WordPress.org
Get WordPress

Plugin Directory

Changeset 3265698


Ignore:
Timestamp:
04/02/2025 02:06:11 PM (12 months ago)
Author:
rohitashv
Message:

xss vurnablilty Resolved Thanks to wordpress team

Location:
emarksheet
Files:
51 added
1 deleted
12 edited

Legend:

Unmodified
Added
Removed

  • emarksheet/trunk/emarksheet.php

    r3265424 r3265698  
    55Description: This is a simple and unique wordpress plugin to create a simple marksheet using wordpress. You can also give a link to your users to see the result and print it.
    66Author: rohitashv
    7 Version: 5.4.3
     7Version: 5.4.4
    88License:           GPL v2 or later
    99License URI:       https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    3232{
    3333    wp_enqueue_script( 'jquery' );
     34    $plugin_url = plugin_dir_url( __FILE__ );
     35
     36    wp_enqueue_style( 'style',  $plugin_url . "/bootstrap/css/bootstrap.css");
    3437    include('menu-pages/emark_add_class.php');
    3538}
    … …  
    3740{
    3841    wp_enqueue_script( 'jquery' );
     42    $plugin_url = plugin_dir_url( __FILE__ );
     43
     44    wp_enqueue_style( 'style',  $plugin_url . "/bootstrap/css/bootstrap.css");
    3945    include('menu-pages/emark_add_sub.php');
    4046}
    … …  
    4248{
    4349    wp_enqueue_script( 'jquery' );
     50    $plugin_url = plugin_dir_url( __FILE__ );
     51
     52    wp_enqueue_style( 'style',  $plugin_url . "/bootstrap/css/bootstrap.css");
    4453    include('menu-pages/emark_add_student.php');
    4554}
    … …  
    4756{
    4857    wp_enqueue_script( 'jquery' );
     58    $plugin_url = plugin_dir_url( __FILE__ );
     59
     60    wp_enqueue_style( 'style',  $plugin_url . "/bootstrap/css/bootstrap.css");
    4961    include('menu-pages/emark_add_student_list.php');
    5062}
    … …  
    5264{
    5365    wp_enqueue_script( 'jquery' );
     66    $plugin_url = plugin_dir_url( __FILE__ );
     67
     68    wp_enqueue_style( 'style',  $plugin_url . "/bootstrap/css/bootstrap.css");
    5469    include('menu-pages/emark_add_marks.php');
    5570}
    … …  
    5772{
    5873    wp_enqueue_script( 'jquery' );
     74    $plugin_url = plugin_dir_url( __FILE__ );
     75
     76    wp_enqueue_style( 'style',  $plugin_url . "/bootstrap/css/bootstrap.css");
    5977    include('menu-pages/settings.php');
    6078}
    … …  
    6280{
    6381    wp_enqueue_script( 'jquery' );
     82    $plugin_url = plugin_dir_url( __FILE__ );
     83
     84    wp_enqueue_style( 'style',  $plugin_url . "/bootstrap/css/bootstrap.css");
    6485    include('menu-pages/print.php');
    6586}
    … …  
    6788{
    6889    wp_enqueue_script( 'jquery' );
     90    $plugin_url = plugin_dir_url( __FILE__ );
     91
     92    wp_enqueue_style( 'style',  $plugin_url . "/bootstrap/css/bootstrap.css");
    6993    include('menu-pages/help.php');
    7094}
    … …  
    7296{
    7397    wp_enqueue_script( 'jquery' );
     98    $plugin_url = plugin_dir_url( __FILE__ );
     99
     100    wp_enqueue_style( 'style',  $plugin_url . "/bootstrap/css/bootstrap.css");
    74101    include('menu-pages/uninstall.php');
    75102}

  • emarksheet/trunk/install-script.php

    r2006371 r3265698  
    11<?php
    22global $wpdb;
    3 $add_subject = "CREATE TABLE IF NOT EXISTS `emarksheet_class` (
     3$wpdb->query("CREATE TABLE IF NOT EXISTS `emarksheet_class` (
    44  `id` int(11) NOT NULL AUTO_INCREMENT,
    55  `class_name` varchar(255) NOT NULL,
    66  PRIMARY KEY (`id`)
    7 ) ENGINE=InnoDB  DEFAULT  CHARSET=utf8 COLLATE=utf8_unicode_ci AUTO_INCREMENT=7 ;";
    8 $wpdb->query($add_subject);
     7) ENGINE=InnoDB  DEFAULT  CHARSET=utf8 COLLATE=utf8_unicode_ci AUTO_INCREMENT=7 ;");
    98
    10 $add_quiz = "CREATE TABLE IF NOT EXISTS `emarksheet_marks` (
     9$wpdb->query("CREATE TABLE IF NOT EXISTS `emarksheet_marks` (
    1110  `id` int(11) NOT NULL AUTO_INCREMENT,
    1211  `student_id` int(11) NOT NULL,
    … …  
    1413  `marks` TEXT NOT NULL,
    1514  PRIMARY KEY (`id`)
    16 ) AUTO_INCREMENT=4 ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;";
    17 $wpdb->query($add_quiz);
     15) AUTO_INCREMENT=4 ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;");
    1816
    19 $add_question = "CREATE TABLE IF NOT EXISTS `emarksheet_setting` (
     17$wpdb->query("CREATE TABLE IF NOT EXISTS `emarksheet_setting` (
    2018  `id` int(11) NOT NULL AUTO_INCREMENT,
    2119  `school_name` varchar(255) NOT NULL,
    … …  
    2624  `name_of_principal` varchar(255) NOT NULL,
    2725  PRIMARY KEY (`id`)
    28 ) AUTO_INCREMENT=5 ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;";
    29 $wpdb->query($add_question);
     26) AUTO_INCREMENT=5 ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;");
    3027
    31 $result = "CREATE TABLE IF NOT EXISTS `emarksheet_student` (
     28$wpdb->query("CREATE TABLE IF NOT EXISTS `emarksheet_student` (
    3229  `id` int(11) NOT NULL AUTO_INCREMENT,
    3330  `class_id` int(11) NOT NULL,
    … …  
    4239  `mother_n` varchar(255) COLLATE utf8_unicode_ci NOT NULL,
    4340  PRIMARY KEY (`id`)
    44 ) AUTO_INCREMENT=6 ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;";
    45 $wpdb->query($result);
     41) AUTO_INCREMENT=6 ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;");
    4642
    47 $result1 = "CREATE TABLE IF NOT EXISTS `emarksheet_subject` (
     43$wpdb->query("CREATE TABLE IF NOT EXISTS `emarksheet_subject` (
    4844  `id` int(11) NOT NULL AUTO_INCREMENT,
    4945  `class` int(11) NOT NULL,
    … …  
    5248  `min_pass` int(11) DEFAULT 33,
    5349  PRIMARY KEY (`id`)
    54 )AUTO_INCREMENT=6 ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;";
    55 $wpdb->query($result1);
     50)AUTO_INCREMENT=6 ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;");
    5651?>

