BMLTGuy

I also had to do this:

* {
outline: none !important;
}

It’s a kludge.

I’m waiting to see what bubbles out of their next fix, before doing a more graceful fix.

@hutman thanks so much!

This is awful. Same thing happened to me. The x only deletes it once. It comes back every time I go in.

Goodbye Subscribe 2.

VERY bad idea.

OK. I just took a look at this.

The fix will work, but that’s because the author is not using prepare() correctly.

I use PDB in my own work, so I’m used to prepared statements.

The way they work, is that you break out the values into a separate array, and replace them with placeholders in the SQL. You then send the SQL and the array into the prepare() statement, and the prepare() statement will take care of scrubbing the values and inserting them into the SQL before sending it to the SQL engine.

If the SQL statement has no placeholders (‘?’ in PDB. I don’t know enough about wpdb to see if it’s the same, but I’ll bet yeah), then you can just give the prepare() statement the entire SQL query in the first argument. It will run it, just like a standard SQL query.

However, that also neuters the cleaning and security goodness of a prepare() statement.

It looks like the author used standard WP DB calls, then modified them to work pretty much “as is” with wpdb. They should have broken up the queries, and fed them in two parts, like I do PDB.

Looks like older versions of wpdb were relaxed about the second parameter (the array), but now require it. If you have no data array, then null will do fine.

I’d have to spend some time examining the plugin to see if it’s a security risk. I’d say yeah. If it has been abandoned, and doesn’t use prepare() correctly, then it may be ripe for an SQL injection attack.

I won’t be using it, which is a shame, because it really seems to have what I need. However, I may give it a once-over, and see if I can tweak it for my needs.