get_filter_entries now generating invalid SQL

Replies: 1

It looks like Forminator_Form_Entry_Model::get_filter_entries was modified in the last release (1.29.3). Including changing this code:

if ( isset( $filters['order'] ) ) {
    $order = esc_sql( $filters['order'] );
}

to:

if ( isset( $filters['order'] ) ) {
    $order = $wpdb->prepare("%s", $filters['order'] );
}

As a result if you pass in ‘ASC’ for $filters[‘order’] the SQL generated ends:

...GROUP BY entries.entry_id ORDER BY entries.entry_id 'ASC'

The quotes around ASC make this SQL invalid (which it wasn’t before this release).