  • emarksheet/trunk/menu-pages/emark_add_class.php

    r3265638 r3265698  
    1 <!---load bootstrap css----->
    2 <link rel='stylesheet' type='text/css' href='<?php echo esc_url(plugins_url('/bootstrap/css/bootstrap.css', __FILE__)); ?>' />
    3 
    41<div class='span12' style='margin-top:20px;'>
    52<?php
    63global $wpdb;
     4$nonce = wp_create_nonce( 'my-nonce' );
     5if(isset($_POST['addsubject'])){
     6$nonce1 = $_REQUEST['_wpnonce'];
     7
     8if ( ! wp_verify_nonce( $nonce1, 'my-nonce' ) ) {
     9
     10     die( 'Security check' );
     11
     12} else {
     13
    714if(isset($_POST['addsubject']))
    815{
    9     $subname = strip_tags($_POST['name']);
    10     $insert_query=$wpdb->prepare("insert into `emarksheet_class`(`id`,`class_name`) values('','$subname')");
    11     $wpdb->query($insert_query);
     16    $subname = wp_strip_all_tags($_POST['name']);
     17    $wpdb->query($wpdb->prepare("insert into `emarksheet_class`(`id`,`class_name`) values('','$subname')"));
    1218    echo "<div class='alert alert-success'>Class Name Added Successfully</div>";
    1319}
    1420if(isset($_POST['update_name']))
    1521{
    16     $up_su_n = strip_tags($_POST['up_su_n']);
    17     $up_su_id = strip_tags($_POST['up_id']);
    18     $update_query = $wpdb->prepare("update `emarksheet_class` set `class_name`='$up_su_n' where `id`='$up_su_id'");
    19     $wpdb->query($update_query);
     22    $up_su_n = wp_strip_all_tags($_POST['up_su_n']);
     23    $up_su_id = wp_strip_all_tags($_POST['up_id']);
     24    $wpdb->query($wpdb->prepare("update `emarksheet_class` set `class_name`='$up_su_n' where `id`='$up_su_id'"));
    2025    echo "<div class='alert alert-success'>Class Name Updated Successfully</div>";
    2126}
    … …  
    2530    {
    2631        $iddelt = esc_html($_GET['id']);
    27         $delete_query = $wpdb->prepare("delete from `emarksheet_class` where `id`='$iddelt'");
    28         $wpdb->query($delete_query);
     32        $wpdb->query($wpdb->prepare("delete from `emarksheet_class` where `id`='$iddelt'"));
    2933        echo "<div class='alert alert-success'>Class Name Deleted Successfully</div>";
    3034        echo "<script>setTimeout(location.href='".esc_url(admin_url("admin.php?page=eMarksheet-main"))."',6000)</script>";
    … …  
    3337{
    3438    $idd = esc_html($_GET['id']);
    35     $selectd_query = $wpdb->prepare("select * from `emarksheet_class` where `id`='$idd'");
    36     $selectd_row =  $wpdb->get_results($selectd_query);
     39    $selectd_row =  $wpdb->get_results($wpdb->prepare("select * from `emarksheet_class` where `id`='$idd'"));
    3740    $su_n = $selectd_row[0]->class_name;
    3841    ?>
    … …  
    4548    </div>
    4649    <?php
     50}}
    4751}
    4852}
     53
    4954?>
    5055<script type="text/javascript">
    … …  
    5459</script>
    5560<?php
    56     $select_query = $wpdb->prepare("select * from `emarksheet_class`");
    57     $select_row =  $wpdb->get_results($select_query);
     61    $select_row =  $wpdb->get_results($wpdb->prepare("select * from `emarksheet_class`"));
    5862?>
    5963<span style="float:right;">
    … …  
    109113        </div>
    110114        <div class="modal-body">
    111             <form action="" method="post">
     115            <form action="?page=eMarksheet-main&_wpnonce=<?php echo esc_html($nonce); ?>" method="post">
    112116            Enter the Name of the Class You want to add<br/>
    113117            <input type="text" autocomplete="off" class="span4 text" name="name" style="margin-top:12px;height:25px;" id="subname"><br/>

