Changeset 3643 for trunk/bp-core/admin/bp-core-schema.php

Timestamp:

01/01/2011 09:36:22 PM (15 years ago)

Author:

djpaul

Message:

Escape xprofile base group name and fullname field name options on the settings screen. Fixes #2986

File:

• trunk/bp-core/admin/bp-core-schema.php (modified) (2 diffs)

trunk/bp-core/admin/bp-core-schema.php

@@ -197 +197 @@
     $charset_collate = bp_core_set_charset();
 
-    update_site_option( 'bp-xprofile-base-group-name', 'Base' );
-    update_site_option( 'bp-xprofile-fullname-field-name', 'Name' );
+    update_site_option( 'bp-xprofile-base-group-name', _x( 'Base', 'First XProfile group name', 'buddypress' ) );
+    update_site_option( 'bp-xprofile-fullname-field-name', _x( 'Name', 'XProfile fullname field name', 'buddypress' ) );
 
     $sql[] = "CREATE TABLE {$wpdb->base_prefix}bp_xprofile_groups (
@@ -251 +251 @@
     dbDelta( $sql );
 
-    /* Insert the default group and fields */
-    $insert_sql = false;
+    // Insert the default group and fields
+    $insert_sql = array();
 
     if ( !$wpdb->get_var( "SELECT id FROM {$wpdb->base_prefix}bp_xprofile_groups WHERE id = 1" ) )
-        $insert_sql[] = "INSERT INTO {$wpdb->base_prefix}bp_xprofile_groups ( name, description, can_delete ) VALUES ( '" . get_site_option( 'bp-xprofile-base-group-name' ) . "', '', 0 );";
+        $insert_sql[] = "INSERT INTO {$wpdb->base_prefix}bp_xprofile_groups ( name, description, can_delete ) VALUES ( " . $wpdb->prepare( '%s', stripslashes( get_site_option( 'bp-xprofile-base-group-name' ) ) ) . ", '', 0 );";
 
     if ( !$wpdb->get_var( "SELECT id FROM {$wpdb->base_prefix}bp_xprofile_fields WHERE id = 1" ) )
-        $insert_sql[] = "INSERT INTO {$wpdb->base_prefix}bp_xprofile_fields ( group_id, parent_id, type, name, description, is_required, can_delete ) VALUES ( 1, 0, 'textbox', '" . get_site_option( 'bp-xprofile-fullname-field-name' ) . "', '', 1, 0 );";
+        $insert_sql[] = "INSERT INTO {$wpdb->base_prefix}bp_xprofile_fields ( group_id, parent_id, type, name, description, is_required, can_delete ) VALUES ( 1, 0, 'textbox', " . $wpdb->prepare( '%s', stripslashes( get_site_option( 'bp-xprofile-fullname-field-name' ) ) ) . ", '', 1, 0 );";
 
     dbDelta( $insert_sql );