WordPress.org
Get WordPress

Plugin Directory

Changeset 3209617


Ignore:
Timestamp:
12/18/2024 04:54:40 AM (15 months ago)
Author:
rabilal
Message:

2.0.2

Location:
js-jobs
Files:
1051 added
29 edited

Legend:

Unmodified
Added
Removed

  • js-jobs/trunk/includes/activation.php

    r2919970 r3209617  
    456456            ('categories_colsperrow', '3', 'category'),
    457457            ('productcode', 'jsjobs', 'default'),
    458             ('versioncode', '2.0.1', 'default'),
     458            ('versioncode', '2.0.2', 'default'),
    459459            ('producttype', 'free', 'default'),
    460460            ('vis_jscredits', '1', 'jscontrolpanel'),

  • js-jobs/trunk/includes/classes/customfields.php

    r2919970 r3209617  
    13011301            $ff = "AND fieldfor = 3 AND section = $section ";
    13021302        }
    1303         $query = "SELECT field,fieldtitle,required,isuserfield,userfieldtype,readonly,maxlength,depandant_field,userfieldparams  from " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE isuserfield = 1 AND " . $published . " AND field ='" . $field . "'" . $ff;
     1303        $query = "SELECT field,fieldtitle,required,isuserfield,userfieldtype,readonly,maxlength,depandant_field,userfieldparams  from " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE isuserfield = 1 AND " . esc_sql($published) . " AND field ='" . esc_sql($field) . "'" . esc_sql($ff);
    13041304        $data = jsjobsdb::get_row($query);
    13051305        return $data;
    … …  
    13201320        }
    13211321
    1322         $query = "SELECT field,fieldtitle,isuserfield,userfieldtype,userfieldparams  FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE isuserfield = 1 AND " . $published . " AND fieldfor =" . $fieldfor . $inquery;
     1322        $query = "SELECT field,fieldtitle,isuserfield,userfieldtype,userfieldparams  FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE isuserfield = 1 AND " . esc_sql($published) . " AND fieldfor =" . esc_sql($fieldfor) . $inquery;
    13231323        $data = jsjobsdb::get_results($query);
    13241324        return $data;
    … …  
    13331333        $value = '';
    13341334        $returnarray = array();
    1335         $query = "SELECT field from " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE isuserfield = 1 AND " . $published . " AND depandant_field ='" . $fieldfor . "'";
     1335        $query = "SELECT field from " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE isuserfield = 1 AND " . esc_sql($published) . " AND depandant_field ='" . esc_sql($fieldfor) . "'";
    13361336        $field = jsjobsdb::get_var($query);
    13371337        if ($data != null) {
    … …  
    13421342            }
    13431343        }
    1344         $query = "SELECT userfieldparams from " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE isuserfield = 1 AND " . $published . " AND field ='" . $fieldfor . "'";
     1344        $query = "SELECT userfieldparams from " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE isuserfield = 1 AND " . esc_sql($published) . " AND field ='" . esc_sql($fieldfor) . "'";
    13451345        $field = jsjobsdb::get_var($query);
    13461346        $fieldarray = json_decode($field);

  • js-jobs/trunk/js-jobs.php

    r2919970 r3209617  
    33/**
    44 * @package JS Jobs Manager
    5  * @version 2.0.1
     5 * @version 2.0.2
    66 */
    77/*
    … …  
    1010  Description: JS Job Manager is Word Press best job board plugin. It is easy to use and highly configurable. It fully accommodates job seekers and employers.
    1111  Author: JoomSky
    12   Version: 2.0.1
     12  Version: 2.0.2
    1313  Text Domain: js-jobs
    1414  Author URI: http://www.joomsky.com
    … …  
    681681                    $query = "SELECT job.tags,job.metakeywords
    682682                        FROM `" . jsjobs::$_db->prefix . "js_job_jobs` AS job
    683                         WHERE job.id = " . $id;
     683                        WHERE job.id = " . esc_sql($id);
    684684                    $data = jsjobsdb::get_row($query);
    685685                    if($data != ''){
    … …  
    694694                    $query = "SELECT resume.tags,resume.keywords
    695695                        FROM `" . jsjobs::$_db->prefix . "js_job_resume` AS resume
    696                         WHERE resume.id = " . $id;
     696                        WHERE resume.id = " . esc_sql($id);
    697697                    $data = jsjobsdb::get_row($query);
    698698                    if($data != ''){
    … …  
    721721           return $redirect_to;
    722722       } else {
    723            $query = "SELECT roleid FROM `".jsjobs::$_db->prefix."js_job_users` WHERE uid = " . $user->id;
     723           $query = "SELECT roleid FROM `".jsjobs::$_db->prefix."js_job_users` WHERE uid = " . esc_sql($user->id);
    724724           $roleid = jsjobsdb::get_var($query);
    725725           $url = '/';

  • js-jobs/trunk/modules/activitylog/model.php

    r2919970 r3209617  
    318318        $query = "SELECT COUNT(act.id)
    319319        FROM `" . jsjobs::$_db->prefix . "js_job_activitylog` AS act
    320         LEFT JOIN `" . jsjobs::$_db->prefix . "js_job_users` AS u ON u.id = act.uid " . $inquery;
     320        LEFT JOIN `" . jsjobs::$_db->prefix . "js_job_users` AS u ON u.id = act.uid " . esc_sql($inquery);
    321321        $total = jsjobsdb::get_var($query);
    322322        jsjobs::$_data[1] = JSJOBSpagination::getPagination($total);
    … …  
    324324        $query = "SELECT act.description,act.created,act.id,act.referencefor,u.first_name,u.last_name
    325325        FROM `" . jsjobs::$_db->prefix . "js_job_activitylog` AS act
    326         LEFT JOIN `" . jsjobs::$_db->prefix . "js_job_users` AS u ON u.id = act.uid " . $inquery;
     326        LEFT JOIN `" . jsjobs::$_db->prefix . "js_job_users` AS u ON u.id = act.uid " . esc_sql($inquery);
    327327        $query .= "ORDER BY " . jsjobs::$_data['sorting'];
    328328        $query .=" LIMIT " . JSJOBSpagination::$_offset . "," . JSJOBSpagination::$_limit;

  • js-jobs/trunk/modules/age/model.php

    r2919970 r3209617  
    1010            return false;
    1111
    12         $query = "SELECT * FROM " . jsjobs::$_db->prefix . "js_job_ages WHERE id = " . $id;
     12        $query = "SELECT * FROM " . jsjobs::$_db->prefix . "js_job_ages WHERE id = " . esc_sql($id);
    1313        jsjobs::$_data[0] = jsjobsdb::get_row($query);
    1414
    … …  
    2424        if ($title != null) {
    2525            //$title = esc_sql($title);
    26             $inquery .= $clause . "title LIKE '%$title%'";
     26            $inquery .= $clause . "title LIKE '%".esc_sql($title)."%'";
    2727            $clause = ' AND ';
    2828        }
    2929        if (is_numeric($status))
    30             $inquery .=$clause . " status = " . $status;
     30            $inquery .=$clause . " status = " . esc_sql($status);
    3131
    3232        jsjobs::$_data['filter']['title'] = $title;
    … …  
    5252        //DB class limitations
    5353        if (is_numeric($id)) {
    54             $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_ages` SET isdefault = 0 WHERE id != " . $id;
     54            $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_ages` SET isdefault = 0 WHERE id != " . esc_sql($id);
    5555            jsjobsdb::query($query);
    5656        }
    … …  
    183183            return false;
    184184        $query = " SELECT
    185                     ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_ages` WHERE id = " . $ageid . " AND isdefault = 1)
     185                    ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_ages` WHERE id = " . esc_sql($ageid) . " AND isdefault = 1)
    186186                    AS total";
    187187        $total = jsjobsdb::get_var($query);
    … …  
    196196            return false;
    197197        $query = " SELECT
    198                     ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_jobs` WHERE agefrom = " . $ageid . " OR ageto = " . $ageid . ")
    199                     + ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_ages` WHERE id = " . $ageid . " AND isdefault = 1)
     198                    ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_jobs` WHERE agefrom = " . esc_sql($ageid) . " OR ageto = " . esc_sql($ageid) . ")
     199                    + ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_ages` WHERE id = " . esc_sql($ageid) . " AND isdefault = 1)
    200200                    AS total";
    201201        $total = jsjobsdb::get_var($query);

  • js-jobs/trunk/modules/careerlevel/model.php

    r2919970 r3209617  
    1010            return false;
    1111
    12         $query = "SELECT * FROM " . jsjobs::$_db->prefix . "js_job_careerlevels WHERE id = " . $id;
     12        $query = "SELECT * FROM " . jsjobs::$_db->prefix . "js_job_careerlevels WHERE id = " . esc_sql($id);
    1313        jsjobs::$_data[0] = jsjobsdb::get_row($query);
    1414
    … …  
    2424        $clause = ' WHERE ';
    2525        if ($title != null) {
    26             $inquery .= $clause . "title LIKE '%$title%'";
     26            $inquery .= $clause . "title LIKE '%".esc_sql($title)."%'";
    2727            $clause = ' AND ';
    2828        }
    2929        if (is_numeric($status))
    30             $inquery .=$clause . " status = " . $status;
     30            $inquery .=$clause . " status = " . esc_sql($status);
    3131
    3232        jsjobs::$_data['filter']['title'] = $title;
    … …  
    5454        if (!is_numeric($id))
    5555            return false;
    56         $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_careerlevels` SET isdefault = 0 WHERE id != " . $id;
     56        $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_careerlevels` SET isdefault = 0 WHERE id != " . esc_sql($id);
    5757        jsjobsdb::query($query);
    5858    }
    … …  
    183183        if (is_numeric($careerlevelid) == false)
    184184            return false;
    185         $query = " SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_careerlevels` WHERE id = " . $careerlevelid . " AND isdefault = 1 ";
     185        $query = " SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_careerlevels` WHERE id = " . esc_sql($careerlevelid) . " AND isdefault = 1 ";
    186186        $total = jsjobsdb::get_var($query);
    187187        if ($total > 0)
    … …  
    196196
    197197        $query = " SELECT
    198                     ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_jobs` WHERE careerlevel = " . $careerlevelid . ")
    199                     + ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_careerlevels` WHERE id = " . $careerlevelid . " AND isdefault = 1)
     198                    ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_jobs` WHERE careerlevel = " . esc_sql($careerlevelid) . ")
     199                    + ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_careerlevels` WHERE id = " . esc_sql($careerlevelid) . " AND isdefault = 1)
    200200                    AS total ";
    201201