  • emarksheet/trunk/menu-pages/emark_add_marks.php

    r3265606 r3265698  
    1 <!---load bootstrap css----->
    2 <link rel='stylesheet' type='text/css' href='<?php echo esc_html(plugins_url('/bootstrap/css/bootstrap.css', __FILE__)); ?>' />
    31<br/><br/>
    42<?php
    … …  
    75{
    86    $id = esc_html($_GET['id']);
    9     $selectd_query = $wpdb->prepare("select * from `emarksheet_student` where `id`='$id'");
    10     $selectd_row =  $wpdb->get_results($selectd_query);
     7    $selectd_row =  $wpdb->get_results($wpdb->prepare("select * from `emarksheet_student` where `id`='$id'"));
    118    $su_n = $selectd_row[0]->class_id;
    129
    13     $selectd_query1 = $wpdb->prepare("select * from `emarksheet_subject` where `class`='$su_n'");
    14     $selectd_row1 =  $wpdb->get_results($selectd_query1);
     10    $selectd_row1 =  $wpdb->get_results($wpdb->prepare("select * from `emarksheet_subject` where `class`='$su_n'"));
    1511    ?>
    1612    <form action='<?php echo esc_url(admin_url("admin.php?page=eMarksheet-add-marks&action_new=add_marks_final&class_id=$su_n")); ?>' method='post'>
    … …  
    3834        $student_id = esc_html($_POST['st_id']);
    3935        $data = serialize($_POST);
    40         $gt_old = $wpdb->prepare("select * from `emarksheet_marks` where `student_id`='$student_id' AND `class_id`='$class_n'");
    41         $gt_old = $wpdb->get_results($gt_old);
     36        $gt_old = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_marks` where `student_id`='$student_id' AND `class_id`='$class_n'"));
    4237        if($gt_old)
    4338        {
    4439            $mk_id = $gt_old[0]->id;
    45             $upds = $wpdb->prepare("update `emarksheet_marks` set `marks`='$data' where `id`='$mk_id'");
    46             $wpdb->query($upds);
    47             //echo $wpdb->last_error;
     40            $wpdb->query($wpdb->prepare("update `emarksheet_marks` set `marks`='$data' where `id`='$mk_id'"));
     41               
    4842            echo "<div class='alert alert-success'> Marks Updated Successfully !!! </div>";
    4943        }
    5044        else
    5145        {
    52             $insert_st = $wpdb->prepare("insert into `emarksheet_marks`(`id`,`student_id`,`class_id`,`marks`) values('','$student_id','$class_n','$data')");
    53             $wpdb->query($insert_st);
     46            $wpdb->query($wpdb->prepare("insert into `emarksheet_marks`(`id`,`student_id`,`class_id`,`marks`) values('','$student_id','$class_n','$data')"));
    5447            echo "<div class='alert alert-success'> Marks Added Successfully !!! </div>";
    5548        }
    5649    }
    57     $select_qury1 = "select * from `emarksheet_class` where `id`='$class_n'";
    58     $select_data1 = $wpdb->get_results($select_qury1);
     50    $select_data1 = $wpdb->get_results("select * from `emarksheet_class` where `id`='$class_n'");
    5951    $class_name = $select_data1[0]->class_name;
    6052?>
    … …  
    6557<tr><th>Sr No</th><th>Roll No</th><th>Student Name</th><th>Father's Name</th><th>Mother's Name</th><th>Date Of Birth</th><th>Action</th></tr>
    6658<?php
    67 $select_qury2 = $wpdb->prepare("select * from `emarksheet_student` where `class_id`='$class_n'");
    68 $select_data2 = $wpdb->get_results($select_qury2);
     59$select_data2 = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_student` where `class_id`='$class_n'"));
    6960$i = 1;
    7061if($select_data2)
    … …  
    7768        echo esc_html($i);
    7869        ?>
    79         </td><td>.<?php echo esc_html($select_data2->roll_no)."</td><td>".esc_html($select_data2->first_n)." ".esc_html($select_data2->last_n)."</td><td>".esc_html($select_data2->father_n)."</td><td>".esc_html($select_data2->mother_n)."</td><td>".esc_html($select_data2->dob_date)."-".esc_html($select_data2->dob_month)."-".esc_html($select_data2->dob_year)."</td><td><a href='".esc_url(admin_url("admin.php?page=eMarksheet-add-marks&action=add_marks&id=$select_data2->id"))."' class='btn btn-danger'><i class='icon-white icon-plus'></i> &nbsp;&nbsp; Add Marks</a></td></tr>";
     70        </td><td><?php echo esc_html($select_data2->roll_no)."</td><td>".esc_html($select_data2->first_n)." ".esc_html($select_data2->last_n)."</td><td>".esc_html($select_data2->father_n)."</td><td>".esc_html($select_data2->mother_n)."</td><td>".esc_html($select_data2->dob_date)."-".esc_html($select_data2->dob_month)."-".esc_html($select_data2->dob_year)."</td><td><a href='".esc_url(admin_url("admin.php?page=eMarksheet-add-marks&action=add_marks&id=$select_data2->id"))."' class='btn btn-danger'><i class='icon-white icon-plus'></i> &nbsp;&nbsp; Add Marks</a></td></tr>";
    8071    $i++;
    8172    }
    … …  
    9485See the list of Enrolled Students for each Class. First Select the class :
    9586<?php
    96 $select_qury = $wpdb->prepare("select * from `emarksheet_class`");
    97 $select_data = $wpdb->get_results($select_qury);
     87$select_data = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_class`"));
    9888?>
    9989<form method="post" action="#">

