpdb->query($sql) ) {
                         
@@ -313 +313 @@
                                                 }
 
                                                 if ( '' != $option_value ) { 
-                                                        if ( !$wpdb->query( $wpdb->prepare("INSERT INTO {$bp->profile->table_name_fields} (group_id, parent_id, type, name, description, is_required, option_order, is_default_option) VALUES (%d, %d, 'option', %s, '', 0, %d, %d)", $this->group_id, $parent_id, $option_value, $counter, $is_default ) ) )
+                                                        if ( !$wpdb->query( sprintf("INSERT INTO {$bp->profile->table_name_fields} (group_id, parent_id, type, name, description, is_required, option_order, is_default_option) VALUES (%d, %d, 'option', '%s', '', 0, %d, %d)", $this->group_id, $parent_id, $option_value, $counter, $is_default ) ) )
                                                                 return false;
                                                 }
                                         
@@ -620 +620 @@
                         $this->id = $profiledata->id;
                         $this->user_id = $profiledata->user_id;
                         $this->field_id = $profiledata->field_id;
-                        $this->value = stripslashes($profiledata->value);
+                        $this->value = $profiledata->value;
                         $this->last_updated = $profiledata->last_updated;
                 }
         }
@@ -661 +661 @@
                 
                 if ( $this->is_valid_field() ) {
                         if ( $this->exists() && $this->value != '' ) {
-                                $sql = $wpdb->prepare( "UPDATE {$bp->profile->table_name_data} SET value = %s, last_updated = %s WHERE user_id = %d AND field_id = %d", $this->value, $this->last_updated, $this->user_id, $this->field_id );
+                                $sql = sprintf( "UPDATE {$bp->profile->table_name_data} SET value = '%s', last_updated = '%s' WHERE user_id = %d AND field_id = %d", $this->value, $this->last_updated, $this->user_id, $this->field_id );
                         } else if ( $this->exists() && empty( $this->value ) ) {
                                 // Data removed, delete the entry.
                                 $this->delete();
                         } else {
-                                $sql = $wpdb->prepare("INSERT INTO {$bp->profile->table_name_data} (user_id, field_id, value, last_updated) VALUES (%d, %d, %s, %s)", $this->user_id, $this->field_id, $this->value, $this->last_updated );
+                                $sql = sprintf("INSERT INTO {$bp->profile->table_name_data} (user_id, field_id, value, last_updated) VALUES (%d, %d, '%s', '%s')", $this->user_id, $this->field_id, $this->value, $this->last_updated );
                         }
                         
                         if ( $wpdb->query($sql) === false )