  • js-jobs/trunk/modules/category/model.php

    r2919970 r3209617  
    1818        if (is_numeric($id) == false) return false;
    1919
    20         $query = " SELECT * FROM " . jsjobs::$_db->prefix . "js_job_categories WHERE id = " . $id;
     20        $query = " SELECT * FROM " . jsjobs::$_db->prefix . "js_job_categories WHERE id = " . esc_sql($id);
    2121        jsjobs::$_data[0] = jsjobsdb::get_row($query);
    2222
    … …  
    4242        $filter_flag = 0;
    4343        if ($categoryname != null) {
    44             $inquery .= " AND cat_title LIKE '%$categoryname%'";
     44            $inquery .= " AND cat_title LIKE '%".esc_sql($categoryname)."%'";
    4545            $statusop = 'WHERE 1 = 1 ';
    4646            $filter_flag = 1;
    … …  
    4848        if (is_numeric($status)) {
    4949            $statusop = 'WHERE 1 = 1 ';
    50             $inquery .=" AND isactive = " . $status;
     50            $inquery .=" AND isactive = " . esc_sql($status);
    5151            $filter_flag = 1;
    5252        }
    … …  
    164164            return false;
    165165        //DB class limitations
    166         $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_categories` SET isdefault = 0 WHERE id != " . $id;
     166        $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_categories` SET isdefault = 0 WHERE id != " . esc_sql($id);
    167167        jsjobsdb::query($query);
    168168    }
    … …  
    180180                return JSJOBS_ALREADY_EXIST;
    181181            } else {
    182                 $query = "SELECT max(ordering)+1 AS maxordering FROM " . jsjobs::$_db->prefix . "js_job_categories " . $inquery;
     182                $query = "SELECT max(ordering)+1 AS maxordering FROM " . jsjobs::$_db->prefix . "js_job_categories " . esc_sql($inquery);
    183183                $data['ordering'] = jsjobsdb::get_var($query);
    184184                if ($data['ordering'] == null)
    … …  
    310310            return false;
    311311        $query = "SELECT
    312                     ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_categories` WHERE id = " . $categoryid . " AND isdefault = 1)
     312                    ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_categories` WHERE id = " . esc_sql($categoryid) . " AND isdefault = 1)
    313313                    AS total ";
    314314        $total = jsjobsdb::get_var($query);
    … …  
    323323            return false;
    324324        $query = "SELECT
    325                     ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_companies` WHERE category = " . $categoryid . ")
    326                     +( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_jobs` WHERE jobcategory = " . $categoryid . ")
    327                     +( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_resume` WHERE job_category = " . $categoryid . ")
    328                     +( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_categories` WHERE id = " . $categoryid . " AND isdefault = 1)
     325                    ( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_companies` WHERE category = " . esc_sql($categoryid) . ")
     326                    +( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_jobs` WHERE jobcategory = " . esc_sql($categoryid) . ")
     327                    +( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_resume` WHERE job_category = " . esc_sql($categoryid) . ")
     328                    +( SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_categories` WHERE id = " . esc_sql($categoryid) . " AND isdefault = 1)
    329329                    AS total ";
    330330        $total = jsjobsdb::get_var($query);
    … …  
    337337    function isCategoryExist($title) {
    338338
    339         $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_categories WHERE cat_title = '" . $title . "'";
     339        $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_categories WHERE cat_title = '" . esc_sql($title) . "'";
    340340        $result = jsjobsdb::get_var($query);
    341341        if ($result > 0)

  • js-jobs/trunk/modules/city/model.php

    r2919970 r3209617  
    8484        }
    8585        if ($countryid) {
    86             $inquery .= $clause . "countryid = " . $countryid;
     86            $inquery .= $clause . "countryid = " . esc_sql($countryid);
    8787            $clause = ' AND ';
    8888        }
    … …  
    230230
    231231        $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_cities WHERE countryid=" . $countryid . "
    232         AND stateid=" . $stateid . " AND LOWER(name) = '" . jsjobslib::jsjobs_strtolower($title) . "'";
     232        AND stateid=" . $stateid . " AND LOWER(name) = '" . esc_sql(jsjobslib::jsjobs_strtolower($title)) . "'";
    233233
    234234        $result = jsjobsdb::get_var($query);
    … …  
    335335        if ($id == 0) {
    336336            if (isset($countryname)) {
    337                 $query .= " WHERE city.name LIKE '" . $cityname . "%' AND country.name LIKE '" . $countryname . "%' AND country.enabled = 1 AND city.enabled = 1 AND IF(state.name is not null,state.enabled,1) = 1 LIMIT " . JSJOBSincluder::getJSModel('configuration')->getConfigValue("number_of_cities_for_autocomplete");
     337                $query .= " WHERE city.name LIKE '" . esc_sql($cityname) . "%' AND country.name LIKE '" . esc_sql($countryname) . "%' AND country.enabled = 1 AND city.enabled = 1 AND IF(state.name is not null,state.enabled,1) = 1 LIMIT " . JSJOBSincluder::getJSModel('configuration')->getConfigValue("number_of_cities_for_autocomplete");
    338338                //$query .= " WHERE city.cityName LIKE '" . $cityname . "%' AND country.name LIKE '" . $countryname . "%' AND country.enabled = 1 AND city.enabled = 1 AND IF(state.name is not null,state.enabled,1) = 1 LIMIT " . JSJOBSincluder::getJSModel('configuration')->getConfigValue("number_of_cities_for_autocomplete");
    339339            } else {
    340                 $query .= " WHERE city.name LIKE '" . $cityname . "%' AND country.enabled = 1 AND city.enabled = 1 AND IF(state.name is not null,state.enabled,1) = 1 LIMIT " . JSJOBSincluder::getJSModel('configuration')->getConfigValue("number_of_cities_for_autocomplete");
     340                $query .= " WHERE city.name LIKE '" . esc_sql($cityname) . "%' AND country.enabled = 1 AND city.enabled = 1 AND IF(state.name is not null,state.enabled,1) = 1 LIMIT " . JSJOBSincluder::getJSModel('configuration')->getConfigValue("number_of_cities_for_autocomplete");
    341341                //$query .= " WHERE city.cityName LIKE '" . $cityname . "%' AND country.enabled = 1 AND city.enabled = 1 AND IF(state.name is not null,state.enabled,1) = 1 LIMIT " . JSJOBSincluder::getJSModel('configuration')->getConfigValue("number_of_cities_for_autocomplete");
    342342            }

  • js-jobs/trunk/modules/common/model.php

    r2919970 r3209617  
    4747                    $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_" . $tablename . "` AS t SET t." . $column . " = 0 ";
    4848                    jsjobsdb::query($query);
    49                     $query = "UPDATE  `" . jsjobs::$_db->prefix . "js_job_" . $tablename . "` AS t SET t." . $column . " = 1 WHERE id=" . $id;
     49                    $query = "UPDATE  `" . jsjobs::$_db->prefix . "js_job_" . $tablename . "` AS t SET t." . $column . " = 1 WHERE id=" . esc_sql($id);
    5050                    if (!jsjobsdb::query($query))
    5151                        return JSJOBS_SET_DEFAULT_ERROR;
    … …  
    7575                break;
    7676        }
    77         $query = "SELECT " . $column . " FROM `" . jsjobs::$_db->prefix . "js_job_" . $tablename . "` WHERE id=" . $id;
     77        $query = "SELECT " . $column . " FROM `" . jsjobs::$_db->prefix . "js_job_" . $tablename . "` WHERE id=" . esc_sql($id);
    7878        $res = jsjobsdb::get_var($query);
    7979        if ($res == 1)
    … …  
    132132            $query = "UPDATE " . jsjobs::$_db->prefix . "js_job_" . $table . " AS f1, " . jsjobs::$_db->prefix . "js_job_" . $table . " AS f2
    133133                        SET f1.ordering = f1.ordering + 1
    134                         WHERE f1.ordering = f2.ordering - 1 AND f1.parentid = ".$parentid."
    135                         AND f2.id = " . $field_id;
     134                        WHERE f1.ordering = f2.ordering - 1 AND f1.parentid = ".esc_sql($parentid)."
     135                        AND f2.id = " . esc_sql($field_id);
    136136        }else{
    137137            $query = "UPDATE " . jsjobs::$_db->prefix . "js_job_" . $table . " AS f1, " . jsjobs::$_db->prefix . "js_job_" . $table . " AS f2
    138138                        SET f1.ordering = f1.ordering + 1
    139139                        WHERE f1.ordering = f2.ordering - 1
    140                         AND f2.id = " . $field_id;
     140                        AND f2.id = " . esc_sql($field_id);
    141141        }
    142142        if (false == jsjobsdb::query($query)) {
    … …  
    145145        $query = " UPDATE " . jsjobs::$_db->prefix . "js_job_" . $table . "
    146146                    SET ordering = ordering - 1
    147                     WHERE id = " . $field_id;
     147                    WHERE id = " . esc_sql($field_id);
    148148
    149149        if (false == jsjobsdb::query($query)) {
    … …  
    161161            $query = "UPDATE " . jsjobs::$_db->prefix . "js_job_" . $table . " AS f1, " . jsjobs::$_db->prefix . "js_job_" . $table . " AS f2
    162162                        SET f1.ordering = f1.ordering - 1
    163                         WHERE f1.ordering = f2.ordering + 1 AND f1.parentid = ".$parentid."
    164                         AND f2.id = " . $field_id;
     163                        WHERE f1.ordering = f2.ordering + 1 AND f1.parentid = ".esc_sql($parentid)."
     164                        AND f2.id = " . esc_sql($field_id);
    165165        }else{
    166166            $query = "UPDATE " . jsjobs::$_db->prefix . "js_job_" . $table . " AS f1, " . jsjobs::$_db->prefix . "js_job_" . $table . " AS f2
    167167                        SET f1.ordering = f1.ordering - 1
    168168                        WHERE f1.ordering = f2.ordering + 1
    169                         AND f2.id = " . $field_id;
     169                        AND f2.id = " . esc_sql($field_id);
    170170        }
    171171
    … …  
    175175        $query = " UPDATE " . jsjobs::$_db->prefix . "js_job_" . $table . "
    176176                    SET ordering = ordering + 1
    177                     WHERE id = " . $field_id;
     177                    WHERE id = " . esc_sql($field_id);
    178178
    179179        if (false == jsjobsdb::query($query)) {
    … …  
    586586                        LEFT JOIN `".jsjobs::$_db->prefix."js_job_states` AS state on city.stateid=state.id
    587587                        WHERE country.enabled = 1 AND city.enabled = 1";
    588             $query .= " AND city.id =".$city;
     588            $query .= " AND city.id =".esc_sql($city);
    589589
    590590