  • emarksheet/trunk/menu-pages/emark_add_student.php

    r3265646 r3265698  
    1 <!---load bootstrap css----->
    2 <link rel='stylesheet' type='text/css' href='<?php echo esc_url(plugins_url('/bootstrap/css/bootstrap.css', __FILE__)); ?>' />
    31<br/><br/><div class='alert alert-info'>Enroll the students in the class</div>
    42<?php
    53global $wpdb;
    6 $select_qury = $wpdb->prepare("select * from `emarksheet_class`");
    7 $select_data = $wpdb->get_results($select_qury);
     4$nonce = wp_create_nonce( 'my-nonce' );
     5$select_data = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_class`"));
    86if(isset($_POST['enroll']))
    97{
    10     $class = strip_tags($_POST['class_n']);
    11     $roll_n = strip_tags($_POST['roll_number']);
    12     $first_n = strip_tags($_POST['first_n']);
    13     $last_n = strip_tags($_POST['last_n']);
    14     $father_n = strip_tags($_POST['f_name']);
    15     $mother_n = strip_tags($_POST['m_name']);
    16     $dob_date = strip_tags($_POST['dob_date']);
    17     $dob_m= strip_tags($_POST['dob_month']);
    18     $dob_y = strip_tags($_POST['dob_year']);
    19     $insert_query= $wpdb->prepare("insert into `emarksheet_student`(`id`,`class_id`,`roll_no`,`first_n`,`last_n`,`father_n`,`mother_n`,`dob_date` ,`dob_month`,`dob_year`) values('','$class','$roll_n','$first_n','$last_n','$father_n','$mother_n','$dob_date','$dob_m','$dob_y')");
    20     $wpdb->query($insert_query);
     8    $nonce1 = $_REQUEST['_wpnonce'];
     9
     10if ( ! wp_verify_nonce( $nonce1, 'my-nonce' ) ) {
     11
     12     die( 'Security check' );
     13
     14} else {
     15    $class = wp_strip_all_tags($_POST['class_n']);
     16    $roll_n = wp_strip_all_tags($_POST['roll_number']);
     17    $first_n = wp_strip_all_tags($_POST['first_n']);
     18    $last_n = wp_strip_all_tags($_POST['last_n']);
     19    $father_n = wp_strip_all_tags($_POST['f_name']);
     20    $mother_n = wp_strip_all_tags($_POST['m_name']);
     21    $dob_date = wp_strip_all_tags($_POST['dob_date']);
     22    $dob_m= wp_strip_all_tags($_POST['dob_month']);
     23    $dob_y = wp_strip_all_tags($_POST['dob_year']);
     24    $wpdb->query($wpdb->prepare("insert into `emarksheet_student`(`id`,`class_id`,`roll_no`,`first_n`,`last_n`,`father_n`,`mother_n`,`dob_date` ,`dob_month`,`dob_year`) values('','$class','$roll_n','$first_n','$last_n','$father_n','$mother_n','$dob_date','$dob_m','$dob_y')"));
    2125    echo "<div class='alert alert-success'>New Student Enrolled Successfully !!!</div>";
    2226}
     27}
    2328?>
    24 <form method="post" action="#">
     29<form method="post" action="?page=eMarksheet-student&_wpnonce=<?php echo esc_html($nonce); ?>">
    2530<table class="responsive display table table-bordered">
    2631<tr><td> Select Class : </td><td>
    … …  
    95100</select>
    96101&nbsp;&nbsp;
    97 <input type="text" style="width:100px;" name="dob_year" placeholder="YEAR" />
     102<input type="text" style="width:100px;" required name="dob_year" minlength="4"  maxlength="4" placeholder="YEAR" />
    98103</td>
    99104</tr>

