hi, i think i fix the “magic quotes” thing. thanks jtimar.
what i did is i edit the wpads-class.php file of the plugin and removed the escape function both in update and add new banner. i know this may be risky but you are the only one using the add or edit banner form. so, check what you are putting in 1st.
/**
* Update data for a banner
*/
function updateBanner( $banner ) {
global $wpdb;
if( $banner["banner_active"] != "Y" ) {
$banner["banner_active"] = "N";
}
$banner["banner_zones"] = $this->zonesUserToDB( $banner["banner_zones"] );
$sql = "UPDATE " . $this->banners_table . " SET "
." banner_description = '" . $wpdb->escape( $banner["banner_description"] ) . "', "
." banner_html = '" . $wpdb->escape( $banner["banner_html"] ) . "', "
." banner_zones = '" . $banner["banner_zones"] . "', "
." banner_active = '" . $banner["banner_active"] . "', "
." banner_weight = '" . $banner["banner_weight"] . "', "
." banner_maxviews = '" . $banner["banner_maxviews"] . "' "
." WHERE banner_id = '" . $banner["banner_id"] . "' ";
$wpdb->query( $sql );
}
that is the original update function code. i changed it to:
/**
* Update data for a banner
*/
function updateBanner( $banner ) {
global $wpdb;
if( $banner["banner_active"] != "Y" ) {
$banner["banner_active"] = "N";
}
$banner["banner_zones"] = $this->zonesUserToDB( $banner["banner_zones"] );
$sql = "UPDATE " . $this->banners_table . " SET "
." banner_description = '" . $wpdb->escape( $banner["banner_description"] ) . "', "
." banner_html = '" . $banner["banner_html"] . "', "
." banner_zones = '" . $banner["banner_zones"] . "', "
." banner_active = '" . $banner["banner_active"] . "', "
." banner_weight = '" . $banner["banner_weight"] . "', "
." banner_maxviews = '" . $banner["banner_maxviews"] . "' "
." WHERE banner_id = '" . $banner["banner_id"] . "' ";
$wpdb->query( $sql );
}
also, the add banner function
/**
* Add a new banner to the database
*/
function addBanner( $banner ) {
global $wpdb;
if( $banner["banner_active"] != "Y" ) {
$banner["banner_active"] = "N";
}
$banner["banner_zones"] = $this->zonesUserToDB( $banner["banner_zones"] );
$sql = "INSERT INTO " . $this->banners_table . " SET "
." banner_description = '" . $wpdb->escape( $banner["banner_description"] ) . "', "
." banner_html = '" . $wpdb->escape( $banner["banner_html"] ). "', "
." banner_zones = '" . $banner["banner_zones"] . "', "
." banner_active = '" . $banner["banner_active"] . "', "
." banner_weight = '" . $banner["banner_weight"] . "', "
." banner_maxviews = '" . $banner["banner_maxviews"] . "' ";
$wpdb->query( $sql );
}
this is the original add new banner function. i changed it into :
/**
* Add a new banner to the database
*/
function addBanner( $banner ) {
global $wpdb;
if( $banner["banner_active"] != "Y" ) {
$banner["banner_active"] = "N";
}
$banner["banner_zones"] = $this->zonesUserToDB( $banner["banner_zones"] );
$sql = "INSERT INTO " . $this->banners_table . " SET "
." banner_description = '" . $banner["banner_description"] . "', "
." banner_html = '" . $wpdb->escape( $banner["banner_html"] ). "', "
." banner_zones = '" . $banner["banner_zones"] . "', "
." banner_active = '" . $banner["banner_active"] . "', "
." banner_weight = '" . $banner["banner_weight"] . "', "
." banner_maxviews = '" . $banner["banner_maxviews"] . "' ";
$wpdb->query( $sql );
}
i hope this works for you too. it did for me. and i hope a php developer look into this.
thanks