  • js-jobs/trunk/modules/company/model.php

    r2919970 r3209617  
    234234        if ($datestart != null) {
    235235            $datestart = date('Y-m-d',jsjobslib::jsjobs_strtotime($datestart));
    236             $inquery .= " AND DATE(company.created) >= '" . $datestart . "'";
     236            $inquery .= " AND DATE(company.created) >= '" . esc_sql($datestart) . "'";
    237237        }
    238238
    239239        if ($dateend != null) {
    240240            $dateend = date('Y-m-d',jsjobslib::jsjobs_strtotime($dateend));
    241             $inquery .= " AND DATE(company.created) <= '" . $dateend . "'";
     241            $inquery .= " AND DATE(company.created) <= '" . esc_sql($dateend) . "'";
    242242        }
    243243
    … …  
    543543            if (!is_numeric($uid))
    544544                return false;
    545             $query .= " AND uid = " . $uid;
     545            $query .= " AND uid = " .esc_sql($uid);
    546546        }
    547547        $query .= " ORDER BY id ASC ";
    … …  
    635635        $uid = JSJOBSincluder::getObjectClass('user')->uid();
    636636        if(!is_numeric($uid)) return false;
    637         $query = "SELECT id, name AS text FROM `" . jsjobs::$_db->prefix . "js_job_companies` WHERE uid = " . $uid . " AND status = 1 ORDER BY name ASC ";
     637        $query = "SELECT id, name AS text FROM `" . jsjobs::$_db->prefix . "js_job_companies` WHERE uid = " . esc_sql($uid) . " AND status = 1 ORDER BY name ASC ";
    638638        $rows = jsjobsdb::get_results($query);
    639639        return $rows;

  • js-jobs/trunk/modules/configuration/model.php

    r2919970 r3209617  
    9494                }
    9595            }
    96             $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET `configvalue` = '$value' WHERE `configname`= '" . $key . "'";
     96            $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET `configvalue` = '$value' WHERE `configname`= '" . esc_sql($key) . "'";
    9797            if (false === jsjobsdb::query($query)) {
    9898                $error = true;
    … …  
    108108        if (!$configfor)
    109109            return;
    110         $query = "SELECT * FROM `" . jsjobs::$_db->prefix . "js_job_config` WHERE configfor = '" . $configfor . "'";
     110        $query = "SELECT * FROM `" . jsjobs::$_db->prefix . "js_job_config` WHERE configfor = '" . esc_sql($configfor) . "'";
    111111        $config = jsjobsdb::get_results($query);
    112112        $configs = array();
    … …  
    125125
    126126    function getConfigValue($configname) {
    127         $query = "SELECT configvalue FROM `" . jsjobs::$_db->prefix . "js_job_config` WHERE configname = '" . $configname . "'";
     127        $query = "SELECT configvalue FROM `" . jsjobs::$_db->prefix . "js_job_config` WHERE configname = '" . esc_sql($configname) . "'";
    128128        //return jsjobsdb::get_var($query);
    129129        return jsjobs::$_db->get_var($query);
    … …  
    132132    function getConfigurationByConfigForMultiple($configfor){
    133133        $query = "SELECT configname,configvalue
    134                   FROM `".jsjobs::$_db->prefix."js_job_config` WHERE configfor IN (".$configfor.")";
     134                  FROM `".jsjobs::$_db->prefix."js_job_config` WHERE configfor IN (".esc_sql($configfor).")";
    135135        $result = jsjobsdb::get_results($query);
    136136        $config_array =  array();
    … …  
    144144    function getConfigurationByConfigName($configname){
    145145        $query = "SELECT configvalue
    146                   FROM `".jsjobs::$_db->prefix."js_job_config` WHERE configname ='" . $configname . "'";
     146                  FROM `".jsjobs::$_db->prefix."js_job_config` WHERE configname ='" . esc_sql($configname) . "'";
    147147        $result = jsjobsdb::get_var($query);
    148148        return $result;
    … …  
    152152    function checkCronKey($passkey) {
    153153
    154         $query = "SELECT COUNT(configvalue) FROM `".jsjobs::$_db->prefix."js_job_config` WHERE configname = 'cron_job_alert_key' AND configvalue = '" . $passkey . "'";
     154        $query = "SELECT COUNT(configvalue) FROM `".jsjobs::$_db->prefix."js_job_config` WHERE configname = 'cron_job_alert_key' AND configvalue = '" . esc_sql($passkey) . "'";
    155155        $key = jsjobsdb::get_var($query);
    156156        if ($key == 1)

  • js-jobs/trunk/modules/country/model.php

    r2919970 r3209617  
    201201        if (!$country)
    202202            return;
    203         $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_countries WHERE name = '" . $country . "'";
     203        $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_countries WHERE name = '" . esc_sql($country) . "'";
    204204        $total = jsjobsdb::get_var($query);
    205205        if ($total > 0)
    … …  
    218218        if (!$name)
    219219            return;
    220         $query = "SELECT id FROM `" . jsjobs::$_db->prefix . "js_job_countries` WHERE REPLACE(LOWER(name), ' ', '') = REPLACE(LOWER('" . $name . "'), ' ', '') AND enabled = 1";
     220        $query = "SELECT id FROM `" . jsjobs::$_db->prefix . "js_job_countries` WHERE REPLACE(LOWER(name), ' ', '') = REPLACE(LOWER('" . esc_sql($name) . "'), ' ', '') AND enabled = 1";
    221221        $id = jsjobsdb::get_var($query);
    222222        return $id;

  • js-jobs/trunk/modules/coverletter/model.php

    r2919970 r3209617  
    100100        foreach($ids AS $id){
    101101            if(!is_numeric($id)) return false;
    102             $query = "SELECT COUNT(jobapply.id) FROM `" . jsjobs::$_db->prefix . "js_job_jobapply` AS jobapply WHERE jobapply.coverletterid = " . $id;
     102            $query = "SELECT COUNT(jobapply.id) FROM `" . jsjobs::$_db->prefix . "js_job_jobapply` AS jobapply WHERE jobapply.coverletterid = " . esc_sql($id);
    103103            $total = jsjobsdb::get_var($query);
    104104            if ($total > 0) { // Cover letter in use

  • js-jobs/trunk/modules/currency/model.php

    r2919970 r3209617  
    4242        $clause = ' WHERE ';
    4343        if ($title != null) {
    44             $inquery .= $clause . "title LIKE '%" . $title . "%'";
     44            $inquery .= $clause . "title LIKE '%" . esc_sql($title) . "%'";
    4545            $clause = ' AND ';
    4646        }
    4747        if (is_numeric($status))
    48             $inquery .=$clause . " status = " . $status;
     48            $inquery .=$clause . " status = " . esc_sql($status);
    4949        if ($code != null)
    50             $inquery .=$clause . " code LIKE '%" . $code . "%'";
     50            $inquery .=$clause . " code LIKE '%" . esc_sql($code) . "%'";
    5151
    5252        jsjobs::$_data['filter']['title'] = $title;
    … …  
    129129
    130130    function isCurrencyExist($title) {
    131         $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_currencies WHERE title = '" . $title . "'";
     131        $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_currencies WHERE title = '" . esc_sql($title) . "'";
    132132        $result = jsjobsdb::get_var($query);
    133133        if ($result > 0)
    … …  
    201201
    202202    function currencyCanUnpulish($currencyid) {
    203         $query = " SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_currencies` AS cur WHERE cur.id = " . $currencyid . " AND cur.default = 1 ";
     203        $query = " SELECT COUNT(id) FROM `" . jsjobs::$_db->prefix . "js_job_currencies` AS cur WHERE cur.id = " . esc_sql($currencyid) . " AND cur.default = 1 ";
    204204        $total = jsjobsdb::get_var($query);
    205205        if ($total > 0)

  • js-jobs/trunk/modules/customfield/model.php

    r2796326 r3209617  
    6262            $query = "SELECT  id,field,fieldtitle,ordering,section,fieldfor,isvisitorpublished AS published,sys,cannotunpublish,required
    6363                        FROM `" . jsjobs::$_db->prefix . "js_job_fieldsordering`
    64                         WHERE isvisitorpublished = 1 AND fieldfor =  " . $fieldfor . " AND section = " . $section
     64                        WHERE isvisitorpublished = 1 AND fieldfor =  " . $fieldfor . " AND section = " . esc_sql($section)
    6565                    . " ORDER BY section,ordering";
    6666        } else {
    … …  
    7070            }
    7171            $query = "SELECT  * FROM `" . jsjobs::$_db->prefix . "js_job_fieldsordering`
    72                         WHERE " . $published_field . " AND fieldfor =  " . $fieldfor . " AND section = " . $section
     72                        WHERE " . $published_field . " AND fieldfor =  " . $fieldfor . " AND section = " . esc_sql($section)
    7373                    . " ORDER BY section,ordering ";
    7474        }

  • js-jobs/trunk/modules/departments/model.php

    r2919970 r3209617  
    3434        $inquery = " WHERE department.status != 0 ";
    3535        if ($departmentname) {
    36             $inquery .= " AND department.name LIKE '%" . $departmentname . "%' ";
     36            $inquery .= " AND department.name LIKE '%" . esc_sql($departmentname) . "%' ";
    3737        }
    3838        if ($companyname) {
    39             $inquery .= " AND company.name LIKE '%" . $companyname . "%' ";
     39            $inquery .= " AND company.name LIKE '%" . esc_sql($companyname) . "%' ";
    4040        }if (is_numeric($status)) {
    41             $inquery .= " AND department.status = " . $status;
     41            $inquery .= " AND department.status = " . esc_sql($status);
    4242        }
    4343        if (is_numeric($companyid)) {
    4444            $inquery .= " AND company.id = " . $companyid;
    45             $query = "SELECT name FROM `" . jsjobs::$_db->prefix . "js_job_companies` WHERE id = " . $companyid;
     45            $query = "SELECT name FROM `" . jsjobs::$_db->prefix . "js_job_companies` WHERE id = " . esc_sql($companyid);
    4646            jsjobs::$_data[0]['companyname'] = jsjobsdb::get_var($query);
    4747        }
    … …  
    8282        $inquery = "";
    8383        if ($departmentname) {
    84             $inquery .= " AND department.name LIKE '%" . $departmentname . "%' ";
     84            $inquery .= " AND department.name LIKE '%" . esc_sql($departmentname) . "%' ";
    8585        }
    8686        if ($companyname) {
    87             $inquery .= " AND company.name LIKE '%" . $companyname . "%' ";
     87            $inquery .= " AND company.name LIKE '%" . esc_sql($companyname) . "%' ";
    8888        }if (is_numeric($status)) {
    89             $inquery .= " AND department.status = " . $status;
     89            $inquery .= " AND department.status = " . esc_sql($status);
    9090        }
    9191        if (is_numeric($companyid)) {
    92             $inquery .= " AND company.id = " . $companyid;
    93             $query = "SELECT name FROM `" . jsjobs::$_db->prefix . "js_job_companies` WHERE id = " . $companyid;
     92            $inquery .= " AND company.id = " . esc_sql($companyid);
     93            $query = "SELECT name FROM `" . jsjobs::$_db->prefix . "js_job_companies` WHERE id = " . esc_sql($companyid);
    9494            jsjobs::$_data[0]['companyname'] = jsjobsdb::get_var($query);
    9595        }
    … …  
    151151        $inquery = "";
    152152        if ($searchcompany)
    153             $inquery .= " AND LOWER(company.name) LIKE '%" . $searchcompany . "%'";
     153            $inquery .= " AND LOWER(company.name) LIKE '%" . esc_sql($searchcompany) . "%'";
    154154        if ($searchdepartment)
    155             $inquery .= " AND LOWER(department.name) LIKE '%" . $searchdepartment . "%'";
     155            $inquery .= " AND LOWER(department.name) LIKE '%" . esc_sql($searchdepartment) . "%'";
    156156
    157157        //Pagination
    … …  
    305305        }
    306306        if ($published == 1) {
    307             $query = "SELECT id, name FROM " . jsjobs::$_db->prefix . "js_job_departments  WHERE status = 1 AND companyid = " . $val . " ORDER BY name ASC";
     307            $query = "SELECT id, name FROM " . jsjobs::$_db->prefix . "js_job_departments  WHERE status = 1 AND companyid = " . esc_sql($val) . " ORDER BY name ASC";
    308308            $result = jsjobsdb::get_results($query);
    309309            $required = ($authentication->required == 1) ? 'data-validation="required"' : '';