  • emarksheet/trunk/menu-pages/emark_add_student_list.php

    r3265638 r3265698  
    1 <!---load bootstrap css----->
    2 <link rel='stylesheet' type='text/css' href='<?php echo esc_url(plugins_url('/bootstrap/css/bootstrap.css', __FILE__)); ?>' />
     1
    32<script type="text/javascript">
    43function show_confirm() {
    … …  
    1110if(isset($_POST['update_name']))
    1211{
    13     $up_id = esc_html($_POST['up_id']);
    14     $class = esc_html($_POST['class_nm']);
    15     $roll_n = esc_html($_POST['roll_number']);
    16     $first_n = esc_html($_POST['first_n']);
    17     $last_n = esc_html($_POST['last_n']);
    18     $father_n = esc_html($_POST['f_name']);
    19     $mother_n = esc_html($_POST['m_name']);
    20     $dob_date = esc_html($_POST['dob_date']);
    21     $dob_m= esc_html($_POST['dob_month']);
    22     $dob_y = esc_html($_POST['dob_year']);
    23     $update_query = $wpdb->prepare("update `emarksheet_student` set `class_id`='$class',
     12    $up_id = wp_unslash($_POST['up_id']);
     13    $class = wp_unslash($_POST['class_nm']);
     14    $roll_n = wp_unslash($_POST['roll_number']);
     15    $first_n = wp_unslash($_POST['first_n']);
     16    $last_n = wp_unslash($_POST['last_n']);
     17    $father_n = wp_unslash($_POST['f_name']);
     18    $mother_n = wp_unslash($_POST['m_name']);
     19    $dob_date = wp_unslash($_POST['dob_date']);
     20    $dob_m= wp_unslash($_POST['dob_month']);
     21    $dob_y = wp_unslash($_POST['dob_year']);
     22    $wpdb->query($wpdb->prepare("update `emarksheet_student` set `class_id`='$class',
    2423    `roll_no`='$roll_n',`first_n`='$first_n',`last_n`='$last_n',`father_n`='$father_n',`mother_n`='$mother_n',
    25     `dob_date`='$dob_date',`dob_month`='$dob_m',`dob_year`='$dob_y' where `id`='$up_id'");
    26     $wpdb->query($update_query);
     24    `dob_date`='$dob_date',`dob_month`='$dob_m',`dob_year`='$dob_y' where `id`='$up_id'"));
    2725    echo "<div class='alert alert-success'>Student Name Updated Successfully</div>";
    2826    echo "<script>setTimeout(location.href='".esc_url(admin_url("admin.php?page=eMarksheet-student-list"))."',6000)</script>";
    … …  
    3331{
    3432    $iddelt = $_GET['id'];
    35     $delete_query = $wpdb->prepare("delete from `emarksheet_student` where `id`='$iddelt'");
    36     $wpdb->query($delete_query);
     33    $wpdb->query($wpdb->prepare("delete from `emarksheet_student` where `id`='$iddelt'"));
    3734    echo "<div class='alert alert-success'>Student Name Deleted Successfully</div>";
    3835    echo "<script>setTimeout(location.href='".esc_url(admin_url("admin.php?page=eMarksheet-student-list"))."',6000)</script>";
    … …  
    4138{
    4239    $idd = $_GET['id'];
    43     $selectd_query = $wpdb->prepare("select * from `emarksheet_student` where `id`='$idd'");
    44     $selectd_row =  $wpdb->get_results($selectd_query);
     40    $selectd_row =  $wpdb->get_results($wpdb->prepare("select * from `emarksheet_student` where `id`='$idd'"));
    4541    $class_ida = $selectd_row[0]->class_id;
    4642    $rollno = $selectd_row[0]->roll_no;
    … …  
    5248    $dob_m = $selectd_row[0]->dob_month;
    5349    $dob_y = $selectd_row[0]->dob_year;
    54     $select_dd = $wpdb->prepare("select * from `emarksheet_class`");
    55     $select_data =  $wpdb->get_results($select_dd);
     50    $select_data =  $wpdb->get_results($wpdb->prepare("select * from `emarksheet_class`"));
    5651    ?>
    5752    <form method="post" action="#">
    … …  
    6358    foreach($select_data as $select_data)
    6459    {
    65         if($select_data->id == $class_ida)
    66             echo "<option value='$select_data->id' selected='selected'>$select_data->class_name </option>";
    67         else
    68             echo "<option value='$select_data->id'>$select_data->sem </option>";
     60        if($select_data->id == $class_ida){
     61            ?>
     62        <option value='<?php echo esc_html($select_data->id); ?>' selected='selected'><?php echo esc_html($select_data->class_name);?> </option>
     63        <?php
     64        }else
     65        ?><option value='<?php echo esc_html($select_data->id);?>'><?php echo esc_html($select_data->sem); ?> </option>
     66    <?php
    6967    }
    7068    ?>
    … …  
    149147{
    150148    $class_n = $_POST['class_n'];
    151     $select_qury1 = $wpdb->prepare("select * from `emarksheet_class` where `id`='$class_n'");
    152     $select_data1 = $wpdb->get_results($select_qury1);
     149    $select_data1 = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_class` where `id`='$class_n'"));
    153150    $class_name = $select_data1[0]->class_name;
    154151?>
    … …  
    159156<tr><th>Sr No</th><th>Roll No</th><th>Student Name</th><th>Father's Name</th><th>Mother's Name</th><th>Date Of Birth</th><th>Action</th></tr>
    160157<?php
    161 $select_qury2 = $wpdb->prepare("select * from `emarksheet_student` where `class_id`='$class_n'");
    162 $select_data2 = $wpdb->get_results($select_qury2);
     158$select_data2 = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_student` where `class_id`='$class_n'"));
    163159$i = 1;
    164160if($select_data2)
    … …  
    173169        </td><td><?php echo esc_html($select_data2->mother_n); ?></td><td><?php echo esc_html($select_data2->dob_date)."-".esc_html($select_data2->dob_month)."-".esc_html($select_data2->dob_year); ?>
    174170        </td><td> &nbsp;&nbsp;&nbsp;&nbsp;<a href='<?php echo esc_url(admin_url("admin.php?page=eMarksheet-student-list&action=update&id=$select_data2->id"));?>' rel='tooltip' title='update' class='update'>
    175         <i class='icon-pencil'></i></a> &nbsp;&nbsp; <a href='<?php echo esc_url(admin_url("admin.php?page=eMarksheet-student-list&action=delete&id=$select_data2->id"));?>' onclick='return show_confirm();' rel='tooltip' title='Delete' class='delete'><i class='icon-trash'></i></a></td></tr>";
     171        <i class='icon-pencil'></i></a> &nbsp;&nbsp; <a href='<?php echo esc_url(admin_url("admin.php?page=eMarksheet-student-list&action=delete&id=$select_data2->id"));?>' onclick='return show_confirm();' rel='tooltip' title='Delete' class='delete'><i class='icon-trash'></i></a></td></tr>
    176172    <?php
    177173    $i++;
    … …  
    191187See the list of Enrolled Students for each Class. First Select the class :
    192188<?php
    193 $select_qury = $wpdb->prepare("select * from `emarksheet_class`");
    194 $select_data = $wpdb->get_results($select_qury);
     189$select_data = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_class`"));
    195190?>
    196191<form method="post" action="#">
    … …  
    199194    foreach($select_data as $select_data)
    200195    {
    201         echo "<option value='$select_data->id'>$select_data->class_name </option>";
     196        ?>
     197        <option value='<?php echo esc_html($select_data->id); ?>'><?php echo esc_html($select_data->class_name);?> </option>
     198        <?php
    202199    }
    203200?>