  • js-jobs/trunk/modules/emailtemplate/model.php

    r2919970 r3209617  
    13821382        }
    13831383
    1384         $query = "SELECT * FROM `" . jsjobs::$_db->prefix . "js_job_emailtemplates` WHERE templatefor = '" . $tempatefor . "'";
     1384        $query = "SELECT * FROM `" . jsjobs::$_db->prefix . "js_job_emailtemplates` WHERE templatefor = '" . esc_sql($tempatefor) . "'";
    13851385        jsjobs::$_data[0] = jsjobsdb::get_row($query);
    13861386
    … …  
    14111411        $templatefor = 'job-new-vis';
    14121412
    1413         $query = "SELECT template.* FROM `" . jsjobs::$_db->prefix . "js_job_emailtemplates` AS template    WHERE template.templatefor = '" . $templatefor."'";
     1413        $query = "SELECT template.* FROM `" . jsjobs::$_db->prefix . "js_job_emailtemplates` AS template    WHERE template.templatefor = '" . esc_sql($templatefor)."'";
    14141414
    14151415        $template = jsjobsdb::get_row($query);

  • js-jobs/trunk/modules/emailtemplatestatus/model.php

    r2796326 r3209617  
    171171        $query = "SELECT emc.admin,emc.employer,emc.jobseeker,emc.employer_visitor,emc.jobseeker_visitor
    172172                FROM " . jsjobs::$_db->prefix . "js_job_emailtemplates_config AS emc
    173                 where  emc.emailfor = '" . $template_name . "'";
     173                where  emc.emailfor = '" . esc_sql($template_name) . "'";
    174174        $templatestatus = jsjobsdb::get_row($query);
    175175        return $templatestatus;

  • js-jobs/trunk/modules/experience/model.php

    r2919970 r3209617  
    2323        $clause = ' WHERE ';
    2424        if ($title != null) {
    25             $inquery .= $clause . "title LIKE '%" . $title . "%'";
     25            $inquery .= $clause . "title LIKE '%" . esc_sql($title) . "%'";
    2626            $clause = ' AND ';
    2727        }
    2828        if (is_numeric($status))
    29             $inquery .=$clause . " status = " . $status;
     29            $inquery .=$clause . " status = " . esc_sql($status);
    3030
    3131        jsjobs::$_data['filter']['title'] = $title;
    … …  
    220220        if (!$title)
    221221            return;
    222         $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_experiences WHERE title = '" . $title . "'";
     222        $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_experiences WHERE title = '" . esc_sql($title) . "'";
    223223        $result = jsjobsdb::get_var($query);
    224224        if ($result > 0)

  • js-jobs/trunk/modules/fieldordering/model.php

    r2919970 r3209617  
    1919        foreach ($ids as $id) {
    2020            if(is_numeric($id) && is_numeric($value)){
    21                 $query = "UPDATE " . jsjobs::$_db->prefix . "js_job_fieldsordering SET required = " . $value . " WHERE id = " . $id . " AND sys=0";
     21                $query = "UPDATE " . jsjobs::$_db->prefix . "js_job_fieldsordering SET required = " . $value . " WHERE id = " . esc_sql($id) . " AND sys=0";
    2222                if (false === jsjobsdb::query($query)) {
    2323                    $total += 1;
    … …  
    5252        $inquery = '';
    5353        if ($title != null)
    54             $inquery .= " AND field.fieldtitle LIKE '%$title%'";
     54            $inquery .= " AND field.fieldtitle LIKE '%".esc_sql($title)."%'";
    5555        if (is_numeric($ustatus))
    56             $inquery .= " AND field.published = $ustatus";
     56            $inquery .= " AND field.published = $".esc_sql(ustatus);
    5757        if (is_numeric($vstatus))
    58             $inquery .= " AND field.isvisitorpublished = $vstatus";
     58            $inquery .= " AND field.isvisitorpublished = ".esc_sql($vstatus);
    5959        if (is_numeric($required))
    60             $inquery .= " AND field.required = $required";
     60            $inquery .= " AND field.required = ".esc_sql($required);
    6161
    6262        jsjobs::$_data['filter']['title'] = $title;
    … …  
    181181        foreach ($ids as $id) {
    182182            if(is_numeric($id) && is_numeric($value)){
    183                 $query = "UPDATE " . jsjobs::$_db->prefix . "js_job_fieldsordering SET published = " . $value . " WHERE id = " . $id . " AND cannotunpublish=0";
     183                $query = "UPDATE " . jsjobs::$_db->prefix . "js_job_fieldsordering SET published = " . $value . " WHERE id = " . esc_sql($id) . " AND cannotunpublish=0";
    184184                if (false === jsjobsdb::query($query)) {
    185185                    $total += 1;
    … …  
    212212        foreach ($ids as $id) {
    213213            if(is_numeric($id) && is_numeric($value)){
    214                 $query = "UPDATE " . jsjobs::$_db->prefix . "js_job_fieldsordering SET isvisitorpublished = " . $value . " WHERE id = " . $id . " AND cannotunpublish=0";
     214                $query = "UPDATE " . jsjobs::$_db->prefix . "js_job_fieldsordering SET isvisitorpublished = " . $value . " WHERE id = " . esc_sql($id) . " AND cannotunpublish=0";
    215215                if (false === jsjobsdb::query($query)) {
    216216                    $total += 1;
    … …  
    290290            // value to add as field ordering
    291291            if ($data['id'] == '') { // only for new
    292                 $query = "SELECT max(ordering) FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE fieldfor = " . $data['fieldfor'];
     292                $query = "SELECT max(ordering) FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE fieldfor = " . esc_sql($data['fieldfor']);
    293293                $var = jsjobsdb::get_var($query);
    294294                $data['ordering'] = $var + 1;
    295295                // search ordering code //
    296                 $query = "SELECT max(ordering) FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE fieldfor = " . $data['fieldfor'];
     296                $query = "SELECT max(ordering) FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE fieldfor = " . esc_sql($data['fieldfor']);
    297297                $var = jsjobsdb::get_var($query);
    298298                $data['search_ordering'] = $var + 1;
    … …  
    409409        $editquery = '';
    410410        if($parentfield){
    411             $query = "SELECT id FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE fieldfor = $fieldfor AND (userfieldtype = 'radio' OR userfieldtype = 'combo' OR userfieldtype = 'depandant_field') AND depandant_field = '" . $parentfield . "' ";
     411            $query = "SELECT id FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE fieldfor = $fieldfor AND (userfieldtype = 'radio' OR userfieldtype = 'combo' OR userfieldtype = 'depandant_field') AND depandant_field = '" . esc_sql($parentfield) . "' ";
    412412            $parent = jsjobsdb::get_var($query);
    413413            $wherequery = ' OR id = '.$parent;
    … …  
    430430        $datas = array();
    431431        if(is_numeric($field)){
    432             $query = "SELECT userfieldparams FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE id=$field";
     432            $query = "SELECT userfieldparams FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE id=".esc_sql($field);
    433433            $data = jsjobsdb::get_var($query);
    434434            $datas = json_decode(jsjobslib::jsjobs_stripslashes($data));
    … …  
    609609        $query = ' SELECT
    610610                    ( SELECT COUNT(id) FROM `' . jsjobs::$_db->prefix . 'js_job_'.$table.'` WHERE
    611                         params LIKE \'%"' . $fieldname . '":%\'
     611                        params LIKE \'%"' . esc_sql($fieldname) . '":%\'
    612612                    )
    613613                    AS total';
    … …  
    630630            $published .= " AND section = $resumesection ";
    631631        }
    632         $query = "SELECT field,userfieldparams,userfieldtype FROM `" . jsjobs::$_db->prefix . "js_job_fieldsordering` WHERE fieldfor = " . $fieldfor . " AND isuserfield = 1 AND " . $published;
     632        $query = "SELECT field,userfieldparams,userfieldtype FROM `" . jsjobs::$_db->prefix . "js_job_fieldsordering` WHERE fieldfor = " . $fieldfor . " AND isuserfield = 1 AND " . esc_sql($published);
    633633        $fields = jsjobsdb::get_results($query);
    634634        return $fields;
    … …  
    649649    function makeDependentComboFiledForResume($val,$childfield,$type,$section,$sectionid,$themecall){
    650650
    651         $query = "SELECT field,depandant_field,userfieldparams,fieldtitle, required FROM `".jsjobs::$_db->prefix."js_job_fieldsordering` WHERE field = '".$childfield."'";
     651        $query = "SELECT field,depandant_field,userfieldparams,fieldtitle, required FROM `".jsjobs::$_db->prefix."js_job_fieldsordering` WHERE field = '".esc_sql($childfield)."'";
    652652        $data = jsjobs::$_db->get_row($query);
    653653        $decoded_data = json_decode($data->userfieldparams);
    … …  
    774774        }
    775775
    776         $query = "SELECT field  FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE showonlisting = 1 AND " . $published . " AND fieldfor =" . $fieldfor ;
     776        $query = "SELECT field  FROM " . jsjobs::$_db->prefix . "js_job_fieldsordering WHERE showonlisting = 1 AND " . esc_sql($published) . " AND fieldfor =" . esc_sql($fieldfor) ;
    777777        $data = jsjobsdb::get_results($query);
    778778        $return_array = array();