  • emarksheet/trunk/menu-pages/emark_add_sub.php

    r3265606 r3265698  
    1 <!---load bootstrap css----->
    2 <link rel='stylesheet' type='text/css' href='<?php echo esc_url(plugins_url('/bootstrap/css/bootstrap.css', __FILE__)); ?>' />
     1
    32
    43<div class='span12' style='margin-top:20px;'>
    … …  
    87if(isset($_POST['add_quiz']))
    98{
    10     $quiz_n = wp_strip_all_tags($_POST['qz_n']);
    11     $sub_id = wp_strip_all_tags($_POST['sub_nm']);
    12     $tot_m = wp_strip_all_tags($_POST['tot_m']);
    13     $min_pass = wp_strip_all_tags($_POST['min_pass']);
    14     $insert_queryr = $wpdb->prepare("insert into `emarksheet_subject`(`id`,`class`,`sub_name`,`min_pass`,`total_marks`) values('','$sub_id','$quiz_n','$min_pass','$tot_m')");
    15     $wpdb->query($insert_queryr);
     9    $quiz_n = wp_unslash($_POST['qz_n']);
     10    $sub_id = wp_unslash($_POST['sub_nm']);
     11    $tot_m = wp_unslash($_POST['tot_m']);
     12    $min_pass = wp_unslash($_POST['min_pass']);
     13    $wpdb->query($wpdb->prepare("insert into `emarksheet_subject`(`id`,`class`,`sub_name`,`min_pass`,`total_marks`) values('','$sub_id','$quiz_n','$min_pass','$tot_m')"));
    1614    echo "<div class='alert alert-success'>Subject Name Added Successfully</div>";
    1715}
    … …  
    1917if(isset($_POST['update_name']))
    2018{
    21     $up_su_n = wp_strip_all_tags($_POST['up_su_n']);
    22     $up_su_id = wp_strip_all_tags($_POST['up_id']);
    23     $up_su_ss = wp_strip_all_tags($_POST['sub_nm']);
    24     $up_su_tm = wp_strip_all_tags($_POST['tot_m']);
    25     $up_su_mp = wp_strip_all_tags($_POST['min_pass']);
    26     $update_query = $wpdb->prepare("update `emarksheet_subject` set `sub_name`='$up_su_n',`class`='$up_su_ss',`total_marks`='$up_su_tm',`min_pass`='$up_su_mp' where `id`='$up_su_id'");
    27     $wpdb->query($update_query);
     19    $up_su_n = wp_unslash($_POST['up_su_n']);
     20    $up_su_id = wp_unslash($_POST['up_id']);
     21    $up_su_ss = wp_unslash($_POST['sub_nm']);
     22    $up_su_tm = wp_unslash($_POST['tot_m']);
     23    $up_su_mp = wp_unslash($_POST['min_pass']);
     24    $wpdb->query($wpdb->prepare("update `emarksheet_subject` set `sub_name`='$up_su_n',`class`='$up_su_ss',`total_marks`='$up_su_tm',`min_pass`='$up_su_mp' where `id`='$up_su_id'"));
    2825    echo "<div class='alert alert-success'>Subject Name Updated Successfully</div>";
    2926    echo "<script>setTimeout(location.href='".esc_url(admin_url("admin.php?page=eMarksheet-subject"))."',6000)</script>";
    3027}
    31 $select_qury = "select * from `emarksheet_class`";
    32 $select_data = $wpdb->get_results($select_qury);
     28$select_data = $wpdb->get_results("select * from `emarksheet_class`");
    3329
    34 $select_quiz = "select * from `emarksheet_subject`";
    35 $select_data_quiz = $wpdb->get_results($select_quiz);
     30
     31$select_data_quiz = $wpdb->get_results("select * from `emarksheet_subject`");
    3632if(isset($_GET['action']))
    3733{
    … …  
    3935    {
    4036        $iddelt = esc_html($_GET['id']);
    41         $delete_query = $wpdb->prepare("delete from `emarksheet_subject` where `id`='$iddelt'");
    42         $wpdb->query($delete_query);
     37        $wpdb->query($wpdb->prepare("delete from `emarksheet_subject` where `id`='$iddelt'"));
    4338        echo "<div class='alert alert-success'>subject Name Deleted Successfully</div>";
    4439        echo "<script>setTimeout(location.href='".esc_url(admin_url("admin.php?page=eMarksheet-subject"))."',6000)</script>";
    … …  
    4742    {
    4843        $idd = $_GET['id'];
    49         $selectd_query = $wpdb->prepare("select * from `emarksheet_subject` where `id`='$idd'");
    50         $selectd_row =  $wpdb->get_results($selectd_query);
     44        $selectd_row =  $wpdb->get_results($wpdb->prepare("select * from `emarksheet_subject` where `id`='$idd'"));
     45        //$selectd_row =  $wpdb->get_results($selectd_query);
    5146        $su_n = $selectd_row[0]->sub_name;
    5247        $sub_id = $selectd_row[0]->class;
    … …  
    6257        foreach($select_data as $select_data)
    6358        {
    64             if($select_data->id == $sub_id)
    65                 echo "<option value='$select_data->id' selected='selected'>$select_data->class_name </option>";
    66             else
    67                 echo "<option value='$select_data->id'>esc_html($select_data->class_name)</option>";
    68         }
     59            if($select_data->id == $sub_id){
     60                ?><option value='<?php echo esc_html($select_data->id);?>' selected='selected'><?php echo esc_html($select_data->class_name); ?> </option>
     61            <?php
     62            }else{
     63                ?><option value='<?php echo esc_html($select_data->id); ?>'><?php echo esc_html($select_data->class_name); ?></option>
     64                <?php
     65        }}
    6966        ?>
    7067        </select> &nbsp;&nbsp;&nbsp;&nbsp;
    … …  
    123120    foreach($select_data_quiz as $select_data_quiz)
    124121    {
    125         $select_sub = $wpdb->prepare("select * from `emarksheet_class` where `id`='$select_data_quiz->class'");
    126         $select_sub_quiz = $wpdb->get_results($select_sub);
     122            $select_sub_quiz = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_class` where `id`='$select_data_quiz->class'"));
    127123        ?>
    128         <tr><td><?php echo $i; ?></td><td><?php echo esc_html(ucfirst($select_sub_quiz[0]->class_name)); ?></td><td><?php echo esc_html(ucfirst($select_data_quiz->sub_name)); ?></td>
     124        <tr><td><?php echo esc_html($i); ?></td><td><?php echo esc_html(ucfirst($select_sub_quiz[0]->class_name)); ?></td><td><?php echo esc_html(ucfirst($select_data_quiz->sub_name)); ?></td>
    129125        <td><?php echo esc_html($select_data_quiz->total_marks);?></td><td><?php echo esc_html($select_data_quiz->min_pass);?></td><td> &nbsp;&nbsp;&nbsp;&nbsp;<a href='<?php echo esc_url("admin.php?page=eMarksheet-subject&action=update&id=$select_data_quiz->id");?>' rel='tooltip' title='update' class='update'><i class='icon-pencil'></i></a> &nbsp;&nbsp; <a href='<?php echo esc_url("admin.php?page=eMarksheet-subject&action=delete&id=$select_data_quiz->id");?>' onclick='return show_confirm();' rel='tooltip' title='Delete' class='delete'><i class='icon-trash'></i></a></td></tr>
    130126        <?php

  • emarksheet/trunk/menu-pages/help.php

    r3265541 r3265698  
    1 <link rel='stylesheet' type='text/css' href='<?php echo esc_url(plugins_url('/bootstrap/css/bootstrap.css', __FILE__)); ?>' />
    2 <link rel='stylesheet' type='text/css' href='<?php echo esc_url(plugins_url('/bootstrap/css/bootstrap-responsive.css', __FILE__)); ?>' />
     1
    32<div class=" span12 alert alert-info" style="margin-top:20px;">
    43<h3>Help & Support</h3>

  • emarksheet/trunk/menu-pages/print.php

    r3265646 r3265698  
    1 <!---load bootstrap css----->
    2 <link rel='stylesheet' type='text/css' href='<?php echo esc_url(plugins_url('/bootstrap/css/bootstrap.css', __FILE__)); ?>' />
     1
    32<style>
    43#print {
    … …  
    2726if(isset($_GET['action']))
    2827{
    29     $sett = $wpdb->prepare("select * from `emarksheet_setting`");
    30     $get_s = $wpdb->get_results($sett);
    31    
     28    $get_s = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_setting`"));
     29
    3230    $sid = $_GET['id'];
    33     $get_m = $wpdb->prepare("select * from `emarksheet_marks` where `student_id` = '$sid'");
    34     $get_st_l = $wpdb->get_results($get_m);
     31    $get_st_l = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_marks` where `student_id` = '$sid'"));
    3532    $gee_cl = $get_st_l[0]->class_id;
    3633
    … …  
    4037    $count = count($marks)/2;
    4138
    42     $select_qury5 = $wpdb->prepare("select * from `emarksheet_student` where `id`='$sid'");
    43     $select_data5 = $wpdb->get_results($select_qury5);
     39    $select_data5 = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_student` where `id`='$sid'"));
     40   
     41    $get_cl_l = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_subject` where `class` = '$gee_cl'"));
    4442
    45     $get_class_l = $wpdb->prepare("select * from `emarksheet_subject` where `class` = '$gee_cl'");
    46     $get_cl_l = $wpdb->get_results($get_class_l);
     43    $get_cl_li = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_class` where `id` = '$gee_cl'"));
    4744
    48     $get_class_li = $wpdb->prepare("select * from `emarksheet_class` where `id` = '$gee_cl'");
    49     $get_cl_li = $wpdb->get_results($get_class_li);
    5045   
    5146    echo "<div class='print' id='print'><center><h1>".esc_html($get_s[0]->school_name)."</h1></center><center><div style='font-size:18px;'>".esc_html($get_s[0]->address)." , ".esc_html($get_s[0]->district)." ( ". esc_html($get_s[0]->state) ." ) "."<br/><br/>PROGRESS REPORT</div></center><br/><br/>";
    … …  
    7570            {
    7671                $fails = '0';
     72                $fail2 = '0';
    7773            }
    7874            ?>
    … …  
    127123{
    128124    $class_n = $_POST['class_n'];
    129     $select_qury1 = "select * from `emarksheet_class` where `id`='$class_n'";
    130     $select_data1 = $wpdb->get_results($select_qury1);
     125    $select_data1 = $wpdb->get_results("select * from `emarksheet_class` where `id`='$class_n'");
    131126    $class_name = $select_data1[0]->class_name;
    132127?>
    … …  
    137132<tr><th>Sr No</th><th>Roll No</th><th>Student Name</th><th>Father's Name</th><th>Mother's Name</th><th>Date Of Birth</th><th>Action</th></tr>
    138133<?php
    139 $select_qury2 = "select * from `emarksheet_student` where `class_id`='$class_n'";
    140 $select_data2 = $wpdb->get_results($select_qury2);
     134$select_data2 = $wpdb->get_results("select * from `emarksheet_student` where `class_id`='$class_n'");
    141135$i = 1;
    142136if($select_data2)
    … …  
    168162To Print the marksheet of the student, Please First Select the class :
    169163<?php
    170 $select_qury = "select * from `emarksheet_class`";
    171 $select_data = $wpdb->get_results($select_qury);
     164$select_data = $wpdb->get_results("select * from `emarksheet_class`");
    172165?>
    173166<form method="post" action="#">