  • js-jobs/trunk/modules/highesteducation/model.php

    r2919970 r3209617  
    2222        $clause = ' WHERE ';
    2323        if ($title != null) {
    24             $inquery .= $clause . "title LIKE '%" . $title . "%'";
     24            $inquery .= $clause . "title LIKE '%" . esc_sql($title) . "%'";
    2525            $clause = ' AND ';
    2626        }
    2727        if (is_numeric($status))
    28             $inquery .=$clause . " isactive = " . $status;
     28            $inquery .=$clause . " isactive = " . esc_sql($status);
    2929
    3030        jsjobs::$_data['filter']['title'] = $title;
    … …  
    223223
    224224    function isHighestEducationExist($title) {
    225         $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_heighesteducation WHERE title = '" . $title . "'";
     225        $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_heighesteducation WHERE title = '" . esc_sql($title) . "'";
    226226        $result = jsjobsdb::get_var($query);
    227227        if ($result > 0)

  • js-jobs/trunk/modules/installer/controller.php

    r2919970 r3209617  
    5151    function updateConfiguration($data) {
    5252        //DB class limitations
    53         $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . $data['showemployerlink'] . "' WHERE configname = 'showemployerlink'";
     53        $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . esc_sql($data['showemployerlink']) . "' WHERE configname = 'showemployerlink'";
    5454        jsjobsdb::query($query);
    5555       
    56         $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . $data['newlisting_requiredpackage'] . "' WHERE configname = 'newlisting_requiredpackage'";
     56        $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . esc_sql($data['newlisting_requiredpackage']) . "' WHERE configname = 'newlisting_requiredpackage'";
    5757        jsjobsdb::query($query);
    5858       
    5959       
    60         $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . $data['visitor_can_post_job'] . "' WHERE configname = 'visitor_can_post_job'";
     60        $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . esc_sql($data['visitor_can_post_job']) . "' WHERE configname = 'visitor_can_post_job'";
    6161        jsjobsdb::query($query);
    6262       
    63         $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . $data['js_newlisting_requiredpackage'] . "' WHERE configname = 'js_newlisting_requiredpackage'";
     63        $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . esc_sql($data['js_newlisting_requiredpackage']) . "' WHERE configname = 'js_newlisting_requiredpackage'";
    6464        jsjobsdb::query($query);
    6565       
    66         $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . $data['visitor_can_apply_to_job'] . "' WHERE configname = 'visitor_can_apply_to_job'";
     66        $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . esc_sql($data['visitor_can_apply_to_job']) . "' WHERE configname = 'visitor_can_apply_to_job'";
    6767        jsjobsdb::query($query);
    6868       
    69         $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . $data['offline'] . "' WHERE configname = 'offline'";
     69        $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET configvalue = '" . esc_sql($data['offline']) . "' WHERE configname = 'offline'";
    7070        jsjobsdb::query($query);
    7171    }