  • emarksheet/trunk/menu-pages/settings.php

    r3265638 r3265698  
    1 <!---load bootstrap css----->
    2 <link rel='stylesheet' type='text/css' href='<?php echo esc_url(plugins_url('/bootstrap/css/bootstrap.css', __FILE__)); ?>' />
     1
    32<br/><br/>
    43<?php
    … …  
    65if(isset($_POST['save']))
    76{
    8     $name_sc = strip_tags($_POST['sch_name']);
    9     $address = strip_tags($_POST['address']);
    10     $district = strip_tags($_POST['district']);
    11     $state = strip_tags($_POST['state']);
    12     $phone_n  = strip_tags($_POST['phone_n']);
    13     $principal = strip_tags($_POST['principle']);
    14     $insert_q = $wpdb->prepare("insert into `emarksheet_setting`(`id`,`school_name`,`address`,`district`,`state`,`phone`,`name_of_principal`) values('','$name_sc','$address','$district','$state','$phone_n','$principal')");
    15     $wpdb->query($insert_q);
     7    $name_sc = wp_unslash($_POST['sch_name']);
     8    $address = wp_unslash($_POST['address']);
     9    $district = wp_unslash($_POST['district']);
     10    $state = wp_unslash($_POST['state']);
     11    $phone_n  = wp_unslash($_POST['phone_n']);
     12    $principal = wp_unslash($_POST['principle']);
     13    $wpdb->query($wpdb->prepare("insert into `emarksheet_setting`(`id`,`school_name`,`address`,`district`,`state`,`phone`,`name_of_principal`) values('','$name_sc','$address','$district','$state','$phone_n','$principal')"));
    1614    echo "<div class='alert alert-success'>Settins Saved Successfully !!! </div>";
    1715}
    18 $select = $wpdb->prepare("select * from `emarksheet_setting` ORDER BY `id` DESC limit 1");
    19 $get_r = $wpdb->get_results($select);
     16$get_r = $wpdb->get_results($wpdb->prepare("select * from `emarksheet_setting` ORDER BY `id` DESC limit 1"));
    2017?>
    2118<form method="post" action="#">

  • emarksheet/trunk/menu-pages/uninstall.php

    r958028 r3265698  
    33{
    44    global $wpdb;
    5     $query1 = "DROP table `emarksheet_class`";
    6     $wpdb->query($query1);
     5    $wpdb->query("DROP table `emarksheet_class`");
    76   
    8     $query = "DROP table `emarksheet_marks`";
    9     $wpdb->query($query);
     7    $wpdb->query("DROP table `emarksheet_marks`");
    108   
    11     $query2 = "DROP table `emarksheet_setting`";
    12     $wpdb->query($query2);
    13     $query3 = "DROP table `emarksheet_student`";
    14     $wpdb->query($query3);
     9    $wpdb->query("DROP table `emarksheet_setting`");
    1510
    16     $query4 = "DROP table `emarksheet_subject`";
    17     $wpdb->query($query4);
     11    $wpdb->query("DROP table `emarksheet_student`");
     12
     13    $wpdb->query("DROP table `emarksheet_subject`");
    1814       
    1915    $plugin = "eMarksheet/emarksheet.php";

  • emarksheet/trunk/readme.txt

    r3265541 r3265698  
    77Requires at least: 4.1
    88Tested up to: 6.7.2
    9 Stable tag: 5.4.3
     9Stable tag: 5.4.4
    1010
    1111== Short Description ==
    … …  
    117117=5.4.0=
    118118XSS Vulnerability resolved
     119
     120=5.4.4=
     121XSS Vulnerability resolved
Note: See TracChangeset for help on using the changeset viewer.