  • js-jobs/trunk/modules/job/model.php

    r2919970 r3209617  
    688688        $inquery = "";
    689689        if ($searchtitle)
    690             $inquery .= " AND LOWER(job.title) LIKE '%" . $searchtitle . "%'";
     690            $inquery .= " AND LOWER(job.title) LIKE '%" . esc_sql($searchtitle) . "%'";
    691691        if ($searchcompany)
    692             $inquery .= " AND LOWER(company.name) LIKE '%" . $searchcompany . "%'";
     692            $inquery .= " AND LOWER(company.name) LIKE '%" . esc_sql($searchcompany) . "%'";
    693693        if ($searchjobcategory)
    694             $inquery .= " AND job.jobcategory = " . $searchjobcategory;
     694            $inquery .= " AND job.jobcategory = " . esc_sql($searchjobcategory);
    695695        if ($searchjobtype)
    696             $inquery .= " AND job.jobtype = " . $searchjobtype;
     696            $inquery .= " AND job.jobtype = " . esc_sql($searchjobtype);
    697697        if ($dateend != null){
    698698            $dateend = date('Y-m-d',jsjobslib::jsjobs_strtotime($dateend));
    699             $inquery .= " AND DATE(job.created) <= '" . $dateend . "'";
     699            $inquery .= " AND DATE(job.created) <= '" . esc_sql($dateend) . "'";
    700700        }
    701701        if ($datestart != null){
    702702            $datestart = date('Y-m-d',jsjobslib::jsjobs_strtotime($datestart));
    703             $inquery .= " AND DATE(job.created) >= '" . $datestart . "'";
     703            $inquery .= " AND DATE(job.created) >= '" . esc_sql($datestart) . "'";
    704704        }
    705705        if ($status != null)
    706706            $inquery .= " AND job.status = $status";
    707707        if ($location != null)
    708             $inquery .= " AND city.cityName LIKE '%" . $location . "%'";
     708            $inquery .= " AND city.cityName LIKE '%" . esc_sql($location) . "%'";
    709709
    710710        $query = "SELECT COUNT(job.id) FROM `" . jsjobs::$_db->prefix . "js_job_jobs` AS job
    … …  
    934934                    $notdeleted += 1;
    935935                } else {
    936                     $query = "DELETE FROM `" . jsjobs::$_db->prefix . "js_job_jobcities` WHERE jobid = " . $id;
     936                    $query = "DELETE FROM `" . jsjobs::$_db->prefix . "js_job_jobcities` WHERE jobid = " . esc_sql($id);
    937937                    jsjobsdb::query($query);
    938938                    JSJOBSincluder::getJSModel('emailtemplate')->sendMail(2, 2, $id,$mailextradata); // 2 for job,2 for DELETE job
    … …  
    11661166            }
    11671167            for ($j = 0; $j < $i; $j++) {
    1168                 $keys[] = " job.metakeywords Like '%" . $keywords[$j] . "%'";
     1168                $keys[] = " job.metakeywords Like '%" . esc_sql($keywords[$j]) . "%'";
    11691169            }
    11701170        }
    … …  
    11861186            for ($k = 0; $k < $r; $k++) {
    11871187                $t_keywords = jsjobslib::jsjobs_str_replace("'", "", $title_keywords[$k]);
    1188                 $titlekeys[] = " job.title LIKE '%" . $t_keywords . "%'";
     1188                $titlekeys[] = " job.title LIKE '%" . esc_sql($t_keywords) . "%'";
    11891189            }
    11901190        }
    11911191        if ($jobcategory != '')
    11921192            if ($jobcategory != '')
    1193                 $wherequery .= " AND job.jobcategory = " . $jobcategory;
     1193                $wherequery .= " AND job.jobcategory = " . esc_sql($jobcategory);
    11941194        if (isset($keys))
    1195             $wherequery .= " AND ( " . implode(' OR ', $keys) . " )";
     1195            $wherequery .= " AND ( " . implode(' OR ', esc_sql($keys)) . " )";
    11961196        if (isset($titlekeys))
    1197             $wherequery .= " AND ( " . implode(' OR ', $titlekeys) . " )";
     1197            $wherequery .= " AND ( " . implode(' OR ', esc_sql($titlekeys)) . " )";
    11981198        if ($jobsubcategory != '')
    1199             $wherequery .= " AND job.subcategoryid = " . $jobsubcategory;
     1199            $wherequery .= " AND job.subcategoryid = " . esc_sql($jobsubcategory);
    12001200        if ($jobtype != '')
    1201             $wherequery .= " AND job.jobtype = " . $jobtype;
     1201            $wherequery .= " AND job.jobtype = " . esc_sql($jobtype);
    12021202        if ($jobstatus != '')
    1203             $wherequery .= " AND job.jobstatus = " . $jobstatus;
     1203            $wherequery .= " AND job.jobstatus = " . esc_sql($jobstatus);
    12041204        if ($salaryrangefrom != '') {
    12051205            $query = "SELECT salfrom.rangestart
    12061206            FROM `" . jsjobs::$_db->prefix . "js_job_salaryrange` AS salfrom
    1207             WHERE salfrom.id = " . $salaryrangefrom;
     1207            WHERE salfrom.id = " . esc_sql($salaryrangefrom);
    12081208
    12091209            $rangestart_value = jsjobsdb::get_var($query);
    1210             $wherequery .= " AND salaryrangefrom.rangestart >= " . $rangestart_value;
     1210            $wherequery .= " AND salaryrangefrom.rangestart >= " . esc_sql($rangestart_value);
    12111211            $issalary = 1;
    12121212        }
    … …  
    12141214            $query = "SELECT salto.rangestart
    12151215            FROM `" . jsjobs::$_db->prefix . "js_job_salaryrange` AS salto
    1216             WHERE salto.id = " . $salaryrangeto;
     1216            WHERE salto.id = " . esc_sql($salaryrangeto);
    12171217
    12181218            $rangeend_value = jsjobsdb::get_var($query);
    1219             $wherequery .= " AND salaryrangeto.rangeend <= " . $rangeend_value;
     1219            $wherequery .= " AND salaryrangeto.rangeend <= " . esc_sql($rangeend_value);
    12201220            $issalary = 1;
    12211221        }
    12221222        if (($issalary != '') && ($salaryrangetype != '')) {
    1223             $wherequery .= " AND job.salaryrangetype = " . $salaryrangetype;
     1223            $wherequery .= " AND job.salaryrangetype = " . esc_sql($salaryrangetype);
    12241224        }
    12251225        if ($shift != '')
    1226             $wherequery .= " AND job.shift = " . $shift;
     1226            $wherequery .= " AND job.shift = " . esc_sql($shift);
    12271227        if ($durration != '')
    1228             $wherequery .= " AND job.duration LIKE '" . $durration . "'";
     1228            $wherequery .= " AND job.duration LIKE '" . esc_sql($durration) . "'";
    12291229        if ($startpublishing != '')
    1230             $wherequery .= " AND job.startpublishing >= '" . $startpublishing . "'";
     1230            $wherequery .= " AND job.startpublishing >= '" . esc_sql($startpublishing) . "'";
    12311231        if ($stoppublishing != '')
    1232             $wherequery .= " AND job.stoppublishing <= '" . $stoppublishing . "'";
     1232            $wherequery .= " AND job.stoppublishing <= '" . esc_sql($stoppublishing) . "'";
    12331233        if ($company != '')
    1234             $wherequery .= " AND job.companyid = " . $company;
     1234            $wherequery .= " AND job.companyid = " . esc_sql($company);
    12351235        if ($city != '') {
    12361236            $city_value = jsjobslib::jsjobs_explode(',', $city);
    … …  
    12381238            for ($i = 0; $i < $lenght; $i++) {
    12391239                if ($i == 0)
    1240                     $wherequery .= " AND ( mjob.cityid=" . $city_value[$i];
     1240                    $wherequery .= " AND ( mjob.cityid=" . esc_sql($city_value[$i]);
    12411241                else
    1242                     $wherequery .= " OR mjob.cityid=" . $city_value[$i];
     1242                    $wherequery .= " OR mjob.cityid=" . esc_sql($city_value[$i]);
    12431243            }
    12441244            $wherequery .= ")";
    … …  
    12461246
    12471247        if ($zipcode != '')
    1248             $wherequery .= " AND job.zipcode = '" . $zipcode . "'";
     1248            $wherequery .= " AND job.zipcode = '" . esc_sql($zipcode) . "'";
    12491249        if (isset($radiussearch) && $radiussearch != '')
    12501250            $wherequery .= " AND " . $radiussearch;
    … …  
    12611261        $query .= " WHERE job.status = 1 ";
    12621262        if ($startpublishing == '')
    1263             $query .= " AND DATE(job.startpublishing) <= " . $curdate;
     1263            $query .= " AND DATE(job.startpublishing) <= " . esc_sql($curdate);
    12641264        if ($stoppublishing == '')
    1265             $query .= " AND DATE(job.stoppublishing) >= " . $curdate;
     1265            $query .= " AND DATE(job.stoppublishing) >= " . esc_sql($curdate);
    12661266        $query .= $wherequery;
    12671267
    … …  
    12851285        $query .= " WHERE  job.status = 1 ";
    12861286        if ($startpublishing == '')
    1287             $query .= " AND DATE(job.startpublishing) <= " . $curdate;
     1287            $query .= " AND DATE(job.startpublishing) <= " . esc_sql($curdate);
    12881288        if ($stoppublishing == '')
    1289             $query .= " AND DATE(job.stoppublishing) >= " . $curdate;
     1289            $query .= " AND DATE(job.stoppublishing) >= " . esc_sql($curdate);
    12901290        if ($currency != '')
    12911291            $query.= " AND currency.id = job.currencyid ";
    … …  
    14211421                    $total = 5;
    14221422                for ($i = 0; $i < $total; $i++) {
    1423                     $qa[] = "job.metakeywords LIKE '%" . $array[$i] . "%'";
     1423                    $qa[] = "job.metakeywords LIKE '%" . esc_sql($array[$i]) . "%'";
    14241424                }
    14251425                break;
    … …  
    14271427                foreach ($array as $item) {
    14281428                    if (is_numeric($item)) {
    1429                         $qa[] = "job.companyid = " . $item;
     1429                        $qa[] = "job.companyid = " . esc_sql($item);
    14301430                    }
    14311431                }
    … …  
    14341434                foreach ($array as $item) {
    14351435                    if (is_numeric($item)) {
    1436                         $query = "SELECT id FROM `" . jsjobs::$_db->prefix . "js_job_categories` WHERE parentid = ". $item;
     1436                        $query = "SELECT id FROM `" . jsjobs::$_db->prefix . "js_job_categories` WHERE parentid = ". esc_sql($item);
    14371437                        $cats = jsjobsdb::get_results($query);
    14381438                        $ids = [];
    … …  
    14421442                        $ids[] = $item;
    14431443                        $ids = implode(",",$ids);
    1444                         $qa[] = "job.jobcategory IN(" . $ids.")";
     1444                        $qa[] = "job.jobcategory IN(" . esc_sql($ids).")";
    14451445                    }
    14461446                }
    … …  
    14491449                foreach ($array as $item) {
    14501450                    if (is_numeric($item)) {
    1451                         $qa[] = "job.careerlevel = " . $item;
     1451                        $qa[] = "job.careerlevel = " . esc_sql($item);
    14521452                    }
    14531453                }
    … …  
    14561456                foreach ($array as $item) {
    14571457                    if (is_numeric($item)) {
    1458                         $qa[] = " job.agefrom = $item OR job.ageto = " . $item;
     1458                        $qa[] = " job.agefrom = $item OR job.ageto = " . esc_sql($item);
    14591459                    }
    14601460                }
    … …  
    14631463                foreach ($array as $item) {
    14641464                    if (is_numeric($item)) {
    1465                         $qa[] = "job.jobtype = " . $item;
     1465                        $qa[] = "job.jobtype = " . esc_sql($item);
    14661466                    }
    14671467                }
    … …  
    14701470                foreach ($array as $item) {
    14711471                    if (is_numeric($item)) {
    1472                         $qa[] = "job.jobstatus = " . $item;
     1472                        $qa[] = "job.jobstatus = " . esc_sql($item);
    14731473                    }
    14741474                }
    … …  
    14771477                foreach ($array as $item) {
    14781478                    if (is_numeric($item)) {
    1479                         $qa[] = "job.shift = " . $item;
     1479                        $qa[] = "job.shift = " . esc_sql($item);
    14801480                    }
    14811481                }
    … …  
    14841484                foreach ($array as $item) {
    14851485                    if (is_numeric($item)) {
    1486                         $qa[] = "job.educationid = " . $item;
     1486                        $qa[] = "job.educationid = " . esc_sql($item);
    14871487                    }
    14881488                }
    … …  
    14921492                foreach ($a as $item) {
    14931493                    if (is_numeric($item)) {
    1494                         $qa[] = "job.city LIKE '%" . $item . "%'";
     1494                        $qa[] = "job.city LIKE '%" . esc_sql($item) . "%'";
    14951495                    }
    14961496                }
    … …  
    14991499                $array = jsjobslib::jsjobs_explode(',', $array);
    15001500                foreach ($array as $item) {
    1501                     $qa[] = "job.tags LIKE '%" . $item . "%'";
     1501                    $qa[] = "job.tags LIKE '%" . esc_sql($item) . "%'";
    15021502                }
    15031503                break;
    … …  
    15051505                foreach ($array as $item) {
    15061506                    if (is_numeric($item)) {
    1507                         $qa[] = "job.workpermit LIKE '%" . $item . "%'";
     1507                        $qa[] = "job.workpermit LIKE '%" . esc_sql($item) . "%'";
    15081508                    }
    15091509                }
    … …  
    15261526        if (!is_numeric($search))
    15271527            return false;
    1528         $query = "SELECT * FROM `" . jsjobs::$_db->prefix . "js_job_jobsearches` WHERE id = " . $search;
     1528        $query = "SELECT * FROM `" . jsjobs::$_db->prefix . "js_job_jobsearches` WHERE id = " . esc_sql($search);
    15291529        $result = jsjobs::$_db->get_row($query);
    15301530        $params = array();
    … …  
    15401540            $res = $this->makeQueryFromArray('metakeywords', $params['metakeywords']);
    15411541            if ($res)
    1542                 $inquery .= " AND ( " . $res . " )";
     1542                $inquery .= " AND ( " . esc_sql($res) . " )";
    15431543        }
    15441544        if (isset($params['jobtitle'])) {
    15451545            jsjobs::$_data['filter']['jobtitle'] = $params['jobtitle'];
    1546             $inquery .= " AND job.title LIKE '%" . $params['jobtitle'] . "%'";
     1546            $inquery .= " AND job.title LIKE '%" . esc_sql($params['jobtitle']) . "%'";
    15471547        }
    15481548        if (isset($params['company'])) {
    … …  
    15501550            $res = $this->makeQueryFromArray('company', $params['company']);
    15511551            if ($res)
    1552                 $inquery .= " AND ( " . $res . " )";
     1552                $inquery .= " AND ( " . esc_sql($res) . " )";
    15531553        }
    15541554        if (isset($params['category'])) {
    … …  
    15561556            $res = $this->makeQueryFromArray('category', $params['category']);
    15571557            if ($res)
    1558                 $inquery .= " AND ( " . $res . " )";
     1558                $inquery .= " AND ( " . esc_sql($res) . " )";
    15591559        }
    15601560        if (isset($params['jobtype'])) {
    … …  
    15621562            $res = $this->makeQueryFromArray('jobtype', $params['jobtype']);
    15631563            if ($res)
    1564                 $inquery .= " AND ( " . $res . " )";
     1564                $inquery .= " AND ( " . esc_sql($res) . " )";
    15651565        }
    15661566        if (isset($params['careerlevel'])) {
    … …  
    15681568            $res = $this->makeQueryFromArray('careerlevel', $params['careerlevel']);
    15691569            if ($res)
    1570                 $inquery .= " AND ( " . $res . " )";
     1570                $inquery .= " AND ( " . esc_sql($res) . " )";
    15711571        }
    15721572        if (isset($params['gender'])) {
    15731573            if (is_numeric($params['gender'])) {
    1574                 $inquery .= " AND job.gender = " . $params['gender'];
     1574                $inquery .= " AND job.gender = " . esc_sql($params['gender']);
    15751575                jsjobs::$_data['filter']['gender'] = $params['gender'];
    15761576            }
    … …  
    15801580            $res = $this->makeQueryFromArray('jobstatus', $params['jobstatus']);
    15811581            if ($res)
    1582                 $inquery .= " AND ( " . $res . " )";
     1582                $inquery .= " AND ( " . esc_sql($res) . " )";
    15831583        }
    15841584        if (isset($params['currencyid'])) {
    15851585            if (is_numeric($params['currencyid'])) {
    15861586                jsjobs::$_data['filter']['currencyid'] = $params['currencyid'];
    1587                 $inquery .= " AND job.currencyid = " . $params['currencyid'];
     1587                $inquery .= " AND job.currencyid = " . esc_sql($params['currencyid']);
    15881588            }
    15891589        }
    … …  
    15911591            if (is_numeric($params['salaryrangestart'])) {
    15921592                jsjobs::$_data['filter']['salaryrangestart'] = $params['salaryrangestart'];
    1593                 $inquery .= " AND job.salaryrangefrom = " . $params['salaryrangestart'];
     1593                $inquery .= " AND job.salaryrangefrom = " . esc_sql($params['salaryrangestart']);
    15941594            }
    15951595        }
    … …  
    15971597            if (is_numeric($params['salaryrangeend'])) {
    15981598                jsjobs::$_data['filter']['salaryrangeend'] = $params['salaryrangeend'];
    1599                 $inquery .= " AND job.salaryrangeto = " . $params['salaryrangeend'];
     1599                $inquery .= " AND job.salaryrangeto = " . esc_sql($params['salaryrangeend']);
    16001600            }
    16011601        }
    … …  
    16031603            if (is_numeric($params['salaryrangetype'])) {
    16041604                jsjobs::$_data['filter']['srangetype'] = $params['salaryrangetype'];
    1605                 $inquery .= " AND job.salaryrangetype = " . $params['salaryrangetype'];
     1605                $inquery .= " AND job.salaryrangetype = " . esc_sql($params['salaryrangetype']);
    16061606            }
    16071607        }
    16081608        if (isset($params['shift'])) {
    16091609            jsjobs::$_data['filter']['shift'] = $params['shift'];
    1610             $res = $this->makeQueryFromArray('shift', $params['shift']);
     1610            $res = $this->makeQueryFromArray('shift', esc_sql($params['shift']));
    16111611            if ($res)
    1612                 $inquery .= " AND ( " . $res . " )";
     1612                $inquery .= " AND ( " . esc_sql($res) . " )";
    16131613        }
    16141614        if (isset($params['highesteducation'])) {
    … …  
    16161616            $res = $this->makeQueryFromArray('education', $params['highesteducation']);
    16171617            if ($res)
    1618                 $inquery .= " AND ( " . $res . " )";
     1618                $inquery .= " AND ( " . esc_sql($res) . " )";
    16191619        }
    16201620        if (isset($params['city'])) {
    … …  
    16221622            $res = $this->makeQueryFromArray('city', $params['city']);
    16231623            if ($res)
    1624                 $inquery .= " AND ( " . $res . " )";
     1624                $inquery .= " AND ( " . esc_sql($res) . " )";
    16251625        }
    16261626        if (isset($params['tags'])) {
    … …  
    16281628            $res = $this->makeQueryFromArray('tags', $params['tags']);
    16291629            if ($res)
    1630                 $inquery .= " AND ( " . $res . " )";
     1630                $inquery .= " AND ( " . esc_sql($res) . " )";
    16311631        }
    16321632        if (isset($params['workpermit'])) {
    … …  
    16341634            $res = $this->makeQueryFromArray('workpermit', $params['workpermit']);
    16351635            if ($res)
    1636                 $inquery .= " AND ( " . $res . " )";
     1636                $inquery .= " AND ( " . esc_sql($res) . " )";
    16371637        }
    16381638        if (isset($params['requiredtravel'])) {
    16391639            if (is_numeric($params['requiredtravel'])) {
    16401640                jsjobs::$_data['filter']['requiredtravel'] = $params['requiredtravel'];
    1641                 $inquery .= " AND job.requiredtravel = " . $params['requiredtravel'];
     1641                $inquery .= " AND job.requiredtravel = " . esc_sql($params['requiredtravel']);
    16421642            }
    16431643        }
    16441644        if (isset($params['duration'])) {
    16451645            jsjobs::$_data['filter']['duration'] = $params['duration'];
    1646             $inquery .= " AND job.duration LIKE '%" . $params['duration'] . "%'";
     1646            $inquery .= " AND job.duration LIKE '%" . esc_sql($params['duration']) . "%'";
    16471647        }
    16481648//custom field code
    … …  
    17411741            $res = $this->makeQueryFromArray('metakeywords', $keywords_a);
    17421742            if ($res)
    1743                 $inquery .= " AND ( " . $res . " )";
     1743                $inquery .= " AND ( " . esc_sql($res) . " )";
    17441744        }
    17451745        if($searchajax == null){
    … …  
    17501750        if ($jobtitle) {
    17511751            jsjobs::$_data['filter']['jobtitle'] = $jobtitle;
    1752             $inquery .= " AND job.title LIKE '%" . $jobtitle . "%'";
     1752            $inquery .= " AND job.title LIKE '%" . esc_sql($jobtitle) . "%'";
    17531753        }
    17541754        if($searchajax == null){
    … …  
    17611761            $res = $this->makeQueryFromArray('company', $company_a);
    17621762            if ($res)
    1763                 $inquery .= " AND ( " . $res . " )";
     1763                $inquery .= " AND ( " . esc_sql($res) . " )";
    17641764        }
    17651765        if($searchajax == null){
    … …  
    17721772            $res = $this->makeQueryFromArray('category', $category_a);
    17731773            if ($res)
    1774                 $inquery .= " AND ( " . $res . " )";
     1774                $inquery .= " AND ( " . esc_sql($res) . " )";
    17751775        }
    17761776        if($searchajax == null){
    … …  
    17831783            $res = $this->makeQueryFromArray('jobtype', $jobtype_a);
    17841784            if ($res)
    1785                 $inquery .= " AND ( " . $res . " )";
     1785                $inquery .= " AND ( " . esc_sql($res) . " )";
    17861786        }
    17871787        if($searchajax == null){
    … …  
    17941794            $res = $this->makeQueryFromArray('careerlevel', $careerlevel_a);
    17951795            if ($res)
    1796                 $inquery .= " AND ( " . $res . " )";
     1796                $inquery .= " AND ( " . esc_sql($res) . " )";
    17971797        }
    17981798        if($searchajax == null){
    … …  
    18051805            $res = $this->makeQueryFromArray('age', $age_a);
    18061806            if ($res)
    1807                 $inquery .= " AND ( " . $res . " )";
     1807                $inquery .= " AND ( " . esc_sql($res) . " )";
    18081808        }
    18091809        if($searchajax == null){
    … …  
    18141814        if ($gender) {
    18151815            if (is_numeric($gender)) {
    1816                 $inquery .= " AND job.gender = " . $gender;
     1816                $inquery .= " AND job.gender = " . esc_sql($gender);
    18171817                jsjobs::$_data['filter']['gender'] = $gender;
    18181818            }
    … …  
    18261826            if (is_numeric($agestart)) {
    18271827                jsjobs::$_data['filter']['agestart'] = $agestart;
    1828                 $inquery .= " AND job.agefrom = " . $agestart;
     1828                $inquery .= " AND job.agefrom = " . esc_sql($agestart);
    18291829            }
    18301830        }
    … …  
    18371837            if (is_numeric($ageend)) {
    18381838                jsjobs::$_data['filter']['ageend'] = $ageend;
    1839                 $inquery .= " AND job.ageto = " . $ageend;
     1839                $inquery .= " AND job.ageto = " . esc_sql($ageend);
    18401840            }
    18411841        }
    … …  
    18491849            $res = $this->makeQueryFromArray('jobstatus', $jobstatus_a);
    18501850            if ($res)
    1851                 $inquery .= " AND ( " . $res . " )";
     1851                $inquery .= " AND ( " . esc_sql($res) . " )";
    18521852        }
    18531853        if($searchajax == null){
    … …  
    18591859            if (is_numeric($symbol)) {
    18601860                jsjobs::$_data['filter']['currencyid'] = $symbol;
    1861                 $inquery .= " AND job.currencyid = " . $symbol;
     1861                $inquery .= " AND job.currencyid = " . esc_sql($symbol);
    18621862            }
    18631863        }
    … …  
    18701870            if (is_numeric($srangestart)) {
    18711871                jsjobs::$_data['filter']['salaryrangestart'] = $srangestart;
    1872                 $inquery .= " AND job.salaryrangefrom = " . $srangestart;
     1872                $inquery .= " AND job.salaryrangefrom = " . esc_sql($srangestart);
    18731873            }
    18741874        }
    … …  
    18811881            if (is_numeric($srangeend)) {
    18821882                jsjobs::$_data['filter']['salaryrangeend'] = $srangeend;
    1883                 $inquery .= " AND job.salaryrangeto = " . $srangeend;
     1883                $inquery .= " AND job.salaryrangeto = " . esc_sql($srangeend);
    18841884            }
    18851885        }
    … …  
    18921892            if (is_numeric($srangetype)) {
    18931893                jsjobs::$_data['filter']['salaryrangetype'] = $srangetype;
    1894                 $inquery .= " AND job.salaryrangetype = " . $srangetype;
     1894                $inquery .= " AND job.salaryrangetype = " . esc_sql($srangetype);
    18951895            }
    18961896        }
    … …  
    19041904            $res = $this->makeQueryFromArray('shift', $shift_a);
    19051905            if ($res)
    1906                 $inquery .= " AND ( " . $res . " )";
     1906                $inquery .= " AND ( " . esc_sql($res) . " )";
    19071907        }
    19081908        if($searchajax == null){
    … …  
    19151915            $res = $this->makeQueryFromArray('education', $education_a);
    19161916            if ($res)
    1917                 $inquery .= " AND ( " . $res . " )";
     1917                $inquery .= " AND ( " . esc_sql($res) . " )";
    19181918        }
    19191919        if($searchajax == null){
    … …  
    19271927            $res = $this->makeQueryFromArray('city', $city_a);
    19281928            if ($res)
    1929                 $inquery .= " AND ( " . $res . " )";
     1929                $inquery .= " AND ( " . esc_sql($res) . " )";
    19301930        }
    19311931        if($searchajax == null){
    … …  
    19391939            $res = $this->makeQueryFromArray('tags', $tags_a);
    19401940            if ($res)
    1941                 $inquery .= " AND ( " . $res . " )";
     1941                $inquery .= " AND ( " . esc_sql($res) . " )";
    19421942        }
    19431943        if($searchajax == null){
    … …  
    19501950            $res = $this->makeQueryFromArray('workpermit', $workpermit_a);
    19511951            if ($res)
    1952                 $inquery .= " AND ( " . $res . " )";
     1952                $inquery .= " AND ( " . esc_sql($res) . " )";
    19531953        }
    19541954        if($searchajax == null){
    … …  
    19601960            if (is_numeric($requiredtravel)) {
    19611961                jsjobs::$_data['filter']['requiredtravel'] = $requiredtravel;
    1962                 $inquery .= " AND job.requiredtravel = " . $requiredtravel;
     1962                $inquery .= " AND job.requiredtravel = " . esc_sql($requiredtravel);
    19631963            }
    19641964        }
    … …  
    19701970        if ($duration) {
    19711971            jsjobs::$_data['filter']['duration'] = $duration;
    1972             $inquery .= " AND job.duration LIKE '%" . $duration . "%'";
     1972            $inquery .= " AND job.duration LIKE '%" . esc_sql($duration) . "%'";
    19731973        }
    19741974        if($searchajax == null){
    … …  
    19791979        if ($zipcode) {
    19801980            jsjobs::$_data['filter']['zipcode'] = $zipcode;
    1981             $inquery .= " AND job.zipcode LIKE '%" . $zipcode . "%'";
     1981            $inquery .= " AND job.zipcode LIKE '%" . esc_sql($zipcode) . "%'";
    19821982        }
    19831983        //Custom field search
    … …  
    20982098            if (isset($vars['company']) && is_numeric($vars['company'])) { // if action form a <link> defined in cp
    20992099                jsjobs::$_data['filter']['company'] = $vars['company'];
    2100                 $inquery = " AND job.companyid=" . $vars['company'];
     2100                $inquery = " AND job.companyid=" . esc_sql($vars['company']);
    21012101            }
    21022102            if (isset($vars['category']) && is_numeric($vars['category'])) { // if action form a <link> defined in cp
    21032103
    21042104                // code for child category
    2105                 $query = "SELECT id FROM `" . jsjobs::$_db->prefix . "js_job_categories` WHERE parentid = ". $vars['category'];
     2105                $query = "SELECT id FROM `" . jsjobs::$_db->prefix . "js_job_categories` WHERE parentid = ". esc_sql($vars['category']);
    21062106                $cats = jsjobsdb::get_results($query);
    21072107                $ids = [];
    … …  
    21112111                $ids[] = $vars['category'];
    21122112                $ids = implode(",",$ids);
    2113                 $inquery = " AND job.jobcategory IN(" . $ids.")";
     2113                $inquery = " AND job.jobcategory IN(" . esc_sql($ids).")";
    21142114                jsjobs::$_data['filter']['category'] = $vars['category'];
    21152115            }
    21162116            if (isset($vars['jobtype']) && is_numeric($vars['jobtype'])) { // if action form a <link> defined in cp
    21172117                jsjobs::$_data['filter']['jobtype'] = $vars['jobtype'];
    2118                 $inquery = " AND job.jobtype=" . $vars['jobtype'];
     2118                $inquery = " AND job.jobtype=" . esc_sql($vars['jobtype']);
    21192119            }
    21202120            if (isset($vars['tags']) && (!is_numeric($vars['tags']))) { // if action form a <link> defined in cp
    21212121                jsjobs::$_data['filter']['tags'] = JSJOBSincluder::getJSModel('common')->makeFilterdOrEditedTagsToReturn($vars['tags']);
    21222122                jsjobs::$_data['filter']['fromtaglink'] = $vars['tags'];
    2123                 $inquery = " AND job.tags LIKE '%" . $vars['tags'] . "%'";
     2123                $inquery = " AND job.tags LIKE '%" . esc_sql($vars['tags']) . "%'";
    21242124            }
    21252125            if (isset($vars['city']) && is_numeric($vars['city'])) { // if action form a <link> defined in cp
    … …  
    21272127                $res = $this->makeQueryFromArray('city', $vars['city']);
    21282128                if ($res){
    2129                     $inquery = " AND ( " . $res . " )";
     2129                    $inquery = " AND ( " . esc_sql($res) . " )";
    21302130                }
    21312131            }
    … …  
    21382138            $res = $this->makeQueryFromArray('city', $city);
    21392139            if ($res){
    2140                 $inquery = " AND ( " . $res . " )";
     2140                $inquery = " AND ( " . esc_sql($res) . " )";
    21412141            }
    21422142        }
    … …  
    21442144        $state = JSJOBSrequest::getVar('state','GET');
    21452145        if($state && is_numeric($state)){
    2146             $inquery .= " AND state.id = ".$state;
     2146            $inquery .= " AND state.id = ". esc_sql($state);
    21472147        }
    21482148
    21492149        $country = JSJOBSrequest::getVar('country','GET');
    21502150        if($country && is_numeric($country)){
    2151             $inquery .= " AND country.id = ".$country;
     2151            $inquery .= " AND country.id = ". esc_sql($country);
    21522152        }
    21532153        //local vars

  • js-jobs/trunk/modules/jobapply/model.php

    r2919970 r3209617  
    5353        $inquery = "";
    5454        if ($searchtitle)
    55             $inquery .= " AND LOWER(job.title) LIKE '%" . $searchtitle . "%'";
     55            $inquery .= " AND LOWER(job.title) LIKE '%" . esc_sql($searchtitle) . "%'";
    5656        if ($searchcompany)
    57             $inquery .= " AND LOWER(company.name) LIKE '%" . $searchcompany . "%'";
     57            $inquery .= " AND LOWER(company.name) LIKE '%" . esc_sql($searchcompany) . "%'";
    5858        if ($searchjobcategory)
    59             $inquery .= " AND job.jobcategory = " . $searchjobcategory;
     59            $inquery .= " AND job.jobcategory = " . esc_sql($searchjobcategory);
    6060        if ($searchjobtype)
    61             $inquery .= " AND job.jobtype = " . $searchjobtype;
     61            $inquery .= " AND job.jobtype = " . esc_sql($searchjobtype);
    6262        if ($searchjobstatus)
    63             $inquery .= " AND job.jobstatus = " . $searchjobstatus;
     63            $inquery .= " AND job.jobstatus = " . esc_sql($searchjobstatus);
    6464
    6565        //Pagination
    … …  
    676676//MAIL TO ADMIN ON JOBAPPLY
    677677        $templatefor = 'jobapply-jobapply';
    678         $query = "SELECT template.* FROM `".jsjobs::$_db->prefix."js_job_emailtemplates` AS template WHERE template.templatefor = '" . $templatefor . "'";
     678        $query = "SELECT template.* FROM `".jsjobs::$_db->prefix."js_job_emailtemplates` AS template WHERE template.templatefor = '" . esc_sql($templatefor) . "'";
    679679
    680680        $template = jsjobsdb::get_row($query);
    … …  
    731731    //MAIL TO EMPLOYER
    732732        $templatefor = 'jobapply-employer';
    733         $query = "SELECT template.* FROM `".jsjobs::$_db->prefix."js_job_emailtemplates` AS template WHERE template.templatefor = '" . $templatefor . "'";
     733        $query = "SELECT template.* FROM `".jsjobs::$_db->prefix."js_job_emailtemplates` AS template WHERE template.templatefor = '" . esc_sql($templatefor) . "'";
    734734
    735735        $template = jsjobsdb::get_row($query);
    … …  
    811811    // MAIL TO JOB SEEKER
    812812        $templatefor = 'jobapply-jobseeker';
    813         $query = "SELECT template.* FROM `".jsjobs::$_db->prefix."js_job_emailtemplates` AS template WHERE template.templatefor = '" . $templatefor . "'";
     813        $query = "SELECT template.* FROM `".jsjobs::$_db->prefix."js_job_emailtemplates` AS template WHERE template.templatefor = '" . esc_sql($templatefor) . "'";
    814814        $template = jsjobsdb::get_row($query);
    815815        $msgSubject = $template->subject;

  • js-jobs/trunk/modules/jobseeker/model.php

    r2919970 r3209617  
    2424                LEFT JOIN `" . jsjobs::$_db->prefix . "js_job_salaryrange` AS srfrom ON srfrom.id = job.salaryrangeto
    2525                LEFT JOIN `" . jsjobs::$_db->prefix . "js_job_salaryrangetypes` AS salaryrangetype ON salaryrangetype.id = job.salaryrangetype
    26                 WHERE resume.uid = " . $uid . " AND(DATE(job.startpublishing) <= '" . $date . "' AND DATE(job.stoppublishing) >= '" . $date . "')
     26                WHERE resume.uid = " . esc_sql($uid) . " AND(DATE(job.startpublishing) <= '" . esc_sql($date ). "' AND DATE(job.stoppublishing) >= '" . esc_sql($date) . "')
    2727                GROUP BY job.id
    2828                ORDER BY job.jobcategory LIMIT 0,5";

  • js-jobs/trunk/modules/jobstatus/model.php

    r2919970 r3209617  
    2323        $clause = ' WHERE ';
    2424        if ($title != null) {
    25             $inquery .= $clause . "title LIKE '%" . $title . "%'";
     25            $inquery .= $clause . "title LIKE '%" . esc_sql($title) . "%'";
    2626            $clause = ' AND ';
    2727        }
    2828        if ($status != null)
    29             $inquery .=$clause . " isactive = '" . $status . "'";
     29            $inquery .=$clause . " isactive = '" . esc_sql($status) . "'";
    3030
    3131        jsjobs::$_data['filter']['title'] = $title;
    … …  
    222222
    223223    function isJobStatusExist($title) {
    224         $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_jobstatus WHERE title = '" . $title . "'";
     224        $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_jobstatus WHERE title = '" . esc_sql($title) . "'";
    225225        $result = jsjobsdb::get_var($query);
    226226        if ($result > 0)

  • js-jobs/trunk/modules/jobtype/model.php

    r2919970 r3209617  
    2323        $clause = ' WHERE ';
    2424        if ($title != null) {
    25             $inquery .= $clause . "title LIKE '%" . $title . "%'";
     25            $inquery .= $clause . "title LIKE '%" . esc_sql($title) . "%'";
    2626            $clause = ' AND ';
    2727        }
    2828        if ($status != null)
    29             $inquery .=$clause . " isactive = '" . $status . "'";
     29            $inquery .=$clause . " isactive = '" . esc_sql($status) . "'";
    3030
    3131        jsjobs::$_data['filter']['title'] = $title;
    … …  
    227227        if (!$title)
    228228            return false;
    229         $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_jobtypes WHERE title = '" . $title . "'";
     229        $query = "SELECT COUNT(id) FROM " . jsjobs::$_db->prefix . "js_job_jobtypes WHERE title = '" . esc_sql($title) . "'";
    230230        $result = jsjobsdb::get_var($query);
    231231        if ($result > 0)
    … …  
    251251    function getIDByTitle($title) {
    252252        if($title == '') return false;
    253         $query = "SELECT id FROM " . jsjobs::$_db->prefix . "js_job_jobtypes WHERE title = '" . $title ."'";
     253        $query = "SELECT id FROM " . jsjobs::$_db->prefix . "js_job_jobtypes WHERE title = '" . esc_sql($title) ."'";
    254254        $title = jsjobsdb::get_var($query);
    255255        return $title;

  • js-jobs/trunk/modules/postinstallation/model.php

    r2919970 r3209617  
    2323        unset($data['step']);
    2424        foreach ($data as $key => $value) {
    25             $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET `configvalue` = '" . $value . "' WHERE `configname`= '" . $key . "'";
     25            $query = "UPDATE `" . jsjobs::$_db->prefix . "js_job_config` SET `configvalue` = '" . esc_sql($value) . "' WHERE `configname`= '" . esc_sql($key) . "'";
    2626            if (!jsjobsdb::query($query)) {
    2727                $error = true;

  • js-jobs/trunk/readme.txt

    r3089970 r3209617  
    55Requires at least: 4.5
    66Tested up to: 6.5.3
    7 Stable tag: 2.0.1
     7Stable tag: 2.0.2
    88License: GPLv2
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    221221== Changelog ==
    222222
     223= 2.0.2 =
     224* Security Updates
     225
    223226= 2.0.1 =
    224227* Security Updates
Note: See TracChangeset for help on using the changeset viewer.